file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 2.4MB
Sample221027-m99weabhe6
SHA256 4ea1794bc1cee4c7fd13b64636ed8a16c69b9dbd37e6d31bd19b04e9d9c08f3b
MD5 1b9a93529a6d91bd7b2ec1fd4a5fb787
SHA1 ba12fcf04011048fc24686d0cd471b49f9208013
SHA512 c8ec30e4fbe84370dadad8b7db2f2b0a97f7d856d91ded8c741d19feec4fb035d7076f3dc823161c6dba946b18ecec3145b49dbe23ac080dd4fd6e976e0a5d0c
SSDEEP 49152:oy6gENdxgA/43N3Ho+KrCTV3+k6OjYliPklf9GFwMJfLklBEKPuc5zVGI:oySNS3HRIE4OMli8R0wnlPF1
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 2.4MB

file.exe

IMPHASH 08569e64bf889aa1485728956b8b0f52
SHA256 4ea1794bc1cee4c7fd13b64636ed8a16c69b9dbd37e6d31bd19b04e9d9c08f3b
MD5 1b9a93529a6d91bd7b2ec1fd4a5fb787
SHA1 ba12fcf04011048fc24686d0cd471b49f9208013
SHA512 c8ec30e4fbe84370dadad8b7db2f2b0a97f7d856d91ded8c741d19feec4fb035d7076f3dc823161c6dba946b18ecec3145b49dbe23ac080dd4fd6e976e0a5d0c
SSDEEP 49152:oy6gENdxgA/43N3Ho+KrCTV3+k6OjYliPklf9GFwMJfLklBEKPuc5zVGI:oySNS3HRIE4OMli8R0wnlPF1
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

4571

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyA RegSetValueA GetUserNameA RegCloseKey RegOpenKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegQueryValueExA RegDeleteKeyA

kernel32

IsProcessorFeaturePresent GetModuleHandleA GetProcAddress MultiByteToWideChar CreateThread FreeConsole CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess FormatMessageA WideCharToMultiByte EncodePointer DecodePointer LocalFree InitializeCriticalSectionEx LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo CreateFileW RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap SetConsoleCtrlHandler OutputDebugStringW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation HeapSize WriteConsoleW

Name

.text

Size

925KB

Virtual Size

925KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

347KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

265B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Fsz

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

r,�y

Size

249KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_MEM_READ

Name

�H ��

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_MEM_READ

Name

\R�(�ut

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_MEM_READ

Name

-�y

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_MEM_READ

Name

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_MEM_READ