file[.]exe | Triage™

General

Target
file.exe
Size 233KB
Sample221005-3fd5msgbej
SHA256 0670be19d69df3a74ce4adf22db4c4de1885d592c430e58942fb247409cd8eed
MD5 2180cd2c1867ab5a820c5ed398315cb0
SHA1 e3dbd8ccf4d0f49936ce00baeada9923d043bf28
SHA512 3064dba0d25730599c4aef83db68babc88d38788d198087549c49065d27e917a4fbad2d3782a5e05eae474ac8a76f54036b46936bf66a5665adba962c5c157de
SSDEEP 3072:L11Qlz4hfSTn61Iq3v8yceS3Thc7ztPGNx5SsIg9n9jIScRi+eAuF50yhFFr5IRn:xqO1dvPcS7ztPYSlMMQ+duHF3RQWAC
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 233KB

file.exe

IMPHASH 56dbf612f54c9ba62f45480e8cc28119
SHA256 0670be19d69df3a74ce4adf22db4c4de1885d592c430e58942fb247409cd8eed
MD5 2180cd2c1867ab5a820c5ed398315cb0
SHA1 e3dbd8ccf4d0f49936ce00baeada9923d043bf28
SHA512 3064dba0d25730599c4aef83db68babc88d38788d198087549c49065d27e917a4fbad2d3782a5e05eae474ac8a76f54036b46936bf66a5665adba962c5c157de
SSDEEP 3072:L11Qlz4hfSTn61Iq3v8yceS3Thc7ztPGNx5SsIg9n9jIScRi+eAuF50yhFFr5IRn:xqO1dvPcS7ztPYSlMMQ+duHF3RQWAC
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19287

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesA ReadFile ReadConsoleW GetVolumeInformationA GetComputerNameA LocalFree InterlockedDecrement GetSystemTimeAdjustment SetLocaleInfoA FindNextVolumeA FindNextChangeNotification CopyFileExA MoveFileWithProgressA VerifyVersionInfoA LocalSize FileTimeToDosDateTime DebugBreak GlobalGetAtomNameA IsBadWritePtr FindResourceW GetComputerNameExA GetProcAddress GetStringTypeW GetFileTime GetConsoleAliasesLengthW DeleteVolumeMountPointA GetCPInfo GetQueuedCompletionStatus InterlockedPushEntrySList lstrcpynW WriteConsoleW GetBinaryTypeW WriteConsoleOutputA GetCommandLineA VerifyVersionInfoW CreateActCtxW FormatMessageW GetModuleHandleA EnterCriticalSection GetStringTypeExA OpenMutexW RtlCaptureContext InterlockedExchange InitializeCriticalSectionAndSpinCount GetPrivateProfileStructA DeleteFiber InterlockedExchangeAdd EnumDateFormatsA InterlockedIncrement GetNamedPipeHandleStateW RegisterWaitForSingleObject LocalAlloc QueryMemoryResourceNotification SetLastError SetFilePointer CopyFileW LoadLibraryA RaiseException RtlUnwind GetLastError MoveFileA DeleteFileA GetStartupInfoA HeapAlloc HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection VirtualAlloc HeapReAlloc HeapSize GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar LCMapStringA LCMapStringW

user32

CharUpperBuffW

advapi32

RevertToSelf

Sharing