file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 170KB
Sample260626-pflmtsa15x
SHA256 f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906
MD5 79c3344864afd83d6cfa95aa816e3286
SHA1 c18fdfd1a053a9c408fb8ae563ea55684be5d4ab
SHA512 329e047f2624900bbb6cdd6641345b44015f5291e97c2fa389a0874109b0ba3fa96044eb68168dfa1d1d98f78d7e738f845fb1baabe12c29a64ccfef8f332a7d
SSDEEP 3072:GVDsce3PgRODbw/g4jmlAQJRSeI01tGrrP/lOAg0FuD0k9qMaf5A:GVrRys/Lfg8ex1twMAOJ9pah
TLSH
T1A2046B10B1E2C4B2E673053118F89B75597DBD310B214AFB67D80B7E4F342D1AA35ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 170KB

file.exe

IMPHASH 44fecc80f9b0222c9a3ac23b1cc2d9f2
SHA256 f2b4f9ac25b35389294ade3fcfe8a8bb5dc1f0e283c5be145a28bd785e993906
MD5 79c3344864afd83d6cfa95aa816e3286
SHA1 c18fdfd1a053a9c408fb8ae563ea55684be5d4ab
SHA512 329e047f2624900bbb6cdd6641345b44015f5291e97c2fa389a0874109b0ba3fa96044eb68168dfa1d1d98f78d7e738f845fb1baabe12c29a64ccfef8f332a7d
SSDEEP 3072:GVDsce3PgRODbw/g4jmlAQJRSeI01tGrrP/lOAg0FuD0k9qMaf5A:GVrRys/Lfg8ex1twMAOJ9pah
TLSH
T1A2046B10B1E2C4B2E673053118F89B75597DBD310B214AFB67D80B7E4F342D1AA35ABA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34743

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

wnsprintfW PathCombineW

wininet

InternetOpenW HttpQueryInfoW InternetCloseHandle InternetReadFile InternetOpenUrlW

netapi32

NetServerEnum NetApiBufferFree NetShareEnum

shell32

SHGetFolderPathW ShellExecuteExW SHGetSpecialFolderPathW

advapi32

RegSetValueExW RegOpenKeyExW RegCloseKey

ole32

CoInitialize CoInitializeEx CoUninitialize CoCreateInstance

user32

SendMessageTimeoutW wsprintfW

kernel32

SetStdHandle FreeEnvironmentStringsW GetProcessHeap GetCommandLineW GetCommandLineA GetOEMCP GetACP SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetEnvironmentStringsW DeleteCriticalSection IsValidCodePage FindFirstFileExW GetFileType EnumSystemLocalesW GetUserDefaultLCID MultiByteToWideChar Sleep GetProcAddress WideCharToMultiByte ReadFile FindFirstFileW FindNextFileW lstrlenW WriteFile lstrcpynW GetModuleFileNameW GetTempPathW CreateMutexW FindClose GetVolumePathNameW WaitForSingleObject CreateFileW GetFileAttributesW SetFileAttributesW GetLogicalDriveStringsW GetLastError DeleteFileW CloseHandle GetFileSize CopyFileW lstrcmpiW GetTickCount GetDriveTypeW LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx WriteConsoleW EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess IsValidLocale RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle ExitProcess GetModuleHandleExW HeapReAlloc HeapFree HeapAlloc LCMapStringW GetLocaleInfoW