file[.]exe | Triage™

General

Target
file.exe
Size 211KB
Sample221011-d22qdschel
SHA256 383f424d25e95e6d1b0b903ff48c8634e00cf27b864a7319c45fe9f04495d76e
MD5 6b60aab71f4ac8420abaaed17cbf6f39
SHA1 63975ba96ab74f28b1b747d68793fcbeda589998
SHA512 267771ea7e5585d4083909035fa342ce2f041f6522325021df729d020ed2757a5d8e2f0b1f3e0370a02b2199f1943a72f36f8d7e739857285b9e08e0987c5e8d
SSDEEP 3072:x/Iio/XH3AH0az7L6Q7v/RGfEYe24JMW1/iBIfo0Gktfid9mlcSmlscxtnwO:xQi2rUL6Q7vMuJ4Cfo0zm9SOlsc/nw
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 211KB

file.exe

IMPHASH 78ee95c35be8f9cbb7d14afcce7e80bb
SHA256 383f424d25e95e6d1b0b903ff48c8634e00cf27b864a7319c45fe9f04495d76e
MD5 6b60aab71f4ac8420abaaed17cbf6f39
SHA1 63975ba96ab74f28b1b747d68793fcbeda589998
SHA512 267771ea7e5585d4083909035fa342ce2f041f6522325021df729d020ed2757a5d8e2f0b1f3e0370a02b2199f1943a72f36f8d7e739857285b9e08e0987c5e8d
SSDEEP 3072:x/Iio/XH3AH0az7L6Q7v/RGfEYe24JMW1/iBIfo0Gktfid9mlcSmlscxtnwO:xQi2rUL6Q7vMuJ4Cfo0zm9SOlsc/nw
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

40502

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesW ReadFile ReadConsoleW GetVolumeInformationA GetComputerNameW LocalFree InterlockedDecrement GetSystemTimeAdjustment SetLocaleInfoW FindNextVolumeA FindCloseChangeNotification EnumSystemCodePagesW FindNextFileA CopyFileExA MoveFileWithProgressA VerifyVersionInfoW LocalSize DosDateTimeToFileTime DebugBreak GlobalGetAtomNameA IsBadWritePtr FindResourceW GetComputerNameExA GetProcAddress GetStringTypeW GetFileTime GetConsoleAliasesLengthW DeleteVolumeMountPointA GetPrivateProfileStructA GetOEMCP InterlockedPopEntrySList CopyFileW lstrcpynW WriteConsoleA GetBinaryTypeW WriteConsoleOutputA GetCommandLineA CreateActCtxA FormatMessageW GetModuleHandleA EnterCriticalSection GetComputerNameA GetStringTypeExW OpenMutexW LocalFlags RtlCaptureContext InterlockedCompareExchange InitializeCriticalSectionAndSpinCount GetPrivateProfileStructW DeleteFiber InterlockedExchangeAdd EnumDateFormatsW InterlockedIncrement GetNamedPipeHandleStateW RegisterWaitForSingleObject LocalAlloc GetLogicalDriveStringsA SetLastError GetQueuedCompletionStatus LoadLibraryA WideCharToMultiByte InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection RtlUnwind RaiseException GetLastError HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent MoveFileA GetStartupInfoW LCMapStringA LCMapStringW GetCPInfo HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapCreate VirtualFree VirtualAlloc HeapReAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP IsValidCodePage GetLocaleInfoA GetStringTypeA HeapSize GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoW SetStdHandle GetConsoleOutputCP WriteConsoleW CreateFileA CloseHandle FlushFileBuffers

user32

CharUpperBuffA

advapi32

RevertToSelf

Sharing