file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 515KB
Sample260823-dfphyasbrb
SHA256 0a8018d9d192b8e1cc5891049be35f5527c74c5ecf8d42d62c121ac5d04a1856
MD5 19bd1eb97bc90ce8a518ff4ce47e6df0
SHA1 9eae6f1e84cddb1e39a34929fe53f408af57c2b3
SHA512 03c79ea8692f5f2cf526d2b440a1d2e88f337992fc1febf5d18bf83123e41a30a7745baa403598272229f4299f8656074bc15f80c25c83543ec42607a58c3815
SSDEEP 6144:zbHrhMJiacaKpZ8SEaWiC8QPgZgo02waNFgq80NYEtgRkY2v:xZ8SETiBQ4GPa0Xh
TLSH
T121B48D99F6A403F9E176C274CD879503F7B278481370AADF03E099761F236A25A3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 515KB

file.exe

IMPHASH 4230d1f555978af38cdacc7a599c4b32
SHA256 0a8018d9d192b8e1cc5891049be35f5527c74c5ecf8d42d62c121ac5d04a1856
MD5 19bd1eb97bc90ce8a518ff4ce47e6df0
SHA1 9eae6f1e84cddb1e39a34929fe53f408af57c2b3
SHA512 03c79ea8692f5f2cf526d2b440a1d2e88f337992fc1febf5d18bf83123e41a30a7745baa403598272229f4299f8656074bc15f80c25c83543ec42607a58c3815
SSDEEP 6144:zbHrhMJiacaKpZ8SEaWiC8QPgZgo02waNFgq80NYEtgRkY2v:xZ8SETiBQ4GPa0Xh
TLSH
T121B48D99F6A403F9E176C274CD879503F7B278481370AADF03E099761F236A25A3E761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

267280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

htons connect ioctlsocket getpeername recv select send setsockopt shutdown socket WSAStartup WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW inet_pton sendto recvfrom ntohl closesocket inet_ntop freeaddrinfo getaddrinfo

advapi32

RegQueryValueExA AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation SetSecurityInfo GetSecurityInfo SetEntriesInAclW LookupPrivilegeValueA AdjustTokenPrivileges RegDeleteTreeW RegSetValueExW RegQueryValueExW OpenProcessToken RegOpenKeyExW RegEnumValueW RegDeleteValueW RegDeleteValueA RegCreateKeyExW RegCloseKey GetUserNameA

user32

SendMessageTimeoutA GetLastInputInfo GetForegroundWindow GetWindowTextA GetKeyboardLayoutList wsprintfA EnumDisplayDevicesA GetSystemMetrics

ole32

CoCreateInstance CoUninitialize CoInitializeEx

shell32

SHGetFolderPathW SHGetSpecialFolderPathA

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider

kernel32

LCMapStringW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW HeapSize GetConsoleOutputCP LoadLibraryExW VirtualProtect GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleHandleExW IsProcessorFeaturePresent DeleteCriticalSection InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter InitOnceComplete GetEnvironmentVariableA GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryA CreateDirectoryW CreateFileA CreateFileW DeleteFileA DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesA GetFileAttributesW GetFileAttributesExW GetFileTime ReadFile SetFileAttributesW SetFilePointer SetFilePointerEx WriteFile GetTempPathA GetVolumeInformationA OutputDebugStringA CloseHandle DuplicateHandle SetHandleInformation GetLastError SetErrorMode SetThreadErrorMode CreatePipe HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent WaitForSingleObject GetConsoleMode CreateMutexA CreateEventA OpenEventA Sleep GetProcessTimes GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess GetCurrentThread GetCurrentThreadId OpenThread ResumeThread CreateProcessA CreateProcessW GetThreadId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GlobalMemoryStatusEx GetSystemTimeAsFileTime GetLocalTime GetTickCount GetTickCount64 GetSystemDirectoryW VirtualAlloc VirtualFree VirtualQuery MapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA lstrcmpiW lstrcpynA lstrlenA CreateFileMappingA QueryFullProcessImageNameA QueryFullProcessImageNameW CopyFileA CopyFileW MoveFileExW GetComputerNameA MultiByteToWideChar WideCharToMultiByte GetGeoInfoA GetUserGeoID CreateToolhelp32Snapshot Process32FirstW Process32NextW HeapReAlloc InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ExitThread GetSystemInfo FindFirstFileA FindNextFileA GetDiskFreeSpaceExA QueryPerformanceCounter QueryPerformanceFrequency DeviceIoControl ReleaseMutex CreateMutexW CreateEventW TlsAlloc TlsSetValue TlsFree GetThreadContext FlushInstructionCache GetSystemDirectoryA ReadProcessMemory LocalFree lstrcatA QueryDosDeviceA WaitNamedPipeA GetDynamicTimeZoneInformation GetLocaleInfoW GetUserDefaultUILanguage GetSystemDefaultLCID GetUserDefaultLCID GetLocaleInfoEx GetUserDefaultLocaleName GetSystemDefaultLocaleName Thread32First Thread32Next K32EnumProcessModulesEx K32GetModuleBaseNameA FreeLibrary GetCommandLineW CreateThread GetFileSize InitOnceBeginInitialize WriteConsoleW SleepEx UnmapViewOfFile

oleaut32

SysFreeString SysAllocString

winhttp

WinHttpQueryDataAvailable WinHttpReadData

crypt32

CryptUnprotectData CryptStringToBinaryA

Name

.text

Size

387KB

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data2

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pvmut

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

ws2_32

advapi32

user32

ole32

shell32

bcrypt

kernel32

oleaut32

winhttp

crypt32

generic