file[.]exe | Triage™

General

Target
file.exe
Size 146KB
Sample260919-a5b3csvwdx
SHA256 84aba03bd72611277861964a657bb9c12decdee1add2e1b3f3cf5d986b52b3f1
MD5 9fc33766b01a08a77a4121860b61265d
SHA1 3eb57f9227b1d6da21e154721052d19b6deeda5d
SHA512 4abed33f581c8a0d9c8d3a96ae2d5ca126ca86d0fd32e2a32297b50d0bffbb56b488308ad153ea6fd132f9bf029927c489878dfa7149382b9cbcd7dc3069cd48
SSDEEP 3072:KsScqOK6evGJF0NfAH/T0mKrXbsImisfqLDbKEQJ3:oTvGJFII/TYgH
TLSH
T182E33A57B3A930F9E177927884921641F772B8314B61ABEF0360437A1E272D59E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 146KB

file.exe

IMPHASH 7de1855770fd82990edb8ef5c6146b38
SHA256 84aba03bd72611277861964a657bb9c12decdee1add2e1b3f3cf5d986b52b3f1
MD5 9fc33766b01a08a77a4121860b61265d
SHA1 3eb57f9227b1d6da21e154721052d19b6deeda5d
SHA512 4abed33f581c8a0d9c8d3a96ae2d5ca126ca86d0fd32e2a32297b50d0bffbb56b488308ad153ea6fd132f9bf029927c489878dfa7149382b9cbcd7dc3069cd48
SSDEEP 3072:KsScqOK6evGJF0NfAH/T0mKrXbsImisfqLDbKEQJ3:oTvGJFII/TYgH
TLSH
T182E33A57B3A930F9E177927884921641F772B8314B61ABEF0360437A1E272D59E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

21056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\source\repos\sosk\x64\Release\sosk.pdb

kernel32

CreateFileW GetModuleHandleA MultiByteToWideChar Sleep WaitForSingleObject CloseHandle GetProcAddress GetFileSize WriteConsoleW VirtualFree GetModuleFileNameA DeleteFileW ReadFile HeapReAlloc HeapSize GetConsoleMode GetCurrentThreadId GetLastError WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread IsProcessorFeaturePresent GetModuleFileNameW GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

shell32

ShellExecuteExA

urlmon

URLDownloadToCacheFileW

Name

.text

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

advapi32

shell32

urlmon

generic