file[.]exe | Triage™

General

Target
file.exe
Size 164KB
Sample221108-e8s79sachj
SHA256 b0a031ba919a6a1a969f758d4aef4016ffca7ca92bfaba0ff59193f79c084d09
MD5 618ecd63cdffd521e7a4226aa2c7d9cc
SHA1 15aac5c90ca35628c9f78e599fc280c79a2a4037
SHA512 49d9a8e56098088d9a64bddedf2803fd1dccfa43c503aa9ad8b8652233df49443a1eb97c45fff8ee7fdd7a16f6a35234a808d53fd3dc386ed33930295c599e65
SSDEEP 3072:CePn0LmkWPQ4oLRtx5Srg50ZgyPp/Iklfr:R0LmkWPQ4IjyNX
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 164KB

file.exe

IMPHASH ea4b36c5b8cf42a5f2ff3359269474cd
SHA256 b0a031ba919a6a1a969f758d4aef4016ffca7ca92bfaba0ff59193f79c084d09
MD5 618ecd63cdffd521e7a4226aa2c7d9cc
SHA1 15aac5c90ca35628c9f78e599fc280c79a2a4037
SHA512 49d9a8e56098088d9a64bddedf2803fd1dccfa43c503aa9ad8b8652233df49443a1eb97c45fff8ee7fdd7a16f6a35234a808d53fd3dc386ed33930295c599e65
SSDEEP 3072:CePn0LmkWPQ4oLRtx5Srg50ZgyPp/Iklfr:R0LmkWPQ4IjyNX
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25254

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeInformationA SetComputerNameW LocalSize InterlockedDecrement GetTickCount SearchPathW GetConsoleAliasExesLengthW EnumSystemCodePagesW TlsGetValue CopyFileExA MoveFileWithProgressW VerifyVersionInfoW LocalReAlloc WaitForDebugEvent GlobalGetAtomNameW MapViewOfFile GetModuleHandleW VirtualProtect GlobalDeleteAtom SizeofResource WriteConsoleInputW CopyFileW CancelWaitableTimer LocalAlloc FindResourceW OpenEventA SearchPathA GetThreadPriority CallNamedPipeW GetProcAddress ReadConsoleA GlobalAlloc GetConsoleAliasesLengthW OpenFileMappingA GetSystemWindowsDirectoryA MoveFileW GetOEMCP GetMailslotInfo GetConsoleAliasW GetFileInformationByHandle GetDiskFreeSpaceExA DefineDosDeviceW GetCPInfo SetProcessAffinityMask GlobalFindAtomW WriteConsoleW ReleaseActCtx FindNextVolumeA LoadLibraryA GetComputerNameW CancelDeviceWakeupRequest EnumCalendarInfoA InterlockedIncrement GetPrivateProfileStructA InterlockedExchangeAdd EnumCalendarInfoW GetConsoleAliasExesLengthA InitializeCriticalSection InterlockedExchange GetNamedPipeHandleStateA SetFileApisToANSI GetModuleHandleA LoadLibraryW Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RaiseException RtlUnwind GetLastError HeapReAlloc HeapAlloc HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter DeleteFileA GetStartupInfoW TerminateProcess GetCurrentProcess IsDebuggerPresent TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate VirtualFree VirtualAlloc HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetACP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP ReadFile CloseHandle CreateFileA

advapi32

SetThreadToken

Sharing