file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 1.3MB
Sample261013-3khcvsdg28
SHA256 ac04d6f242b026ee7be404dd99a0d09564b1c74eb7e453401dc2c15b680bad05
MD5 261c8f16e809fdcf42b97bacee9e523f
SHA1 ca99deaba23c339bdc816e5ea3977849fa437f2a
SHA512 d96b33dc666ac8365de0d903f3a08b21173a5a74c25c73e9705ff58f617d692404f6492d9b766fa85b33b5b22c8466f6e6ecd2b873cdfac0d82f39cd8fa8429d
SSDEEP 24576:f8BWYGVh9vHksLmy+FZ3tLOvEWXGT2z1MEunuYG/P7j+:f8B9GVosLf+F362TGMEu4/P7y
TLSH
T13D555A23A7941DFAF467C178C9624122E672F83D07E066DB3A9C6A551F337D12AFA301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file.exe

File Explorer

file.exe

.exe 1.3MB

file.exe

IMPHASH 93d1b3e50a85a553c3c93867946901c2
SHA256 ac04d6f242b026ee7be404dd99a0d09564b1c74eb7e453401dc2c15b680bad05
MD5 261c8f16e809fdcf42b97bacee9e523f
SHA1 ca99deaba23c339bdc816e5ea3977849fa437f2a
SHA512 d96b33dc666ac8365de0d903f3a08b21173a5a74c25c73e9705ff58f617d692404f6492d9b766fa85b33b5b22c8466f6e6ecd2b873cdfac0d82f39cd8fa8429d
SSDEEP 24576:f8BWYGVh9vHksLmy+FZ3tLOvEWXGT2z1MEunuYG/P7j+:f8B9GVosLf+F362TGMEu4/P7y
TLSH
T13D555A23A7941DFAF467C178C9624122E672F83D07E066DB3A9C6A551F337D12AFA301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

689412

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA

shell32

ShellExecuteW CommandLineToArgvW SHCreateDirectoryExW

kernel32

GetEnvironmentVariableW CreateFileW GetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError SetLastError SetErrorMode ReleaseMutex CreateMutexW GetCurrentProcess CreateProcessW SetPriorityClass GetModuleFileNameW LocalFree CopyFileW MultiByteToWideChar SetEvent ResetEvent WaitForSingleObject CreateEventW OpenEventW GetPriorityClass GetCurrentProcessId GetCurrentThreadId GetLocalTime GetSystemTimes GetCommandLineW GetSystemPowerStatus GetNativeSystemInfo GetActiveProcessorCount GlobalMemoryStatusEx WaitForMultipleObjects FindClose FindNextFileW WideCharToMultiByte GetSystemTimeAsFileTime VirtualAlloc VirtualProtect VirtualFree GetLargePageMinimum MoveFileExA GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW DeleteFileW HeapQueryInformation HeapSize HeapReAlloc GetFileSizeEx GetConsoleOutputCP SetFilePointerEx ReadConsoleW SetStdHandle FlushFileBuffers SetEndOfFile WriteConsoleW GetSystemInfo GetConsoleMode QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared GetTickCount64 InitializeCriticalSectionEx GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ReadFile ExitProcess GetStdHandle HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW

ws2_32

GetAddrInfoExCancel GetAddrInfoExW WSAGetLastError WSACleanup WSAStartup socket getnameinfo setsockopt send select recv getsockopt ioctlsocket connect closesocket inet_pton FreeAddrInfoExW shutdown

crypt32

CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW

bcrypt

BCryptGenRandom

Name

.text

Size

808KB

Virtual Size

807KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

290KB

Virtual Size

289KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

advapi32

shell32

kernel32

ws2_32

crypt32

bcrypt

generic