01[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
01.exe
Size 46KB
Sample260417-as8wkags21
SHA256 7c653beb8859964f06f508f963bc9e7440f71a9a7558f1a7f61d99e12b82fc98
MD5 7170a9841339953ff2e7fa3d57b6d1fd
SHA1 d7e6dd3876e2609320e29221cc73c8c51538c2d9
SHA512 2c4f409cf1dcfe8eddf1ced492ddeee2835945b599a794144d6d53cd66cdb0496e8c38b7365e1a932f0dd8d776c34624db90496f7a74e7bc28f971a01cfa23ff
SSDEEP 768:L8r40O85XvHSYrN87kPQqPQvtD/eJLPwUFqN5bTtDbI3QOC:L880fHSYrNojD4L8p3DOC
TLSH
T11223731ADD2ED0A7C279A874D5421519FC617CD68BF8A7C3AF410DC606B3BE4AA3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01.exe

File Explorer

01.exe

.exe 46KB

01.exe

IMPHASH df1c8a39b2d76c252713425650d481e5
SHA256 7c653beb8859964f06f508f963bc9e7440f71a9a7558f1a7f61d99e12b82fc98
MD5 7170a9841339953ff2e7fa3d57b6d1fd
SHA1 d7e6dd3876e2609320e29221cc73c8c51538c2d9
SHA512 2c4f409cf1dcfe8eddf1ced492ddeee2835945b599a794144d6d53cd66cdb0496e8c38b7365e1a932f0dd8d776c34624db90496f7a74e7bc28f971a01cfa23ff
SSDEEP 768:L8r40O85XvHSYrN87kPQqPQvtD/eJLPwUFqN5bTtDbI3QOC:L880fHSYrNojD4L8p3DOC
TLSH
T11223731ADD2ED0A7C279A874D5421519FC617CD68BF8A7C3AF410DC606B3BE4AA3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle HeapCreate HeapDestroy HeapAlloc HeapFree WaitForSingleObject CreateThread SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

vcruntime140

__C_specific_handler __current_exception __current_exception_context __std_exception_copy _CxxThrowException memchr memset memcpy __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _exit exit _initterm_e _initterm _get_initial_narrow_environment _c_exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_narrow_argv __p___argc _set_app_type __p___argv _cexit _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free