file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 8.2MB
Sample260929-tw8vhsbb23
SHA256 3c1c6b94e57afd57f58b1c9e16d5f8261b16af2654ffd3196edc2ac9fe6db67e
MD5 9e6cc0f8079d16fc6286fc9547235410
SHA1 d6c1238bc6b00181392ac99e7c173b448c33b386
SHA512 1ee6fcae5af8d37b8ef73045a2b8b838b0d18c15bac2a52b04ea1f327092d5b0a7898a13307c4b173d28d574f62a2f2579fcbec01739a32dbde20aca73f94fe0
SSDEEP 49152:ERaM2wWFvG79bKoYWoW38dj5kj5br1IHc6ivuHleJB3K7PaBcgKb/tBRKQ:+FH/UjKjRxIHcZvuHleJ
TLSH
T1FF96C72592080395F539F3BE4AD97BB87B143F28B0340419B7DE6993A513DA1E3F43A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 8.2MB

file.exe

IMPHASH 52e5996627a347dff3c9d972d6ba3f74
SHA256 3c1c6b94e57afd57f58b1c9e16d5f8261b16af2654ffd3196edc2ac9fe6db67e
MD5 9e6cc0f8079d16fc6286fc9547235410
SHA1 d6c1238bc6b00181392ac99e7c173b448c33b386
SHA512 1ee6fcae5af8d37b8ef73045a2b8b838b0d18c15bac2a52b04ea1f327092d5b0a7898a13307c4b173d28d574f62a2f2579fcbec01739a32dbde20aca73f94fe0
SSDEEP 49152:ERaM2wWFvG79bKoYWoW38dj5kj5br1IHc6ivuHleJB3K7PaBcgKb/tBRKQ:+FH/UjKjRxIHcZvuHleJ
TLSH
T1FF96C72592080395F539F3BE4AD97BB87B143F28B0340419B7DE6993A513DA1E3F43A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5563880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize WriteConsoleW GetLocaleInfoW GetTimeZoneInformation CloseHandle FileTimeToSystemTime lstrlenW FormatMessageW InitOnceComplete GetProcessHeap LCMapStringW IsDBCSLeadByte IsProcessInJob GetModuleFileNameW IdnToUnicode GetSystemTimeAsFileTime GetLastError InitOnceBeginInitialize GetCurrentProcessId GetCurrentThreadId InitializeSListHead InitializeConditionVariable GetStartupInfoW RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess FreeLibrary InitOnceInitialize IsThreadAFiber IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind InitializeContext UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW

user32

EndPaint ShowWindow CharUpperW GetSystemMetrics GetClientRect GetWindowTextW RedrawWindow LoadIconW BeginPaint DrawTextW

gdi32

TextOutW GetDeviceCaps DeleteObject

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

IsUserAnAdmin SHGetKnownFolderPath

ole32

CoInitializeEx CoUninitialize CoTaskMemFree

shlwapi

PathIsRelativeW PathFileExistsW PathFindFileNameW

comctl32

ImageList_Create ImageList_Destroy ImageList_ReplaceIcon ImageList_Draw

Name

.text

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

generic