file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 102KB
Sample260923-1xca9sec92
SHA256 f2569f9368a1c6a7a3a11e94931ec3be9846ea9e5c98958d29e975f9b56a8467
MD5 b3b7ea95efc09c7fe9976fc378eb64c6
SHA1 6524b8e8f677d16761c65495ec955c25184f7e2d
SHA512 e0b580b0bb257d9cdefb274157acec7b291e520578c5e3bb0f45f414d8161a07ec04ba81b03f4b5ba0cb1f3700aff0ea7055d45c6da8f506c18ceca3734a5070
SSDEEP 1536:sy7QJLyXw2hochQP/EQwi4RNrXuRABqMkyF29OFzuShLYWOiHJCTH:Wkm/ZD4RNrueFzFvEWODr
TLSH
T17CA30773EAD261AED0B7C63498F392327B75F8105B22A7AF47504A302F62BD05E74B45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 102KB

file.exe

IMPHASH 3bd5a63deb8fc84f31e78555c69beb40
SHA256 f2569f9368a1c6a7a3a11e94931ec3be9846ea9e5c98958d29e975f9b56a8467
MD5 b3b7ea95efc09c7fe9976fc378eb64c6
SHA1 6524b8e8f677d16761c65495ec955c25184f7e2d
SHA512 e0b580b0bb257d9cdefb274157acec7b291e520578c5e3bb0f45f414d8161a07ec04ba81b03f4b5ba0cb1f3700aff0ea7055d45c6da8f506c18ceca3734a5070
SSDEEP 1536:sy7QJLyXw2hochQP/EQwi4RNrXuRABqMkyF29OFzuShLYWOiHJCTH:Wkm/ZD4RNrueFzFvEWODr
TLSH
T17CA30773EAD261AED0B7C63498F392327B75F8105B22A7AF47504A302F62BD05E74B45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CloseServiceHandle CreateServiceW GetTokenInformation OpenProcessToken OpenSCManagerW OpenServiceW RegCloseKey RegOpenKeyExW RegSetValueExW StartServiceW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreateSolidBrush DeleteDC DeleteObject GetDIBits SelectObject SetBkMode SetTextColor

iphlpapi

GetIpNetTable

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection ExitProcess FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileSizeEx GetLastError GetLocalTime GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessHeap GetTempPathW GetTickCount GetTickCount64 GetVolumePathNamesForVolumeNameW HeapAlloc HeapFree HeapReAlloc InitializeConditionVariable InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW MoveFileW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReadFile SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TerminateProcess TerminateThread TlsGetValue VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile __C_specific_handler

mpr

WNetAddConnection2W WNetCancelConnection2W WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-environment-l1-1-0

__p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcpy memmove wcschr wcsrchr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _beginthreadex _cexit _configure_wide_argv _crt_atexit _exit _set_app_type _initialize_wide_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

_wcsicmp _wcsnicmp memset strlen strncmp towlower towupper wcscat wcscmp wcscpy wcslen wcsncpy

api-ms-win-crt-utility-l1-1-0

qsort

netapi32

NetApiBufferFree NetServerEnum NetShareEnum

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree

shell32

SHCreateDirectoryExW SHEmptyRecycleBinW SHGetFolderPathW

user32

DrawTextW FillRect GetDC ReleaseDC ShowWindow SystemParametersInfoW wsprintfW

ws2_32

WSAStartup closesocket connect freeaddrinfo getaddrinfo ioctlsocket select socket

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

advapi32

bcrypt

gdi32

iphlpapi

kernel32

mpr

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

netapi32

ole32

shell32

user32

ws2_32

generic