file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 5.8MB
Sample260815-d3acjaywet
SHA256 6ca51deb014b8b313336ff09d44e9b308e55e1c4e8a08d315096250dea0ad853
MD5 c1165519430c253c6f0a78c2e1c9b4d3
SHA1 97ec6c8b562aaef59b10812d6deb527b898767d7
SHA512 2eaff50355508f68d4c428068247b6ef91f6dbf76245c0870f70689fc4ded6329d316d85907557090c24b15acd77ba9fab9a500baef9c5c20ac3222e0e31358f
SSDEEP 49152:b0iEPoOCAqwy12sMy5j9XQ2thQy/Z0ymc4ggu6a0WaBUFqxPvMNsg6/bHLDM/DHw:57/7xxtx0JFxUscR5vmEqkbeJoOgOQ6
TLSH
T1A6564B55BA6B94ACD197C47483468A639E2130DF0B36BAFF418485383F6ABF11B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 5.8MB

file.exe

IMPHASH 736029744d6e019a39ea152cdcd00c12
SHA256 6ca51deb014b8b313336ff09d44e9b308e55e1c4e8a08d315096250dea0ad853
MD5 c1165519430c253c6f0a78c2e1c9b4d3
SHA1 97ec6c8b562aaef59b10812d6deb527b898767d7
SHA512 2eaff50355508f68d4c428068247b6ef91f6dbf76245c0870f70689fc4ded6329d316d85907557090c24b15acd77ba9fab9a500baef9c5c20ac3222e0e31358f
SSDEEP 49152:b0iEPoOCAqwy12sMy5j9XQ2thQy/Z0ymc4ggu6a0WaBUFqxPvMNsg6/bHLDM/DHw:57/7xxtx0JFxUscR5vmEqkbeJoOgOQ6
TLSH
T1A6564B55BA6B94ACD197C47483468A639E2130DF0B36BAFF418485383F6ABF11B3D724
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4666908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

IT_solutions.pdb

crypt32

CertFreeCertificateContext CertCloseStore CertDuplicateCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertEnumCertificatesInStore CertDuplicateStore CertAddCertificateContextToStore CertGetCertificateChain CertVerifyCertificateChainPolicy CryptUnprotectData CryptProtectData CryptStringToBinaryA CertCreateCertificateContext CertOpenStore

kernel32

GetUserDefaultGeoName GetLocaleInfoEx CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentThreadId WaitForSingleObject HeapReAlloc CreateThread QueryPerformanceFrequency QueryPerformanceCounter GetSystemInfo GetProcessId GetExitCodeProcess LocalFree OpenProcess GetProcessTimes QueryFullProcessImageNameW TerminateProcess CreateJobObjectW SetInformationJobObject ProcessIdToSessionId FlushFileBuffers MoveFileExW CreateMutexW AssignProcessToJobObject CreatePipe SetHandleInformation CreatePseudoConsole InitializeProcThreadAttributeList UpdateProcThreadAttribute ClosePseudoConsole DeleteProcThreadAttributeList CreateProcessW ResumeThread ResizePseudoConsole WriteFile FindFirstFileExW FindNextFileW GlobalSize GlobalLock GlobalUnlock GlobalAlloc GlobalFree CompareStringOrdinal GetTimeZoneInformationForYear AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetSystemTimePreciseAsFileTime GetQueuedCompletionStatusEx GetOverlappedResult CreateIoCompletionPort SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW CancelIoEx CreateFileW GetModuleHandleW ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW CreateMutexA WideCharToMultiByte ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW WriteFileEx SleepEx ReadFileEx FormatMessageW GetModuleHandleA GetFullPathNameW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW CreateEventW CancelIo GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetCommandLineW DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException OutputDebugStringA OutputDebugStringW FormatMessageA GetCurrentProcessId GetProcAddress GetLastError GetProcessHeap HeapFree CloseHandle FindClose SwitchToThread TerminateJobObject PostQueuedCompletionStatus GetTempPathW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile SetFilePointer CreateFileA GetFullPathNameA LoadLibraryW HeapCompact UnlockFileEx LockFile UnlockFile LockFileEx GetFileSize GetDiskFreeSpaceW FreeLibrary GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile GetTickCount HeapCreate AreFileApisANSI SystemTimeToFileTime HeapDestroy SetEndOfFile DeleteFileA

user32

SetKeyboardState OpenClipboard GetSystemMetrics CreateDesktopW PeekMessageW ChildWindowFromPointEx IsClipboardFormatAvailable GetClipboardData CloseClipboard EmptyClipboard SetClipboardData OpenInputDesktop GetThreadDesktop MapVirtualKeyW SendInput ReleaseDC GetDC GetClipboardSequenceNumber ScreenToClient PostMessageW SetFocus SetActiveWindow BringWindowToTop GetKeyboardState SetThreadDesktop GetGUIThreadInfo CloseDesktop GetClassNameW IsWindow AttachThreadInput IsWindowVisible GetWindowRect EnumDesktopWindows PrintWindow GetWindowThreadProcessId GetAncestor SendMessageTimeoutW

gdi32

StretchBlt SetStretchBltMode DeleteDC DeleteObject SelectObject CreateDIBSection CreateCompatibleDC

iphlpapi

NotifyIpInterfaceChange

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

secur32

ApplyControlToken AcceptSecurityContext AcquireCredentialsHandleA InitializeSecurityContextW QueryContextAttributesW FreeContextBuffer DeleteSecurityContext FreeCredentialsHandle DecryptMessage EncryptMessage

ws2_32

WSASend send getsockopt freeaddrinfo getaddrinfo connect ioctlsocket WSASocketW setsockopt WSACleanup WSAGetLastError getpeername getsockname WSAIoctl shutdown closesocket recv bind WSAStartup

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile

vcruntime140

__CxxFrameHandler3 strrchr memcmp __current_exception_context __current_exception memchr __C_specific_handler memmove strchr _CxxThrowException memset memcpy

api-ms-win-crt-math-l1-1-0

round pow __setusermatherr log

api-ms-win-crt-string-l1-1-0

strcspn strlen strncmp strcmp strspn

api-ms-win-crt-heap-l1-1-0

free malloc _msize _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _endthreadex _register_onexit_function terminate _crt_atexit _seh_filter_exe _get_initial_narrow_environment _set_app_type _initterm_e exit _exit _initialize_onexit_table __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initterm _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale