notepad[.]exe | Triage™

General

Target
notepad.exe
Size 275KB
Sample220308-jqepdafffr
SHA256 efd04e8f37b1a511e4c723356220d4c07a27a8e8b5a370ea7a7a6b8a5d98ea6b
MD5 602644e238f0cff8552374b9defc11e4
SHA1 05418d9bc58d485697de77d71e1157773016333e
SHA512 e3ca80cb47e64973f6e1bfaf70bc3a822722178bdd4e579e9b7c5ba86c0d021a00e3c28a9feed43742082cc90851b3b6180629d3c45990296e1f563b57f3bf4d
MD5 SHA1 SHA512

Score

N/A

Malware Config

Signatures

File Explorer

notepad.exe

.exe 275KB

notepad.exe

IMPHASH 30b61c273b1d343ed1b1e7a06292b7df
SHA256 efd04e8f37b1a511e4c723356220d4c07a27a8e8b5a370ea7a7a6b8a5d98ea6b
MD5 602644e238f0cff8552374b9defc11e4
SHA1 05418d9bc58d485697de77d71e1157773016333e
SHA512 e3ca80cb47e64973f6e1bfaf70bc3a822722178bdd4e579e9b7c5ba86c0d021a00e3c28a9feed43742082cc90851b3b6180629d3c45990296e1f563b57f3bf4d
MD5 SHA1 SHA512

windows x86

Minor OS version

Major OS version

Entry point

21575

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ZombifyActCtx GetEnvironmentStringsW GetConsoleAliasesA GetEnvironmentStrings GlobalAlloc WideCharToMultiByte LoadLibraryW SetVolumeMountPointA LeaveCriticalSection HeapValidate WriteConsoleW GetAtomNameW ReplaceFileA SetLastError AttachConsole FindFirstChangeNotificationW BeginUpdateResourceW SetStdHandle LoadLibraryA AddVectoredExceptionHandler WriteProfileSectionW GetModuleFileNameA GetDefaultCommConfigA SetConsoleTitleW GetConsoleTitleW SetCalendarInfoA LocalFree VirtualAlloc EnumResourceNamesW HeapAlloc GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree DeleteCriticalSection EnterCriticalSection VirtualFree HeapReAlloc HeapCreate GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle SetHandleCount GetFileType GetStartupInfoA SetFilePointer CloseHandle GetModuleFileNameW FreeEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode MultiByteToWideChar FlushFileBuffers HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP CreateFileA

Sharing