file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 2.4MB
Sample260604-vjftmsbs3y
SHA256 dc65030a0e285fb075eaa4767a03a97e1dfcd08490d6af9d59b928b9062023b3
MD5 5d1827bdd49fa353c2f67d2130c8c02f
SHA1 c8a596a0cab9cef739c5d3059066711d624c84b6
SHA512 b6084941ac54edfcaeeef44388958ff954718d9b35592a5a3dad9c9567ee44c2666dab9c4039101f34103436b5981449c467d9504e56d1c7242177cf1f080944
SSDEEP 49152:JhXbZPX110tL+Qr5hBnUua3zy8eEQWTo:Jhx3urYFT
TLSH
T13CB5D50D011447DCC97D823694CF26ADA010332C62781FBEB6665EB18F75BD87EE5A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 2.4MB

file.exe

IMPHASH af9a47539f01e4b6a139b2f89653da6e
SHA256 dc65030a0e285fb075eaa4767a03a97e1dfcd08490d6af9d59b928b9062023b3
MD5 5d1827bdd49fa353c2f67d2130c8c02f
SHA1 c8a596a0cab9cef739c5d3059066711d624c84b6
SHA512 b6084941ac54edfcaeeef44388958ff954718d9b35592a5a3dad9c9567ee44c2666dab9c4039101f34103436b5981449c467d9504e56d1c7242177cf1f080944
SSDEEP 49152:JhXbZPX110tL+Qr5hBnUua3zy8eEQWTo:Jhx3urYFT
TLSH
T13CB5D50D011447DCC97D823694CF26ADA010332C62781FBEB6665EB18F75BD87EE5A8B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1943716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAGetLastError

bcrypt

BCryptGenRandom

kernel32

CloseHandle GetTempFileNameW GetTempPathW GetModuleHandleA GetProcAddress GetUserDefaultLCID HeapReAlloc ReadConsoleW WriteConsoleW CreateFileW HeapSize SetStdHandle SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP WideCharToMultiByte MultiByteToWideChar ExitProcess GetLastError FindClose FindFirstFileExW FindNextFileW WriteProcessMemory GetModuleHandleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime FlushFileBuffers LocalFree EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW IsValidCodePage

ole32

CoUninitialize CoSetProxyBlanket CoCreateInstance CoInitializeEx

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlUnwindEx RtlUnwind

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

197KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

ws2_32

bcrypt

kernel32

ole32

oleaut32

ntdll

generic