client[.]exe | Triage™

General

Target
client.exe
Size 146KB
Sample260916-rgr74sv15m
SHA256 8a4e3770c160c3c254f247e32417dcb4673381965f2e7400d49fe1b663c9e418
MD5 c5dc01f2afc8405ea7c729b685615a2e
SHA1 34939fb0efb91393ce18311c28059d99884ec663
SHA512 a09c7dcce2948c31436cd47546094c52f13293d26af3a0ba340101d1b51260d47f2f0a031c0c64d354200e09c9336353fba43b94726fcbd612804fbbf5e4afd2
SSDEEP 3072:IF73WqY8Qwi2df4s5gumRHAD+pm8xRfRpnGJ56RNO4WT:O73e8Rff6umHAaA4i6mV
TLSH
T1F0E36C00F5C1D033E57A4C3985F69E769D2DECB04B44AACF67841EE98E349E0A738697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
client.exe

File Explorer

client.exe

.exe 146KB

client.exe

IMPHASH d27d2c951a75782ff4c456444a1ab692
SHA256 8a4e3770c160c3c254f247e32417dcb4673381965f2e7400d49fe1b663c9e418
MD5 c5dc01f2afc8405ea7c729b685615a2e
SHA1 34939fb0efb91393ce18311c28059d99884ec663
SHA512 a09c7dcce2948c31436cd47546094c52f13293d26af3a0ba340101d1b51260d47f2f0a031c0c64d354200e09c9336353fba43b94726fcbd612804fbbf5e4afd2
SSDEEP 3072:IF73WqY8Qwi2df4s5gumRHAD+pm8xRfRpnGJ56RNO4WT:O73e8Rff6umHAaA4i6mV
TLSH
T1F0E36C00F5C1D033E57A4C3985F69E769D2DECB04B44AACF67841EE98E349E0A738697
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

connect inet_pton WSAStartup socket send recv htons closesocket

kernel32

GetStdHandle CreateFileW CloseHandle DecodePointer GetConsoleMode GetConsoleOutputCP FlushFileBuffers CreateDirectoryA FindClose FindFirstFileA FindNextFileA GetVolumeInformationA GetLastError CreateMutexA Sleep FreeLibrary GetModuleFileNameA GetProcAddress LoadLibraryA IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead HeapReAlloc RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind EncodePointer GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW WriteConsoleW WriteFile IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize

Sharing