Desktop[.]exe | Triage™

General

Target
Desktop.exe
Size 4.6MB
Sample260923-2m2c3sfb55
SHA256 adfdee62a4a50f6cc697f121de02492aa061100fdc3b593f8ddd3ab6037b5eac
MD5 7bceb72f54d99dd03a0bde2e1f426071
SHA1 e5d36580ee7a69290c584124ee43162f6cbe09f2
SHA512 2bd41100c8a50fdf8773c402b9a55407302e16b9fff23840df1e2fa9fa3ed3d8192b2a4d3bfc949b3a5cd7a943576a1eea71a260dfae7147efa7b6055f0279d6
SSDEEP 24576:mgnangfTkjjpdpKTc8tTwM0lLriSE7ALuswiY4tqNaPGP0RmRJVs/jJf9mS78F6j:mjiU3eTHuxhasEViAnXtN6Xg
TLSH
T13D26091575FD461AF8B6A2B54FEACAA79DB2BC084E77420F21A0136F5D31E102837B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Desktop.exe

File Explorer

Desktop.exe

.exe 4.6MB

Desktop.exe

IMPHASH 341e6981af1df643aa2b9746596b7213
SHA256 adfdee62a4a50f6cc697f121de02492aa061100fdc3b593f8ddd3ab6037b5eac
MD5 7bceb72f54d99dd03a0bde2e1f426071
SHA1 e5d36580ee7a69290c584124ee43162f6cbe09f2
SHA512 2bd41100c8a50fdf8773c402b9a55407302e16b9fff23840df1e2fa9fa3ed3d8192b2a4d3bfc949b3a5cd7a943576a1eea71a260dfae7147efa7b6055f0279d6
SSDEEP 24576:mgnangfTkjjpdpKTc8tTwM0lLriSE7ALuswiY4tqNaPGP0RmRJVs/jJf9mS78F6j:mjiU3eTHuxhasEViAnXtN6Xg
TLSH
T13D26091575FD461AF8B6A2B54FEACAA79DB2BC084E77420F21A0136F5D31E102837B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm50

EVENT_SINK_GetIDsOfNames ord690 ord588 MethCallEngine EVENT_SINK_Invoke ord516 ord625 ord518 ord519 ord626 ord552 ord553 ord660 ord661 ord556 ord557 ord665 ord558 ord666 Zombie_GetTypeInfo ord669 ord591 ord592 ord593 ord300 ord594 ord301 ord595 ord302 ord596 ord303 ord304 ord598 ord305 ord306 ord520 ord307 ord308 ord522 ord309 ord524 ord631 ord525 ord632 ord526 EVENT_SINK_AddRef ord528 ord529 ord560 ord561 ord562 DllFunctionCall ord563 ord670 Zombie_GetTypeInfoCount EVENT_SINK_Release ord600 ord601 ord310 ord311 EVENT_SINK_QueryInterface __vbaExceptHandler ord312 ord313 ord314 ord606 ord315 ord607 ord316 ord608 ord319 ord534 ProcCallEngine ord535 ord536 ord537 ord538 ord645 ord570 ord648 ord571 ord572 ord573 ord681 ord576 ord577 ord578 ord685 ord100 ord689 ord610 ord320 ord612 ord321 ord613 ord616 ord617 ord618 ord619 ord542 ord543 ord650 ord544 ord545 ord546 ord547 ord580 ord581

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

Desktop.exe

msvbvm50

generic