Experiment[.]exe | Triage™

General

Target
Experiment.exe
Size 434KB
Sample260924-sadltavy8k
SHA256 ba7d4f05d3cc536ff352c054ea353bbcebe408ce051f7e59f3412f8bbf14e5c6
MD5 c33b781d85f544ee0f1e950a2fff5f3d
SHA1 e38b2cc421b086103cc413d23abe2effc49a61aa
SHA512 1d01f0d4bf6bda37008e75898230c532d239b1604d93a628533ae22f9df25ba71d6c140d0d73dbb96fd58ce2621d77b1e7117ef511da4196b3bae3a9acf0b78e
SSDEEP 6144:W6S7CwG2O1YfkRjRmx+TXBqProkgD+Dph0lhSMXlBXBWnYq6JC2XXQ:H6sBRmx+TXBurobD0ph0lhSMXliD
TLSH
T19C949D16B3E541F9E22786788C970A05EA3378414751EBCF03A8E9B62F636D15F3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Experiment.exe

File Explorer

Experiment.exe

.exe 434KB

Experiment.exe

IMPHASH 6e2e9a0d7ee8bb03724765833517b337
SHA256 ba7d4f05d3cc536ff352c054ea353bbcebe408ce051f7e59f3412f8bbf14e5c6
MD5 c33b781d85f544ee0f1e950a2fff5f3d
SHA1 e38b2cc421b086103cc413d23abe2effc49a61aa
SHA512 1d01f0d4bf6bda37008e75898230c532d239b1604d93a628533ae22f9df25ba71d6c140d0d73dbb96fd58ce2621d77b1e7117ef511da4196b3bae3a9acf0b78e
SSDEEP 6144:W6S7CwG2O1YfkRjRmx+TXBqProkgD+Dph0lhSMXlBXBWnYq6JC2XXQ:H6sBRmx+TXBurobD0ph0lhSMXliD
TLSH
T19C949D16B3E541F9E22786788C970A05EA3378414751EBCF03A8E9B62F636D15F3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

76608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\D2\Projects\NewCpp\Experiment\out\Experiment\Release\x64\Experiment.pdb

kernel32

CreateRemoteThread GetCurrentProcessId CloseHandle GetLastError ProcessIdToSessionId GetExitCodeThread OpenProcess DuplicateHandle QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WriteProcessMemory GetProcessId ReadProcessMemory VirtualProtectEx VirtualAllocEx VirtualFreeEx MultiByteToWideChar WideCharToMultiByte LCMapStringEx FindClose FindFirstFileExW FindNextFileW WaitForSingleObject GetProcAddress EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo GetStdHandle SetConsoleMode GetConsoleMode SetStdHandle FlushConsoleInputBuffer RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree WriteFile GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent GetConsoleCP HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetFileSizeEx SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapReAlloc CreateFileW ReadConsoleInputW ReadConsoleW FlushFileBuffers ReadFile HeapSize WriteConsoleW GetCurrentProcess SetLastError RtlUnwind

advapi32

AdjustTokenPrivileges WaitServiceState QueryServiceStatus CloseServiceHandle OpenSCManagerW SetTokenInformation LookupPrivilegeNameW ControlService OpenProcessToken GetTokenInformation DuplicateTokenEx OpenServiceW CreateProcessAsUserW StartServiceW

ntdll

NtQuerySystemInformation RtlNtStatusToDosError

Name

.text

Size

193KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Experiment.exe

kernel32

advapi32

ntdll

generic