file[.]exe | Triage™

General

Target
file.exe
Size 229KB
Sample220930-r6ey3sdhc2
SHA256 6d29256bf1304b553a02027f71cf881ba33fa964350a6e3d9736d875bf3669f0
MD5 ae2386ff88841e0c25328a0e1f57b8cf
SHA1 d51e701e24b8d16e9318f9692e708402fabf7d27
SHA512 4bd7d225f2c991f35f515cfc58753ea6a0d9445170f44b1b377e6b13be1445d5d35d222ee2bfbc36f56c296ffe5fc416b39c76abc451ffd44e03cf8605723e2c
SSDEEP 3072:RUQU8MIvxZGRdSnPKUZwrMgHkHcLx3bVZX9frSzzbSrMKAvNM3wooChhjWrTH:blvxZio+kH0xLVffsq2MAehjSH
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 229KB

file.exe

IMPHASH 51ffa0852b439367601a9c1a24552133
SHA256 6d29256bf1304b553a02027f71cf881ba33fa964350a6e3d9736d875bf3669f0
MD5 ae2386ff88841e0c25328a0e1f57b8cf
SHA1 d51e701e24b8d16e9318f9692e708402fabf7d27
SHA512 4bd7d225f2c991f35f515cfc58753ea6a0d9445170f44b1b377e6b13be1445d5d35d222ee2bfbc36f56c296ffe5fc416b39c76abc451ffd44e03cf8605723e2c
SSDEEP 3072:RUQU8MIvxZGRdSnPKUZwrMgHkHcLx3bVZX9frSzzbSrMKAvNM3wooChhjWrTH:blvxZio+kH0xLVffsq2MAehjSH
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

14375

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFilePointer OpenFileMappingA GetProfileIntA ReadFile ReadConsoleW GetVolumeInformationW GetComputerNameW LocalShrink InterlockedExchange SetSystemTimeAdjustment SetLocaleInfoW FindNextVolumeW FindCloseChangeNotification CopyFileExW MoveFileWithProgressW GetProfileSectionA GetProductInfo LocalSize FileTimeToDosDateTime FindFirstChangeNotificationW GlobalGetAtomNameA FindResourceExA GetComputerNameExA GetModuleHandleW GetTempPathW BuildCommDCBAndTimeoutsW GetProcAddress LoadLibraryA GetFileTime SetConsoleScreenBufferSize GetPrivateProfileStructA GetCPInfo PostQueuedCompletionStatus GlobalFindAtomW TerminateJobObject lstrcpynA WriteConsoleA GetBinaryTypeA GetLastError GetCommandLineA InterlockedIncrement VerifyVersionInfoA CreateActCtxW FormatMessageW GetConsoleAliasA GetModuleHandleA LoadLibraryW LeaveCriticalSection EnumSystemLocalesA GetStringTypeExW OpenMutexW SearchPathA FindResourceW GetSystemTimeAdjustment InterlockedCompareExchange GetOverlappedResult GetPrivateProfileStructW DeleteFiber InterlockedExchangeAdd EnumDateFormatsW InterlockedDecrement FindActCtxSectionStringW GetNamedPipeHandleStateW RegisterWaitForSingleObject GlobalAlloc QueryMemoryResourceNotification SetLastError GetProcessPriorityBoost SetMailslotInfo GetConsoleMode LCMapStringW Sleep ExitProcess DeleteFileA GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection EnterCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage HeapSize RtlUnwind GetLocaleInfoA HeapAlloc VirtualAlloc HeapReAlloc GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA

user32

CharUpperW

winhttp

WinHttpQueryOption

Sharing