file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 1.7MB
Sample221025-matedaccdr
SHA256 9ee4629c44106c3a802d02cfa1e67ebb15a615a652d4bd087a3c07e8786531b0
MD5 366acd2b67b2b2043f0b4a7532de20e9
SHA1 5f4c30ff1fbd06ab366898160504830d1ca47657
SHA512 4ecd5530b1471a3d3f238c6396072f91028b417f5962b1015b6b2eb1aae957a82d24388f1894169ced9e1d31cd09e884ad27c5f507ca0e21daa33fc28721c80c
SSDEEP 49152:IT8jRCTk5sKML0nJfvD+IOYyWC+ovZlA+8gkE:IT8jRESI0nJKvvMvE
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 1.7MB

file.exe

IMPHASH d742af36dbf70ae1be4c1cbc670abd18
SHA256 9ee4629c44106c3a802d02cfa1e67ebb15a615a652d4bd087a3c07e8786531b0
MD5 366acd2b67b2b2043f0b4a7532de20e9
SHA1 5f4c30ff1fbd06ab366898160504830d1ca47657
SHA512 4ecd5530b1471a3d3f238c6396072f91028b417f5962b1015b6b2eb1aae957a82d24388f1894169ced9e1d31cd09e884ad27c5f507ca0e21daa33fc28721c80c
SSDEEP 49152:IT8jRCTk5sKML0nJfvD+IOYyWC+ovZlA+8gkE:IT8jRESI0nJKvvMvE
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

244515

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsProcessorFeaturePresent GetModuleHandleA GetProcAddress MultiByteToWideChar FreeConsole CreateThread CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess WideCharToMultiByte EncodePointer DecodePointer InitializeCriticalSectionEx LCMapStringEx GetStringTypeW GetCPInfo CreateFileW RaiseException RtlUnwind GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc HeapSize WriteConsoleW

Name

.text

Size

350KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

261KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

ɦK�X

Size

246KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_MEM_READ

Name

ǔ�U_

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_MEM_READ

Name

�Vx�

Size

219KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_MEM_READ

Name

AjW��

Size

220KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_MEM_READ

Name

y:=�{

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_MEM_READ