pip[.]exe | Triage™

General

Target
pip.exe
Size 105KB
Sample261102-3tf66ady6w
SHA256 032ef64a62443cf10201acd8e77db36966c7c4e7795c3e9e0cfd700139b79931
MD5 515e0045dfa5a6bbc4aeca04813a7d11
SHA1 31f51f867ff6c16f4ba0329c4366caa7d269a50d
SHA512 9214cd1143c8b99a604ba9222e800c7c06db20a7f576966a0c9f9edca0a835a4fdf8fb52db00778d6ab1f1bbb23319f1f43d32b038f232952ac155b14c9c17f8
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GqS:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+bS
TLSH
T187B36A0A33D420FDD0575274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pip.exe

File Explorer

pip.exe

.exe 105KB

pip.exe

IMPHASH c51d659b4b1142d4af3795d09f1d63f7
SHA256 032ef64a62443cf10201acd8e77db36966c7c4e7795c3e9e0cfd700139b79931
MD5 515e0045dfa5a6bbc4aeca04813a7d11
SHA1 31f51f867ff6c16f4ba0329c4366caa7d269a50d
SHA512 9214cd1143c8b99a604ba9222e800c7c06db20a7f576966a0c9f9edca0a835a4fdf8fb52db00778d6ab1f1bbb23319f1f43d32b038f232952ac155b14c9c17f8
SSDEEP 1536:1966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+GqS:j8wDSRUT0kbAYn2GgYlBYN2fHYTo+bS
TLSH
T187B36A0A33D420FDD0575274CDB69A15D3B2BC2A4274934F27A47B6A1F733926D2EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

17020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\t64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError SetStdHandle GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle HeapSize GetProcessHeap SetEndOfFile SetEnvironmentVariableW HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer DecodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc GetProcAddress GetModuleHandleW WriteFile SetHandleCount DeleteCriticalSection Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW LoadLibraryW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Sharing