selam[.]exe | Triage™

General

Target
selam.exe
Size 234KB
Sample260623-ecth6aav6z
SHA256 01f288daf9ca08857b51c550a0e4b1d422724de883d984780fb8c493f2e2c859
MD5 940179a5ce44cac5fa507c6969fbaf9b
SHA1 c7990f78f85638a3a5081fdf288c769abc5f8c1a
SHA512 3f930893c45e77c830b063c8ca88669405d62337f9555032df47157dcc0d9d9c9d79c00721b5dea18f401597a6fb30e85fe50ecf96fbb585db95d9b51b96de7c
SSDEEP 3072:UpT2Fr2cd0ZugqR7SGa4bU7ATZp7OZCFxCwWRQcOn12mE6zA7psmcVXsdGs8:UpT2oHGaUU7uKqTWA1Anss
TLSH
T104348E1577A90CF9E97B953DCC820906DA727C5247A0EACF03A04A974F27BE49E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
selam.exe

File Explorer

selam.exe

.exe 234KB

selam.exe

IMPHASH 23ca09086753553511ffd53baf06f102
SHA256 01f288daf9ca08857b51c550a0e4b1d422724de883d984780fb8c493f2e2c859
MD5 940179a5ce44cac5fa507c6969fbaf9b
SHA1 c7990f78f85638a3a5081fdf288c769abc5f8c1a
SHA512 3f930893c45e77c830b063c8ca88669405d62337f9555032df47157dcc0d9d9c9d79c00721b5dea18f401597a6fb30e85fe50ecf96fbb585db95d9b51b96de7c
SSDEEP 3072:UpT2Fr2cd0ZugqR7SGa4bU7ATZp7OZCFxCwWRQcOn12mE6zA7psmcVXsdGs8:UpT2oHGaUU7uKqTWA1Anss
TLSH
T104348E1577A90CF9E97B953DCC820906DA727C5247A0EACF03A04A974F27BE49E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyKey BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDeriveKeyPBKDF2

kernel32

FreeLibrary WriteConsoleW CreateFileW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW FindNextFileW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess RtlUnwind GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW

Name

.text

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

selam.exe

bcrypt

kernel32

generic