new[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
new.exe
Size 175KB
Sample260705-jpl23aaz6x
SHA256 564024a58e1b7f8d8190df29d2a4beaaa127f48aaa0b3ce35b6c98bddb9067fe
MD5 03d8f9b0bd93a71e52b2e92a863edb31
SHA1 74e01b526213e274a16f1708a86c5825a7169078
SHA512 69f5f293e5d684ca723aa8683638bf26e59779bd5f74c954784d2773b326e1c5796548ac1d24bc25339b30d2cfad5d726d14e50178b543d583814c97f889a2ca
SSDEEP 3072:M1lvPEfsgNQcArqkDq/VqWzy1p+5b/tAVPxeSZ:MzRqt9qnSDi
TLSH
T1D7046B5676A500FDE0B79139C9A21A46E773FC4607209BEF03A043A62F277D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
new.exe

File Explorer

new.exe

.exe 175KB

new.exe

IMPHASH 72153761a3d44ddca36ec29d18fe4d34
SHA256 564024a58e1b7f8d8190df29d2a4beaaa127f48aaa0b3ce35b6c98bddb9067fe
MD5 03d8f9b0bd93a71e52b2e92a863edb31
SHA1 74e01b526213e274a16f1708a86c5825a7169078
SHA512 69f5f293e5d684ca723aa8683638bf26e59779bd5f74c954784d2773b326e1c5796548ac1d24bc25339b30d2cfad5d726d14e50178b543d583814c97f889a2ca
SSDEEP 3072:M1lvPEfsgNQcArqkDq/VqWzy1p+5b/tAVPxeSZ:MzRqt9qnSDi
TLSH
T1D7046B5676A500FDE0B79139C9A21A46E773FC4607209BEF03A043A62F277D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

sendto WSACleanup closesocket inet_pton WSAStartup inet_addr socket inet_ntoa htons setsockopt

iphlpapi

GetAdaptersInfo

advapi32

RegSetValueExW RegOpenKeyExW RegCloseKey

user32

MessageBoxW SetWindowTextW ShowWindow EnumWindows GetWindowTextW

kernel32

GetConsoleMode FlushFileBuffers GetProcessHeap HeapSize HeapReAlloc CreateFileW WriteConsoleW GetConsoleOutputCP EncodePointer GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetModuleFileNameW SetErrorMode CreateMutexW GetLastError CloseHandle GetConsoleWindow QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive Sleep WaitForSingleObjectEx GetExitCodeThread WakeAllConditionVariable GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW MultiByteToWideChar RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo