file[.]exe | Triage™

General

Target
file.exe
Size 54KB
Sample260623-m96tracs2k
SHA256 32075d40944320f51e3e5014c7b210ce61306868fb3cf69b0ad6ef5fa92ca7b4
MD5 70641963e686a3aea2215df8ba086040
SHA1 8481056d1a3f5b09ab05035c01168ca723f1a1d1
SHA512 81706a7de0fad7c546e5780081a7cd4f8912b071b1d102f95fc36d84a5ad120500faca24a7bc92012b72085364ad07c05ad486e3f1242a5955a6318cd6f69f88
SSDEEP 768:IpMG/0vaXDiTLlGCI0App3uWSph6koM3R+qsq:6aEiTLXA3+fp4koUR+v
TLSH
T19F43C79167F9151AF6F38E783C7465968C7BBE726D61E08E8280204F0875B95CE78B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 54KB

file.exe

IMPHASH 83fa772670ac674cd68ff73f3ef04802
SHA256 32075d40944320f51e3e5014c7b210ce61306868fb3cf69b0ad6ef5fa92ca7b4
MD5 70641963e686a3aea2215df8ba086040
SHA1 8481056d1a3f5b09ab05035c01168ca723f1a1d1
SHA512 81706a7de0fad7c546e5780081a7cd4f8912b071b1d102f95fc36d84a5ad120500faca24a7bc92012b72085364ad07c05ad486e3f1242a5955a6318cd6f69f88
SSDEEP 768:IpMG/0vaXDiTLlGCI0App3uWSph6koM3R+qsq:6aEiTLXA3+fp4koUR+v
TLSH
T19F43C79167F9151AF6F38E783C7465968C7BBE726D61E08E8280204F0875B95CE78B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcr90

_except_handler4_common _invoke_watson _decode_pointer _crt_debugger_hook _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ iswspace __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _wcmdln exit _XcptFilter _exit _cexit __wgetmainargs _amsg_exit wcsstr wcschr wcsncat_s wcscat_s memset _wfopen fgetws wcstok wcscat fclose wcscmp wcslen _controlfp_s

wininet

InternetOpenUrlW InternetCloseHandle InternetOpenW

shlwapi

StrCmpNW PathMatchSpecW PathFileExistsW PathCombineW

kernel32

QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoW InterlockedCompareExchange InterlockedExchange Sleep CreateMutexA ExitProcess GetLastError CreateThread ExitThread GetLogicalDrives GetDriveTypeW GetTickCount lstrcpyW FindFirstFileW lstrcmpW FindNextFileW GlobalLock GlobalUnlock ExpandEnvironmentStringsW CreateFileW CloseHandle TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCurrentProcessId QueryDosDeviceW GetSystemTimeAsFileTime

user32

wsprintfW CloseClipboard OpenClipboard CharLowerW GetClipboardData

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

Sharing