appFile[.]exe | Triage™

General

Target
appFile.exe
Size 694KB
Sample260919-s8ydwagh49
SHA256 b688b171ff1130bc5c7bd4b1d4356ee397bf593656a7f47c086b86029190e37e
MD5 6d56ef04d909e160704556f54070bec5
SHA1 af89f13fd7d557a6c90c39a4970e60c6340d3946
SHA512 0fd2ba1846c38ee756e07db148802fc4cd03db141b8de5b1c0e936a7e4c6651dc9830467b9541557d8491c865dc81e78e5ec84c1157018344b018f3e86d61835
SSDEEP 12288:iZn5OhuJ1V/eyRR+m1nRLv02xSw+9iKFDyxiYoQUuv4:iZn5Wu3gm1nIr9iDwRQUuv
TLSH
T1B1E401497FA686FDC9B8803119A48572F4B7BC5E0755C8FFC3A549080E6A2F86D3C792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
appFile.exe

File Explorer

appFile.exe

.exe 694KB

appFile.exe

IMPHASH e4c068b5fa1ace43a73bbd97f074efa1
SHA256 b688b171ff1130bc5c7bd4b1d4356ee397bf593656a7f47c086b86029190e37e
MD5 6d56ef04d909e160704556f54070bec5
SHA1 af89f13fd7d557a6c90c39a4970e60c6340d3946
SHA512 0fd2ba1846c38ee756e07db148802fc4cd03db141b8de5b1c0e936a7e4c6651dc9830467b9541557d8491c865dc81e78e5ec84c1157018344b018f3e86d61835
SSDEEP 12288:iZn5OhuJ1V/eyRR+m1nRLv02xSw+9iKFDyxiYoQUuv4:iZn5Wu3gm1nIr9iDwRQUuv
TLSH
T1B1E401497FA686FDC9B8803119A48572F4B7BC5E0755C8FFC3A549080E6A2F86D3C792
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

54512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

snauennimp.pdb

kernel32

GetCommandLineW GetCurrentThread GetCurrentThreadId CloseHandle GetModuleHandleA GetProcAddress GetConsoleOutputCP GetProcessHeaps GetStdHandle GetConsoleWindow HeapSize GetConsoleCP SetLastError GetSystemDefaultUILanguage LoadLibraryA GetUserDefaultUILanguage GetCommandLineA GetEnvironmentStringsW GetFileType GetSystemDefaultLCID HeapFree WaitForSingleObject GetModuleHandleW HeapAlloc GetLastError SetFileTime GetFullPathNameW CreateFileW HeapReAlloc GetFileInformationByHandle IsThreadAFiber GetFileInformationByHandleEx GetThreadId MultiByteToWideChar GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter GetTickCount ReleaseSRWLockExclusive GetConsoleMode TryAcquireSRWLockExclusive WriteConsoleW SetFileInformationByHandle GetUserDefaultLCID GetProcessHeap SetFilePointerEx GetCurrentProcessId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW FlushFileBuffers WriteFile

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

Sharing