e_win[.]exe | Triage™

General

Target
e_win.exe
Size 79KB
Sample260707-pabwfahs3x
SHA256 3cc722073092656d090e5b3a51132741a368062ab2a4b6b70b4232abe0eea535
MD5 49681242e8fe91eb0c234e98a57ed731
SHA1 b10085364aa6e111791e79e53e8abf594ec3a743
SHA512 5c7d1f7694fde0646a5c85ba54c5ce6ec0500b455d8db6cdfc0fc90ce7129a1736936b0fe7b68dba877efe35ef0bb3d91e984507087814a615841088ad94c419
SSDEEP 1536:s6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:uhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
TLSH
T1FB83D8115945E2B6C5D132319167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e_win.exe

File Explorer

e_win.exe

.exe 79KB

e_win.exe

IMPHASH 202fa14f574c71c2f95878e40a79322d
SHA256 3cc722073092656d090e5b3a51132741a368062ab2a4b6b70b4232abe0eea535
MD5 49681242e8fe91eb0c234e98a57ed731
SHA1 b10085364aa6e111791e79e53e8abf594ec3a743
SHA512 5c7d1f7694fde0646a5c85ba54c5ce6ec0500b455d8db6cdfc0fc90ce7129a1736936b0fe7b68dba877efe35ef0bb3d91e984507087814a615841088ad94c419
SSDEEP 1536:s6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:uhZ5YesrQLOJgY8Zp8LHD4XWaNH71dLI
TLSH
T1FB83D8115945E2B6C5D132319167F1AAC13A197003B5B78B63C027AEFB10AE8F6BCF67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess GetTickCount GetModuleHandleA GetProcAddress LoadLibraryA lstrcmpW lstrlenW SetVolumeMountPointW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileW WriteFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection lstrlenA GetCommandLineW FindClose FindFirstFileW FindNextFileW GetFileSizeEx GetCurrentProcess ReadFile SetFileAttributesW SetFilePointerEx WaitForSingleObject CreateMutexA WaitForMultipleObjects GetCurrentProcessId ExitProcess CreateThread ExitThread SetProcessShutdownParameters GetSystemInfo lstrcmpiW lstrcpyW lstrcatW OpenMutexA MoveFileExW WideCharToMultiByte HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore CreateSemaphoreA TerminateProcess Sleep GetLastError CloseHandle GetVolumePathNamesForVolumeNameW GetDriveTypeW FindVolumeClose FindNextVolumeW GetLogicalDrives FindFirstVolumeW

user32

wsprintfA

advapi32

QueryServiceStatusEx OpenSCManagerA EnumDependentServicesA ControlService CloseServiceHandle CryptAcquireContextW CryptReleaseContext CryptGenRandom OpenServiceA

shell32

SHEmptyRecycleBinA CommandLineToArgvW ShellExecuteW

netapi32

NetShareEnum NetApiBufferFree

rstrtmgr

RmGetList RmStartSession RmEndSession RmRegisterResources

mpr

WNetCloseEnum WNetEnumResourceW WNetOpenEnumW WNetGetConnectionW

Sharing