output[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
output.exe
Size 81.1MB
Sample260805-3cfjashp21
SHA256 2849e920526ba108af57443cbb178e6f506a07bb6db72e76cc0de9635a4560ff
MD5 1190e7e69cda1a540a8a3dd37b953ca4
SHA1 55a93e628bad6f324959a1093d889fabfc845fc7
SHA512 6866b636997cb6b564e099156c4a06a42bc0aa845b10b514b3f1d4323dcf5ab2c184eb63ddf2c655d87c5276e0c495bc539839bcda945a7c7592996b93379d6d
SSDEEP 1572864:hVEOVPMfeGt8iVjEBvvID4XKJtlm5gNq9NStgbjnZhRAyLtQvD+qIkpnt:hhPrNiVABXID+KTftaj+dv9Ikpt
TLSH
T13318330FD64B9494E4B365306CB34404CEB338989FF5DE4B2B1911E66A8F1D92C5FBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
output.exe

File Explorer

output.exe

.exe 81.1MB

output.exe

IMPHASH 1aeae1dc5bcd879907f3574d82aaf8f1
SHA256 2849e920526ba108af57443cbb178e6f506a07bb6db72e76cc0de9635a4560ff
MD5 1190e7e69cda1a540a8a3dd37b953ca4
SHA1 55a93e628bad6f324959a1093d889fabfc845fc7
SHA512 6866b636997cb6b564e099156c4a06a42bc0aa845b10b514b3f1d4323dcf5ab2c184eb63ddf2c655d87c5276e0c495bc539839bcda945a7c7592996b93379d6d
SSDEEP 1572864:hVEOVPMfeGt8iVjEBvvID4XKJtlm5gNq9NStgbjnZhRAyLtQvD+qIkpnt:hhPrNiVABXID+KTftaj+dv9Ikpt
TLSH
T13318330FD64B9494E4B365306CB34404CEB338989FF5DE4B2B1911E66A8F1D92C5FBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\rar\build\sfxcon64\Release\sfxcon.pdb

kernel32

GetStdHandle GetFileType WriteFile GetConsoleMode SetConsoleMode ReadConsoleW WriteConsoleW GetLastError SetLastError Sleep LocalFree FormatMessageW SetConsoleCtrlHandler CreateFileW DeleteFileW RemoveDirectoryW SetFileTime CloseHandle DeviceIoControl CreateHardLinkW GetLongPathNameW GetShortPathNameW MoveFileW FlushFileBuffers ReadFile SetEndOfFile SetFilePointer CreateDirectoryW GetDriveTypeW GetFileAttributesW SetFileAttributesW GetCurrentProcessId FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW GetModuleFileNameW FoldStringW SetErrorMode FreeLibrary GetProcAddress GetCurrentProcess ExitProcess GetSystemDirectoryW GetModuleHandleW LoadLibraryW SetThreadExecutionState CompareStringW AllocConsole FreeConsole AttachConsole InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW CreateThread SetThreadPriority GetProcessAffinityMask FileTimeToLocalFileTime GetSystemTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte GetCPInfo IsDBCSLeadByte HeapSize SetFilePointerEx RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW QueryPerformanceFrequency GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetConsoleOutputCP SetStdHandle HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW

Name

.text

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

output.exe

kernel32

generic