start[.]exe | Triage™

General

Target
start.exe
Size 12KB
Sample260711-1bjs8aax3p
SHA256 a9e5973be0d9060b81746fedb74b0f68226d5d075e9dd2486dbc2fb0c2bd6d4c
MD5 6dd9908327b6dbc6591738fedeb3a282
SHA1 acebb539a6c5083d640b250d4d638578863ecd5f
SHA512 7dc4e1ad90be95c5cb6f02862ae817c49dc41ad189495c439f87f1a3a5dd8ffcff064b870b60b4de90aa35be7fb0cd8640b98f27cb65fa96afc5616447571a91
SSDEEP 96:OAnAB0mZctCEZpCqzHtXJmL3J8SqgemlUUO0fIsEgtAHfxi0vlxbz2DmFe55tfD+:CxcVivqgeWf/Ed/xi0vXffe55tfDcLq
TLSH
T1DF422B4AB2964CFDD6298175C0330E06E2FAB13107326ACF4374E5251EBB3D1AC726CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
start.exe

File Explorer

start.exe

.exe 12KB

start.exe

IMPHASH e7f0b30a9df17ab6462d40bf49f14c6e
SHA256 a9e5973be0d9060b81746fedb74b0f68226d5d075e9dd2486dbc2fb0c2bd6d4c
MD5 6dd9908327b6dbc6591738fedeb3a282
SHA1 acebb539a6c5083d640b250d4d638578863ecd5f
SHA512 7dc4e1ad90be95c5cb6f02862ae817c49dc41ad189495c439f87f1a3a5dd8ffcff064b870b60b4de90aa35be7fb0cd8640b98f27cb65fa96afc5616447571a91
SSDEEP 96:OAnAB0mZctCEZpCqzHtXJmL3J8SqgemlUUO0fIsEgtAHfxi0vlxbz2DmFe55tfD+:CxcVivqgeWf/Ed/xi0vXffe55tfDcLq
TLSH
T1DF422B4AB2964CFDD6298175C0330E06E2FAB13107326ACF4374E5251EBB3D1AC726CA
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle WaitForSingleObject CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32First Process32Next RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent RtlCaptureContext QueryPerformanceCounter GetCurrentProcessId GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId

user32

GetWindowThreadProcessId FindWindowA

vcruntime140

memset __C_specific_handler memcpy __current_exception __current_exception_context strrchr

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf __p__commode

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _register_onexit_function terminate _crt_atexit _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing