file[.]exe | Triage™

General

Target
file.exe
Size 953KB
Sample260703-3ct2pag16w
SHA256 0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56
MD5 0d6b27a00e79e8138b3d93b2c56b24d7
SHA1 e4571f7b27285ddc0e39d005a9f1109a9335820d
SHA512 185ad4ee08ce97a25fc82c43a6b4e63e36be856aba9b43d88c8159b6ef2335ce55de4ff5feb39fbf1844c3446bc1027b0602c3f42cd5203d71fe4957031beb23
SSDEEP 24576:RVP2hh0cMo02cVGjpo/jE27Ii8dwqOc5S:/28cjnNME27ZQwUS
TLSH
T12925E04BB3E460EFD6A7973089764606D37278A18761CBEF329C42211F173D49E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 953KB

file.exe

IMPHASH 13f79e8b30893cd8b53f6528763b9ff4
SHA256 0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56
MD5 0d6b27a00e79e8138b3d93b2c56b24d7
SHA1 e4571f7b27285ddc0e39d005a9f1109a9335820d
SHA512 185ad4ee08ce97a25fc82c43a6b4e63e36be856aba9b43d88c8159b6ef2335ce55de4ff5feb39fbf1844c3446bc1027b0602c3f42cd5203d71fe4957031beb23
SSDEEP 24576:RVP2hh0cMo02cVGjpo/jE27Ii8dwqOc5S:/28cjnNME27ZQwUS
TLSH
T12925E04BB3E460EFD6A7973089764606D37278A18761CBEF329C42211F173D49E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentVariableA SetEnvironmentVariableA CreateDirectoryA DeleteFileA GetFileAttributesA GetTempPathA QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetSystemDirectoryA GetModuleFileNameA GetModuleHandleA GetProcAddress lstrcpyA QueryFullProcessImageNameA CopyFileA MoveFileA MoveFileExA CreateToolhelp32Snapshot Process32First Process32Next WriteConsoleW CreateFileW CloseHandle InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

user32

CharUpperA GetCursorPos

Name

.text

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

generic