EXCEL[.]EXE | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
EXCEL.EXE
Size 50.9MB
Sample260816-q6d64scl3x
SHA256 085d410997c853ee5e986defb647e70f89ef73068638ca7a35b09edcd4b30f99
MD5 18a2904e4c824f0673c284edec716997
SHA1 13f0ca7b5cbfaa2d290b728b6d1a9b68afdd7a92
SHA512 61d07f785c3fbc19b1b424b6ac7abadf95349d0d5a47da1b34440160c10c5baec9585d75ad57bc094959b592c195b3aec6ef79621fff2a2ff46e6c5c50107036
SSDEEP 393216:BwdnKi4x1Hr/NsqUBrNReJuaPQRNuIZxQpBHld0ziS/KkBNOOT15bd5JUx:i2NEoyGIzax
TLSH
T157C77C4273F880CAE06AD034896B8656FFB17C451B3187DB526177AE6F336E19E38361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

EXCEL.EXE

.exe 50.9MB

EXCEL.EXE

SHA256 085d410997c853ee5e986defb647e70f89ef73068638ca7a35b09edcd4b30f99
MD5 18a2904e4c824f0673c284edec716997
SHA1 13f0ca7b5cbfaa2d290b728b6d1a9b68afdd7a92
SHA512 61d07f785c3fbc19b1b424b6ac7abadf95349d0d5a47da1b34440160c10c5baec9585d75ad57bc094959b592c195b3aec6ef79621fff2a2ff46e6c5c50107036
SSDEEP 393216:BwdnKi4x1Hr/NsqUBrNReJuaPQRNuIZxQpBHld0ziS/KkBNOOT15bd5JUx:i2NEoyGIzax
TLSH
T157C77C4273F880CAE06AD034896B8656FFB17C451B3187DB526177AE6F336E19E38361
MD5 SHA1 SHA512 SSDEEP TLSH

Password

6c96ff66

Digest

fe:06:00:17:a7:75:37:27:9e:c8:27:0f:14:b9:b0:17:05:51:7b:2e:4c:99:a9:81:65:74:e8:99:98:2a:cf:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 27, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

51840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\dbs\el\zlt\Target\x64\ship\postc2r\x-none\excel.pdb

Name

.text

Size

37.0MB

Virtual Size

37.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

584KB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

287KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=257, version=25930,

count=3, id=259, version=25930,

count=36, id=261, version=25930,

count=12, id=260, version=25930,

count=1, id=261, version=25711,

count=1, id=263, version=25711,

count=2, id=262, version=25711,

count=23, id=260, version=25711,

count=9, id=257, version=25711,

count=8803, id=1, productName=Unmarked objects,

count=1, id=255, productName=VS2017 v15.6.0 build 26128, version=26128,

count=6, id=259, productName=VS2017 v15.6.0 build 26128, version=26128,

count=122, id=261, productName=VS2017 v15.6.0 build 26128, version=26128,

count=4086, id=265, version=26128,

count=1, id=256, productName=VS2017 v15.6.0 build 26128, version=26128,

count=1, id=258, productName=VS2017 v15.6.0 build 26128, version=26128,