file[.]exe | Triage™

General

Target
file.exe
Size 211KB
Sample221103-mkyrvabeer
SHA256 9ba18ae1d79fd6ef1d7304486238d7155dd9bd3a1b83fafa69edfce7e774ab19
MD5 5e514b0baa998c0215175de5103803f5
SHA1 16b1bd0c62610c07e34cdcb0514d029653d39f09
SHA512 3ca968ec6e7c3193e857a8dcedc8b4b6f002ce604de069abda566bac054fc78a2ae0ea16c3a6929fe891cb5b800d5d5889c2ef2fd165b5a95e995b003570b938
SSDEEP 3072:YceXvwqEfhoFS3LxmcE6yf5BkIIprKW+eeiv3FUz3S6wcVE7T7ORbhBix:Yc2zEZo83LfEeIIprBexTLZOKRbhBi
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 211KB

file.exe

IMPHASH 8fb85d04360d27123c3a8e1c2ffb7f7e
SHA256 9ba18ae1d79fd6ef1d7304486238d7155dd9bd3a1b83fafa69edfce7e774ab19
MD5 5e514b0baa998c0215175de5103803f5
SHA1 16b1bd0c62610c07e34cdcb0514d029653d39f09
SHA512 3ca968ec6e7c3193e857a8dcedc8b4b6f002ce604de069abda566bac054fc78a2ae0ea16c3a6929fe891cb5b800d5d5889c2ef2fd165b5a95e995b003570b938
SSDEEP 3072:YceXvwqEfhoFS3LxmcE6yf5BkIIprKW+eeiv3FUz3S6wcVE7T7ORbhBix:Yc2zEZo83LfEeIIprBexTLZOKRbhBi
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

38134

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalSize InterlockedExchange GetTickCount CopyFileExA GetConsoleAliasExesLengthW EnumSystemCodePagesA TlsGetValue MoveFileWithProgressA VerifyVersionInfoW LocalUnlock DebugBreak GlobalGetAtomNameA MapViewOfFileEx GetWindowsDirectoryA GetModuleHandleA lstrlenW GlobalDeleteAtom SizeofResource WriteConsoleInputA CopyFileW SetWaitableTimer GetVersionExA FindResourceW OpenEventA SearchPathA GetThreadPriority CallNamedPipeA GetProcAddress GlobalAlloc SetFileTime GetConsoleAliasesLengthA GetComputerNameA GetSystemWindowsDirectoryA GetMailslotInfo GetTapeParameters OpenJobObjectW GetPrivateProfileIntA ReadConsoleInputW _lread LockFile GetPrivateProfileStructW GetDiskFreeSpaceExW DefineDosDeviceW GetACP SetProcessAffinityMask GlobalFindAtomW InterlockedDecrement VerifyVersionInfoA CreateActCtxW FindNextVolumeA GetComputerNameW CancelDeviceWakeupRequest EnumCalendarInfoA InterlockedCompareExchange GetPrivateProfileStructA EnumCalendarInfoW EnterCriticalSection InterlockedIncrement GetNamedPipeHandleStateW AreFileApisANSI LoadLibraryA SetLastError WriteConsoleW GetVolumeInformationA OpenFileMappingA LoadLibraryW Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection RtlUnwind RaiseException GetLastError HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc HeapAlloc MoveFileA DeleteFileA GetStartupInfoW LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo GetModuleHandleW TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapCreate VirtualFree VirtualAlloc HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale InitializeCriticalSectionAndSpinCount SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoW FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP CloseHandle CreateFileA

gdi32

GetCharWidthA

advapi32

SetThreadToken

Sharing