file[.]exe | Triage™

General

Target
file.exe
Size 303KB
Sample221107-vknwmsbcdm
SHA256 03ede89c1f4d46233ff3e0b334d2e0e1a4b8f88a75105926b1df68cfa63cea2c
MD5 64abc01d601faf34c8353e9098789af8
SHA1 b68339d322ddc53b81adaa93488434372b266272
SHA512 6131cd840dda77ee644d6328fca98e674f145595f6451dbd7a0aea16ecbc02cf70ca16c9214fbe7880e2c751f80fab873a755a552d91eecd8e723c546eba21e7
SSDEEP 6144:g+C4cLe+RKVZc5UuLk2sFnXvzHPGpZKgMW3MLJ:ZcC+RgZnXrPWMt
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 303KB

file.exe

IMPHASH 483d42c4bab2861786531c440bf02d80
SHA256 03ede89c1f4d46233ff3e0b334d2e0e1a4b8f88a75105926b1df68cfa63cea2c
MD5 64abc01d601faf34c8353e9098789af8
SHA1 b68339d322ddc53b81adaa93488434372b266272
SHA512 6131cd840dda77ee644d6328fca98e674f145595f6451dbd7a0aea16ecbc02cf70ca16c9214fbe7880e2c751f80fab873a755a552d91eecd8e723c546eba21e7
SSDEEP 6144:g+C4cLe+RKVZc5UuLk2sFnXvzHPGpZKgMW3MLJ:ZcC+RgZnXrPWMt
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25206

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeInformationA SetComputerNameW LocalSize InterlockedDecrement GetTickCount CopyFileExW GetConsoleAliasExesLengthW EnumSystemCodePagesW TlsGetValue CopyFileExA MoveFileWithProgressW VerifyVersionInfoW LocalLock WaitForDebugEvent GlobalGetAtomNameW MapViewOfFileEx GetModuleHandleW VirtualProtectEx GlobalDeleteAtom SizeofResource WriteConsoleInputW CopyFileW CancelWaitableTimer GlobalAlloc FindResourceW OpenEventW SearchPathA GetThreadPriority CallNamedPipeW GetProcAddress ReadConsoleA GetConsoleAliasesLengthW OpenFileMappingA GetSystemWindowsDirectoryA MoveFileW GetOEMCP GetMailslotInfo GetConsoleAliasW GetFileInformationByHandle GetDiskFreeSpaceExW DefineDosDeviceW GetCPInfo SetProcessAffinityMask GlobalFindAtomW WriteConsoleW ReleaseActCtx FindNextVolumeA LoadLibraryA InitializeCriticalSection GetComputerNameW CancelDeviceWakeupRequest EnterCriticalSection GetPrivateProfileStructA InterlockedExchangeAdd GetConsoleAliasExesLengthA InterlockedIncrement EnumCalendarInfoA InterlockedExchange GetNamedPipeHandleStateA SetFileApisToANSI GetModuleHandleA LoadLibraryW Sleep DeleteCriticalSection LeaveCriticalSection RaiseException RtlUnwind ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError DeleteFileA GetStartupInfoW HeapFree HeapAlloc TerminateProcess GetCurrentProcess IsDebuggerPresent TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime HeapSize VirtualAlloc HeapReAlloc GetACP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP ReadFile CloseHandle CreateFileA

advapi32

SetThreadToken

Sharing