file[.]exe | Triage™

General

Target
file.exe
Size 145KB
Sample221006-cnz4zagdan
SHA256 bf9d78f4666b7c7f4fd29634ca53fe9202ebcfc3a2bfc6eb9d4b0b4dcbb3874d
MD5 c691f496f6cee823325e5f0a76ef47dc
SHA1 382c62254eff1af0d48ce7e2dda5df74cf23b6c1
SHA512 1c161a372fbbbaf367448e7fbac32ccd41a14210a3f0b7870d70333ad4497b9abb7c31d73d17f5ad0f13feb735456648ee7daf5de794a2c2e77cf8141da90b1b
SSDEEP 1536:261Nmp9PQ6xJiBhf/Ekmf1sPbg3BMuK25Sf3oPoGKTs5+jlMD9E5c0yNm/Oi:261NkL2hf/OsDgRMXi43t45U89KmgO
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 145KB

file.exe

IMPHASH 56dbf612f54c9ba62f45480e8cc28119
SHA256 bf9d78f4666b7c7f4fd29634ca53fe9202ebcfc3a2bfc6eb9d4b0b4dcbb3874d
MD5 c691f496f6cee823325e5f0a76ef47dc
SHA1 382c62254eff1af0d48ce7e2dda5df74cf23b6c1
SHA512 1c161a372fbbbaf367448e7fbac32ccd41a14210a3f0b7870d70333ad4497b9abb7c31d73d17f5ad0f13feb735456648ee7daf5de794a2c2e77cf8141da90b1b
SSDEEP 1536:261Nmp9PQ6xJiBhf/Ekmf1sPbg3BMuK25Sf3oPoGKTs5+jlMD9E5c0yNm/Oi:261NkL2hf/OsDgRMXi43t45U89KmgO
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19287

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesA ReadFile ReadConsoleW GetVolumeInformationA GetComputerNameA LocalFree InterlockedDecrement GetSystemTimeAdjustment SetLocaleInfoA FindNextVolumeA FindNextChangeNotification CopyFileExA MoveFileWithProgressA VerifyVersionInfoA LocalSize FileTimeToDosDateTime DebugBreak GlobalGetAtomNameA IsBadWritePtr FindResourceW GetComputerNameExA GetProcAddress GetStringTypeW GetFileTime GetConsoleAliasesLengthW DeleteVolumeMountPointA GetCPInfo GetQueuedCompletionStatus InterlockedPushEntrySList lstrcpynW WriteConsoleW GetBinaryTypeW WriteConsoleOutputA GetCommandLineA VerifyVersionInfoW CreateActCtxW FormatMessageW GetModuleHandleA EnterCriticalSection GetStringTypeExA OpenMutexW RtlCaptureContext InterlockedExchange InitializeCriticalSectionAndSpinCount GetPrivateProfileStructA DeleteFiber InterlockedExchangeAdd EnumDateFormatsA InterlockedIncrement GetNamedPipeHandleStateW RegisterWaitForSingleObject LocalAlloc QueryMemoryResourceNotification SetLastError SetFilePointer CopyFileW LoadLibraryA RaiseException RtlUnwind GetLastError MoveFileA DeleteFileA GetStartupInfoA HeapAlloc HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection VirtualAlloc HeapReAlloc HeapSize GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar LCMapStringA LCMapStringW

user32

CharUpperBuffW

advapi32

RevertToSelf

Sharing