file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 6.2MB
Sample260627-g73resh17p
SHA256 e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49
MD5 0c4befa56ca087221fb5706ba15e7988
SHA1 462110f09bb941c726d1536cb5ad8e2f5e78293f
SHA512 09849db1556d26f657bbd183ed8ab7e95ba9158d5a79d1804990273dd9211f1791e7cc50d5f0fefd0fac9a00c8f56ee6b7215ab40e7b17f322b9799a550e08c7
SSDEEP 98304:Qgc/0XoFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KS:wcodemyhjpu6a67buEjcmUInErzvF
TLSH
T19366E003E5E7CEF8C21BE67D46629333A92474880E32B11C6995F36B5FE4934A19DB70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 6.2MB

file.exe

IMPHASH 79fc34079e4f2426d5934af60b648369
SHA256 e01ad37bc931710e2ca30250596a780c12259ae27712564a6c872f63fe3dcf49
MD5 0c4befa56ca087221fb5706ba15e7988
SHA1 462110f09bb941c726d1536cb5ad8e2f5e78293f
SHA512 09849db1556d26f657bbd183ed8ab7e95ba9158d5a79d1804990273dd9211f1791e7cc50d5f0fefd0fac9a00c8f56ee6b7215ab40e7b17f322b9799a550e08c7
SSDEEP 98304:Qgc/0XoFHNxZemy4hjcnjHJuuoUZYV6jPQ9+A5VRg7h4guEiAcmt+jInErzvR/KS:wcodemyhjpu6a67buEjcmUInErzvF
TLSH
T19366E003E5E7CEF8C21BE67D46629333A92474880E32B11C6995F36B5FE4934A19DB70
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileMappingW CreateFileW CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FindResourceW FlushViewOfFile FormatMessageA GetCPInfo GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileInformationByHandle GetFileSize GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTickCount64 InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEvent SetFileAttributesA SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp _setmode _strdup _stricmp _strtoi64 _strtoui64 _time64 _unlock _vscprintf _vsnprintf _wfopen _write abort atexit calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset putc putwc rand realloc setlocale setvbuf srand strchr strcmp strcoll strerror strftime strlen strncmp strstr strtoul strxfrm tolower towupper ungetwc towlower ungetc vfprintf vswprintf_s wcschr wcscoll wcscpy_s wcsftime wcslen wcsstr wcstombs wcstombs_s wcsxfrm

ntdll

NtClose NtCreateSection NtMapViewOfSection NtOpenFile NtSetInformationFile NtWriteFile RtlInitUnicodeString

ole32

CoCreateInstance CoGetObject CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

CommandLineToArgvW

user32

GetDesktopWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

Name

.itext

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

advapi32

kernel32

msvcrt

ntdll

ole32

oleaut32

shell32

user32

winhttp

generic