appFile[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
appFile.exe
Size 831.9MB
Sample260809-23rtkser4s
SHA256 34a9116bf497fea382f1ac2fb41cbdc14f6a6f3bc70d2fbb04afd4a2abe54017
MD5 97f991b0f463d0dcc7c229ea887f2cbf
SHA1 076c3f69e7ceab0894558224c410325839a9c1fe
SHA512 35b6209688bbe4fda8c394630f0d5c9d70a74cd16970d079332f143ff7c3d4fb103b0ff3d7edf33224385ff507dbacfb7364eb01d2ebbc9ad637a44cbf505da1
SSDEEP 393216:cWFU9moRaHQ4Nsn2uYy2g7JKTqhluBx71S5Nxub8kK/rVhpe2A+2SZfiHn1E5doZ:cWFToRaHQis2tqhluGrubou6RiJreS
TLSH
T1E499BF02B7F80065F1B7973489B79A12EA36BC611B31D3DF1290A66D1E737C09E35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
sample	pdf_with_link_action

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
appFile.exe

File Explorer

appFile.exe

.exe 831.9MB

appFile.exe

IMPHASH d42595b695fc008ef2c56aabd8efd68e
SHA256 34a9116bf497fea382f1ac2fb41cbdc14f6a6f3bc70d2fbb04afd4a2abe54017
MD5 97f991b0f463d0dcc7c229ea887f2cbf
SHA1 076c3f69e7ceab0894558224c410325839a9c1fe
SHA512 35b6209688bbe4fda8c394630f0d5c9d70a74cd16970d079332f143ff7c3d4fb103b0ff3d7edf33224385ff507dbacfb7364eb01d2ebbc9ad637a44cbf505da1
SSDEEP 393216:cWFU9moRaHQ4Nsn2uYy2g7JKTqhluBx71S5Nxub8kK/rVhpe2A+2SZfiHn1E5doZ:cWFToRaHQis2tqhluGrubou6RiJreS
TLSH
T1E499BF02B7F80065F1B7973489B79A12EA36BC611B31D3DF1290A66D1E737C09E35B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

HTTP links in PDF interactive object

Detects HTTP links in interactive objects within PDF files.

pdf link
Unsigned PE

Checks for missing Authenticode signature.

Password

7907

Minor OS version

Major OS version

Entry point

473920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

appFile.exe

kernel32

generic