ob[.]exe | Triage™

General

Target
ob.exe
Size 131.6MB
Sample260905-jnammsgp9x
SHA256 c441a8d7193fcfa0816b7a52c230da68fbc58ae2c696637deb2eb0b4921f36ac
MD5 7f42121315465be84f22d984244758fc
SHA1 6f4f145460f3111921ea2924e17755f128b3f804
SHA512 5d2d9848006bdc837919e8eb6c5d0d85e34b34ad7fad61dd1473706fdc1fb90d0e5902aba97da90c901fd6be30f14b61d82d8ad25e887d813ea0fd15ce600874
SSDEEP 3145728:Ym3608stHj5ubBv57QCe9jt0JMC0cRJXlg0ZuB9/+r4LEE:YwEb7de9mJM8FMvq4L
TLSH
T19268337404E89DCCF12B103DB5C79A058AE2F47AD539ACBE6324739C2A591CBB19CF09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ob.exe

File Explorer

ob.exe

.exe 131.6MB

ob.exe

IMPHASH e6f4169f2a5c3a8f93171d9f593bd22a
SHA256 c441a8d7193fcfa0816b7a52c230da68fbc58ae2c696637deb2eb0b4921f36ac
MD5 7f42121315465be84f22d984244758fc
SHA1 6f4f145460f3111921ea2924e17755f128b3f804
SHA512 5d2d9848006bdc837919e8eb6c5d0d85e34b34ad7fad61dd1473706fdc1fb90d0e5902aba97da90c901fd6be30f14b61d82d8ad25e887d813ea0fd15ce600874
SSDEEP 3145728:Ym3608stHj5ubBv57QCe9jt0JMC0cRJXlg0ZuB9/+r4LEE:YwEb7de9mJM8FMvq4L
TLSH
T19268337404E89DCCF12B103DB5C79A058AE2F47AD539ACBE6324739C2A591CBB19CF09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\Setup.pdb

kernel32

LoadResource FindResourceW lstrlenW GetProcAddress GetModuleHandleW DeleteCriticalSection GetTempPathW GetLastError GetTempFileNameW MoveFileW WaitForSingleObject GetExitCodeProcess CloseHandle DeleteFileW GetModuleFileNameW GetCurrentProcess LoadLibraryW FreeLibrary InitializeCriticalSectionEx GetFileAttributesW CreateFileW SetFilePointer ReadFile VerSetConditionMask GetCurrentDirectoryW MultiByteToWideChar LocalFileTimeToFileTime WideCharToMultiByte CreateDirectoryW WriteFile SetFileTime FreeResource SizeofResource LockResource CreateProcessW GetSystemDirectoryW SetDefaultDllDirectories GetCurrentThreadId DecodePointer RaiseException LeaveCriticalSection EnterCriticalSection lstrcmpiW LoadLibraryExW GetConsoleMode GetConsoleCP SystemTimeToFileTime VerifyVersionInfoW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW GetFileSizeEx SetFilePointerEx FlushFileBuffers WriteConsoleW

shlwapi

PathIsUNCW

comctl32

InitCommonControlsEx

Sharing