file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 513KB
Sample260823-cs4mysdn6t
SHA256 995ed821ea164668fb7744183b39cace5adc913f03a15014d6a08500b6ccfb04
MD5 357e95b07d7fd0151e74fb6195987bb8
SHA1 139997a7e16727f9e907f489ef59df59e7f48124
SHA512 3f9f883a3e3267ad5f158df08b2cf75c1af57ddbcd0b6e10a2fdd9dadc905a88b381f37979cb6993b854a3e1e151dde2da8c3259c6b53ba0b97c78efdff9ea3f
SSDEEP 6144:6edVxAw777HKu694PEhpAbl14JkyA2Kj+lzS961vqy9TJr0R5V3luJSdrw:1694PCpMcCUsgvlNJUf7Fw
TLSH
T171B48D98F6A403F9E176C278CD875503F7B278481370AADF03E499761F236A25A3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 513KB

file.exe

IMPHASH 4230d1f555978af38cdacc7a599c4b32
SHA256 995ed821ea164668fb7744183b39cace5adc913f03a15014d6a08500b6ccfb04
MD5 357e95b07d7fd0151e74fb6195987bb8
SHA1 139997a7e16727f9e907f489ef59df59e7f48124
SHA512 3f9f883a3e3267ad5f158df08b2cf75c1af57ddbcd0b6e10a2fdd9dadc905a88b381f37979cb6993b854a3e1e151dde2da8c3259c6b53ba0b97c78efdff9ea3f
SSDEEP 6144:6edVxAw777HKu694PEhpAbl14JkyA2Kj+lzS961vqy9TJr0R5V3luJSdrw:1694PCpMcCUsgvlNJUf7Fw
TLSH
T171B48D98F6A403F9E176C278CD875503F7B278481370AADF03E499761F236A25A3E761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

264896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

htons connect ioctlsocket getpeername recv select send setsockopt shutdown socket WSAStartup WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW inet_pton sendto recvfrom ntohl closesocket inet_ntop freeaddrinfo getaddrinfo

advapi32

RegQueryValueExA AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation SetSecurityInfo GetSecurityInfo SetEntriesInAclW LookupPrivilegeValueA AdjustTokenPrivileges RegDeleteTreeW RegSetValueExW RegQueryValueExW OpenProcessToken RegOpenKeyExW RegEnumValueW RegDeleteValueW RegDeleteValueA RegCreateKeyExW RegCloseKey GetUserNameA

user32

SendMessageTimeoutA GetLastInputInfo GetForegroundWindow GetWindowTextA GetKeyboardLayoutList wsprintfA EnumDisplayDevicesA GetSystemMetrics

ole32

CoCreateInstance CoUninitialize CoInitializeEx

shell32

SHGetFolderPathW SHGetSpecialFolderPathA

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider

kernel32

LCMapStringW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW HeapSize GetConsoleOutputCP LoadLibraryExW VirtualProtect GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleHandleExW IsProcessorFeaturePresent DeleteCriticalSection InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter InitOnceComplete GetEnvironmentVariableA GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DeleteFileA DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesA GetFileAttributesW GetFileAttributesExW GetFileTime ReadFile SetFileAttributesW SetFilePointer SetFilePointerEx WriteFile GetTempPathA GetVolumeInformationA OutputDebugStringA CloseHandle DuplicateHandle SetHandleInformation GetLastError SetErrorMode SetThreadErrorMode CreatePipe HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent WaitForSingleObject GetConsoleMode CreateMutexA CreateEventA OpenEventA Sleep GetProcessTimes GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess GetCurrentThread GetCurrentThreadId OpenThread ResumeThread CreateProcessA CreateProcessW GetThreadId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GlobalMemoryStatusEx GetSystemTimeAsFileTime GetLocalTime GetTickCount GetTickCount64 GetSystemDirectoryW VirtualAlloc VirtualFree VirtualQuery MapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA lstrcmpiW lstrcpynA lstrlenA CreateFileMappingA QueryFullProcessImageNameA QueryFullProcessImageNameW CopyFileA CopyFileW MoveFileExW GetComputerNameA MultiByteToWideChar WideCharToMultiByte GetGeoInfoA GetUserGeoID CreateToolhelp32Snapshot Process32FirstW Process32NextW HeapReAlloc InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ExitThread GetSystemInfo FindFirstFileA FindNextFileA GetDiskFreeSpaceExA QueryPerformanceCounter QueryPerformanceFrequency DeviceIoControl ReleaseMutex CreateMutexW CreateEventW TlsAlloc TlsSetValue TlsFree GetThreadContext FlushInstructionCache GetSystemDirectoryA ReadProcessMemory LocalFree lstrcatA QueryDosDeviceA WaitNamedPipeA GetDynamicTimeZoneInformation GetLocaleInfoW GetUserDefaultUILanguage GetSystemDefaultLCID GetUserDefaultLCID GetLocaleInfoEx GetUserDefaultLocaleName GetSystemDefaultLocaleName Thread32First Thread32Next K32EnumProcessModulesEx K32GetModuleBaseNameA FreeLibrary GetCommandLineW CreateThread GetFileSize InitOnceBeginInitialize WriteConsoleW SleepEx UnmapViewOfFile

oleaut32

SysFreeString SysAllocString

winhttp

WinHttpQueryDataAvailable WinHttpReadData

crypt32

CryptUnprotectData CryptStringToBinaryA

Name

.text

Size

385KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data2

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pvmut

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

ws2_32

advapi32

user32

ole32

shell32

bcrypt

kernel32

oleaut32

winhttp

crypt32

generic