file[.]exe | Triage™

General

Target
file.exe
Size 290KB
Sample220929-mchewsbebl
SHA256 e7aee53b7e1b227bbc873e7bb00a789ece328bb061253ca7d4135c44a7a6b7b7
MD5 6b94ce1bf64e08c099dfccaaa31c1351
SHA1 def1ca50af65c112fd8b1c19037b7277b67cf0d3
SHA512 6849a1cc260c7eee1f6aa27987dd201f7840dae5473b591d774642934c178d1f695e997b21ca4916e90424977618b73b3eae63ec53d4dcc159445d687f334d9a
SSDEEP 3072:5XheZONy+2UKyae35SqcAHD6r2ujbIh1qEn8CHFzC4K5b6ex0K4M/h3JpZa9uD6t:ds8nKyadAjavIhIYBA4GWex0RwwVfgU
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 290KB

file.exe

IMPHASH a07b1168025450aad3f23c1b945db1fb
SHA256 e7aee53b7e1b227bbc873e7bb00a789ece328bb061253ca7d4135c44a7a6b7b7
MD5 6b94ce1bf64e08c099dfccaaa31c1351
SHA1 def1ca50af65c112fd8b1c19037b7277b67cf0d3
SHA512 6849a1cc260c7eee1f6aa27987dd201f7840dae5473b591d774642934c178d1f695e997b21ca4916e90424977618b73b3eae63ec53d4dcc159445d687f334d9a
SSDEEP 3072:5XheZONy+2UKyae35SqcAHD6r2ujbIh1qEn8CHFzC4K5b6ex0K4M/h3JpZa9uD6t:ds8nKyadAjavIhIYBA4GWex0RwwVfgU
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

31017

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetModuleHandleA FoldStringA InterlockedCompareExchange OpenWaitableTimerA CreateEventA ReadConsoleInputW WaitNamedPipeA SetVolumeMountPointA SetSystemTimeAdjustment FindNextFileW EnumResourceTypesA GetModuleFileNameA IsBadCodePtr LoadLibraryW DeleteFileW SearchPathA VirtualAlloc WriteConsoleOutputCharacterW GetConsoleAliasW GetShortPathNameW GetPrivateProfileStringW PeekConsoleInputW GlobalGetAtomNameA GetProcAddress GetUserDefaultLangID FindFirstChangeNotificationW GetFileType SetFileShortNameW lstrcpynA AddAtomW SetConsoleCtrlHandler CreateMutexA GetLongPathNameW ResetEvent GlobalWire GetComputerNameA GetVersionExW GetSystemDefaultLCID GetProcessHandleCount GetLastError VirtualProtect GlobalAlloc SetCalendarInfoW SetComputerNameA GetFileAttributesA GetVolumePathNameW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetCommandLineA GetStartupInfoA HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle DeleteCriticalSection Sleep ExitProcess WriteFile FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount SetFilePointer ReadFile GetConsoleCP GetConsoleMode CloseHandle CreateFileA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile GetProcessHeap

ole32

OleQueryCreateFromData

winhttp

WinHttpCloseHandle

Sharing