i[.]exe | Triage™

General

Target
i.exe
Size 351KB
Sample260910-ak16raed27
SHA256 fd6f66265a8abece6af72554191f5f3458a4ccc9e4a607a752a993828f4d0e95
MD5 4d370e2cb0ab3349e6f249aad7fa9929
SHA1 f26a372c9a94663f995ae155d61b5005d982e2ad
SHA512 2f07b4eeee1ddc1ab5659ceea6d7fc6d40abe8fc07e4d66cbf9d9ab5f7cd94f895212dd349a5cf1474eb9a7edbfc181517045ecfb4b34d168428981fab0767bd
SSDEEP 6144:9oQ4agmT7gaj03cQd+F82d3ax4hYySCK:9nSmTr43cQglpaxmYt
TLSH
T183747D1256D19830E11B97F28E1FC6F4662EF9205F667AFB27A55A3F39302E1E132314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
i.exe

File Explorer

i.exe

.exe 351KB

i.exe

IMPHASH 65e26f7361921acdd644477d2064c736
SHA256 fd6f66265a8abece6af72554191f5f3458a4ccc9e4a607a752a993828f4d0e95
MD5 4d370e2cb0ab3349e6f249aad7fa9929
SHA1 f26a372c9a94663f995ae155d61b5005d982e2ad
SHA512 2f07b4eeee1ddc1ab5659ceea6d7fc6d40abe8fc07e4d66cbf9d9ab5f7cd94f895212dd349a5cf1474eb9a7edbfc181517045ecfb4b34d168428981fab0767bd
SSDEEP 6144:9oQ4agmT7gaj03cQd+F82d3ax4hYySCK:9nSmTr43cQglpaxmYt
TLSH
T183747D1256D19830E11B97F28E1FC6F4662EF9205F667AFB27A55A3F39302E1E132314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

43597

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasExesLengthA BuildCommDCBAndTimeoutsA SetUnhandledExceptionFilter EnumCalendarInfoW GetConsoleAliasA GetCurrentProcess GetNamedPipeHandleStateA GetModuleHandleExW GetUserDefaultLCID InterlockedCompareExchange WriteConsoleInputA SetEvent FreeEnvironmentStringsA GetModuleHandleW CreateRemoteThread WaitNamedPipeW AllocateUserPhysicalPages GetEnvironmentStrings GlobalAlloc WideCharToMultiByte GlobalFindAtomA GetConsoleMode GetVersionExW GetFileAttributesA DnsHostnameToComputerNameW GetComputerNameExA FindNextVolumeW GetModuleFileNameW lstrcmpW GetDriveTypeW FindNextVolumeMountPointW GetConsoleOutputCP GetLastError BackupRead GetProcAddress GlobalGetAtomNameA PrepareTape LoadLibraryA OpenMutexA SetCalendarInfoW RemoveDirectoryW SetCommMask RtlCaptureStackBackTrace GetPrivateProfileStructA GetTapeParameters EnumResourceTypesW FindNextFileA SetConsoleCursorInfo GetModuleHandleA CreateMutexA CreateMailslotA RequestWakeupLatency GetDiskFreeSpaceExA DeleteFileW GetFileInformationByHandle FindActCtxSectionStringW EnumSystemLocalesW CreateFileW WriteConsoleW GetVolumePathNameA GetStringTypeA FlushFileBuffers SetStdHandle InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapAlloc DeleteFileA HeapReAlloc ExitProcess GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind LCMapStringW MultiByteToWideChar GetCPInfo UnhandledExceptionFilter IsDebuggerPresent TerminateProcess IsProcessorFeaturePresent HeapCreate HeapDestroy WriteFile GetStdHandle SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId GetCurrentThread FatalAppExitA SetConsoleCtrlHandler FreeLibrary LoadLibraryW GetLocaleInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW GetConsoleCP CloseHandle

user32

GetMenu

advapi32

ReportEventW

winhttp

WinHttpSetOption

Sharing