file[.]exe | Triage™

General

Target
file.exe
Size 414KB
Sample220928-e5b5ksgbel
SHA256 1f628a053ff8d30cb12d2c644382bcf91c3b0d7fe0daa878355fbd418ef97e81
MD5 dae2835ac53c88be1d3bccc33cc4640c
SHA1 b86b65e77facb97f09ed0df3f23c8f08d86eb585
SHA512 79cb0bee5d1be70e2b37303fa0afd711fef11a2af0d006458322afd62b9817969fdeedfcc47f3fbdbe47fa645b6b6f4595112002785a7ff6b2941d523ddc563d
SSDEEP 6144:V7KdCrrhCTo9vIxI9Ey8lYG5rzVhNU+4rkWX0mKnigabwVfs:V7KU5CMtIg8G4rJhi5rk1tiB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

test.yar 1 IoCs

test.

resource	yara_rule
sample	test

File Explorer

file.exe

.exe 414KB

file.exe

IMPHASH beddc31176fbd42897a58cb208f48486
SHA256 1f628a053ff8d30cb12d2c644382bcf91c3b0d7fe0daa878355fbd418ef97e81
MD5 dae2835ac53c88be1d3bccc33cc4640c
SHA1 b86b65e77facb97f09ed0df3f23c8f08d86eb585
SHA512 79cb0bee5d1be70e2b37303fa0afd711fef11a2af0d006458322afd62b9817969fdeedfcc47f3fbdbe47fa645b6b6f4595112002785a7ff6b2941d523ddc563d
SSDEEP 6144:V7KdCrrhCTo9vIxI9Ey8lYG5rzVhNU+4rkWX0mKnigabwVfs:V7KU5CMtIg8G4rJhi5rk1tiB
MD5 SHA1 SHA512 SSDEEP

windows x86

test.yar

test.

Minor OS version

Major OS version

Entry point

36921

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedCompareExchange OpenWaitableTimerW CreateEventA ReadConsoleInputA WaitNamedPipeW FindVolumeMountPointClose SetSystemTimeAdjustment FindNextFileW EnumResourceTypesW GetModuleFileNameW IsBadCodePtr DeleteFileA SearchPathW VirtualAlloc WriteConsoleOutputCharacterA GetConsoleAliasA GetShortPathNameW GetPrivateProfileStringA PeekConsoleInputA GetModuleHandleA GetProcAddress GetSystemDefaultLangID FindFirstChangeNotificationW GetFileType SetFileShortNameW lstrcpynA AddAtomW SetConsoleCtrlHandler CreateMutexA GetLongPathNameW FoldStringW ResetEvent GlobalWire GetComputerNameW GetVersionExA GetSystemDefaultLCID GetProcessHandleCount GetLastError VirtualProtect GlobalAlloc SetFileShortNameA GetFileSize GetFileAttributesExW SetComputerNameA GetFileAttributesA ReadConsoleW FindFirstChangeNotificationA GetVolumePathNameA GlobalGetAtomNameA LoadLibraryA RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle DeleteCriticalSection GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapAlloc Sleep ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount SetFilePointer ReadFile GetConsoleCP GetConsoleMode CloseHandle CreateFileA HeapSize FlushFileBuffers LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile GetProcessHeap

advapi32

ClearEventLogA

ole32

CoRevokeMallocSpy

Resubmissions

Sharing