file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 30.1MB
Sample260802-e6qz5avclc
SHA256 350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c
MD5 5c8e68a414254a67111c6167f44ec777
SHA1 cb5be7c6c404339029a88a7a4ffc0465da77288a
SHA512 4e5bafdd6d8b522937d78b57f6780ea87da7587fb37229bc85b8ed6de914001276e66fe5b0d0f9707a35a089474fcd82e66531d456296b3a8df341fdf841858c
SSDEEP 24576:qC0Pf7dNvVC2cuWnd/ewT96mCTccMQjjf1aeY7Df:qvPfanHT95wlU7Df
TLSH
T17B679D35A3A4C1A8E92FC274CAB54233E6B174451720AACB0355EA55FF33AD17BFA311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 30.1MB

file.exe

IMPHASH 8c0ed5311e0eeba51b4c1a13e4263081
SHA256 350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c
MD5 5c8e68a414254a67111c6167f44ec777
SHA1 cb5be7c6c404339029a88a7a4ffc0465da77288a
SHA512 4e5bafdd6d8b522937d78b57f6780ea87da7587fb37229bc85b8ed6de914001276e66fe5b0d0f9707a35a089474fcd82e66531d456296b3a8df341fdf841858c
SSDEEP 24576:qC0Pf7dNvVC2cuWnd/ewT96mCTccMQjjf1aeY7Df:qvPfanHT95wlU7Df
TLSH
T17B679D35A3A4C1A8E92FC274CAB54233E6B174451720AACB0355EA55FF33AD17BFA311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

617248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Projects\Moonshine-Csharp\out\native\aethsync.pdb

advapi32

RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW DeregisterEventSource

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CompareStringEx CompareStringOrdinal CreateEventExW DuplicateHandle FindNLSStringEx FindStringOrdinal FormatMessageW GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetLastError GetLocaleInfoEx GetModuleFileNameW GetModuleHandleW GetStdHandle GetThreadPriority LCMapStringEx LoadLibraryExW LocalFree LocaleNameToLCID MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ResolveLocaleName SetEvent SetLastError SetThreadErrorMode Sleep SleepEx VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetProcAddress RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak WaitForSingleObject GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent GetSystemTimeAsFileTime FlushProcessWriteBuffers InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead

ole32

CoInitializeEx CoGetApartmentType CoUninitialize CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

_callnewh free calloc malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

log __setusermatherr

api-ms-win-crt-string-l1-1-0

_stricmp strcpy strlen strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode __stdio_common_vsscanf __stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table abort _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv terminate __p___argc _exit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

621KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.gfx

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic