file[.]exe | Triage™

General

Target
file.exe
Size 211KB
Sample221011-e5dneaeghk
SHA256 a3a2bfd26612b25ebcecf081889b529c4eacfd4a3df6c56dab48cfd83c5d3b88
MD5 d92523e6637cea6a19120c764fcf82a6
SHA1 611e3b0191af111c8c79b172373c9f79a8db4794
SHA512 90d10f6500a74259a8b86410416fd39d8527053922c12d9eb6895e429b2e2a0052024809a9b519751abde2e407ea7021f5188381190a8c3db50e14048c4ee1c4
SSDEEP 3072:gemOO3j43+JSzLWEnDOFjRFQN36pXto7WJ16yoGBHamIGAMjefuO:gJM3+J2LdnDOFUNKRTJ0WB6mIwj+u
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 211KB

file.exe

IMPHASH f07757163332cdbf737bafdb4614222c
SHA256 a3a2bfd26612b25ebcecf081889b529c4eacfd4a3df6c56dab48cfd83c5d3b88
MD5 d92523e6637cea6a19120c764fcf82a6
SHA1 611e3b0191af111c8c79b172373c9f79a8db4794
SHA512 90d10f6500a74259a8b86410416fd39d8527053922c12d9eb6895e429b2e2a0052024809a9b519751abde2e407ea7021f5188381190a8c3db50e14048c4ee1c4
SSDEEP 3072:gemOO3j43+JSzLWEnDOFjRFQN36pXto7WJ16yoGBHamIGAMjefuO:gJM3+J2LdnDOFUNKRTJ0WB6mIwj+u
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

40534

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesW ReadFile ReadConsoleW GetVolumeInformationA GetComputerNameW LocalFree InterlockedDecrement GetSystemTimeAdjustment SetLocaleInfoW FindNextVolumeA FindCloseChangeNotification EnumSystemCodePagesW FindNextFileA CopyFileExA MoveFileWithProgressA VerifyVersionInfoW LocalSize DosDateTimeToFileTime DebugBreak GlobalGetAtomNameA IsBadWritePtr FindResourceW GetComputerNameExA GetProcAddress GetStringTypeW GetFileTime GetConsoleAliasesLengthW DeleteVolumeMountPointA GetPrivateProfileStructA GetOEMCP GetQueuedCompletionStatus InterlockedPopEntrySList lstrcpynW WriteConsoleA GetBinaryTypeW WriteConsoleOutputA GetCommandLineA CreateActCtxA FormatMessageW GetModuleHandleA EnterCriticalSection GetComputerNameA GetStringTypeExW OpenMutexW LocalFlags RtlCaptureContext InterlockedCompareExchange InitializeCriticalSectionAndSpinCount GetPrivateProfileStructW DeleteFiber InterlockedExchangeAdd EnumDateFormatsW EnumCalendarInfoA GetConsoleAliasExesLengthW OpenSemaphoreA InterlockedIncrement GetNamedPipeHandleStateW RegisterWaitForSingleObject LocalAlloc GetLogicalDriveStringsA SetLastError CopyFileW LoadLibraryA WideCharToMultiByte InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection RtlUnwind RaiseException GetLastError HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent MoveFileA GetStartupInfoW LCMapStringA LCMapStringW GetCPInfo HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapCreate VirtualFree VirtualAlloc HeapReAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP IsValidCodePage GetLocaleInfoA GetStringTypeA HeapSize GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoW SetStdHandle GetConsoleOutputCP WriteConsoleW CreateFileA CloseHandle FlushFileBuffers

user32

CharUpperBuffA

advapi32

RevertToSelf

Sharing