file[.]exe | Triage™

General

Target
file.exe
Size 5.6MB
Sample221019-tmc2gsfdfr
SHA256 203f591e084a2ece60b2be5c13fbafa673ecac10ef91055ad7bd73fddc656b5d
MD5 74cffc19a09979e23bfd9f5a5378508b
SHA1 54e1969a3f4000a610aec127bf2d9028e0dc7588
SHA512 be1aa3e40639201f9f5eb6a476ac8a4ca8381eb92c116f4b472d661e435b2b4115337879b59caec4ee397df0adaba5011054cfb425eb9978e82bdb1dea9aaae5
SSDEEP 98304:cdqxlydvAURQUc6QSiSbgOOzVbRRtYoa5JSY8ANYCfBeGO:cdkqAURQUc6QSgOOnA7lhBo
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 5.6MB

file.exe

IMPHASH 0721ccf5c6e6216d478ef8b62a185a8b
SHA256 203f591e084a2ece60b2be5c13fbafa673ecac10ef91055ad7bd73fddc656b5d
MD5 74cffc19a09979e23bfd9f5a5378508b
SHA1 54e1969a3f4000a610aec127bf2d9028e0dc7588
SHA512 be1aa3e40639201f9f5eb6a476ac8a4ca8381eb92c116f4b472d661e435b2b4115337879b59caec4ee397df0adaba5011054cfb425eb9978e82bdb1dea9aaae5
SSDEEP 98304:cdqxlydvAURQUc6QSiSbgOOzVbRRtYoa5JSY8ANYCfBeGO:cdkqAURQUc6QSgOOnA7lhBo
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

28688

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentThreadId GetCurrentProcessId WriteConsoleW SetEndOfFile HeapSize CreateFileW GetProcessHeap SetStdHandle EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree CloseHandle GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RtlUnwind

user32

GetForegroundWindow PostMessageA

shell32

ShellExecuteA

Name

.text

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

shell32