file[.]exe | Triage™

General

Target
file.exe
Size 222KB
Sample221108-xyr7bsdca2
SHA256 b59a69d292d78b9f198eb520135e4ebe78a6aea0a89af7702d524a09dc32a107
MD5 ed0724b7c2a64dcfbd489a83afeacd01
SHA1 a05dae5bc6029752c9c42a40411d768c5a88c14a
SHA512 d7be7f7938f3307afa133087753e4e3ee94bc7ea276cc0d53ea0e190bd760473f1edd553c869c1e7a62ad74eb5cf06314530289314676eca02031b758cc706c5
SSDEEP 3072:bowhxoLLto6MopR4KwLzYqnVqrKZTCNXEshRR8vw+A19uj19kkBmb4+zn:PeLto6MYwfYqnVlZON0Kiw/19uy4
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 222KB

file.exe

IMPHASH 9319d135f7d6ec290291daf0b6cad258
SHA256 b59a69d292d78b9f198eb520135e4ebe78a6aea0a89af7702d524a09dc32a107
MD5 ed0724b7c2a64dcfbd489a83afeacd01
SHA1 a05dae5bc6029752c9c42a40411d768c5a88c14a
SHA512 d7be7f7938f3307afa133087753e4e3ee94bc7ea276cc0d53ea0e190bd760473f1edd553c869c1e7a62ad74eb5cf06314530289314676eca02031b758cc706c5
SSDEEP 3072:bowhxoLLto6MopR4KwLzYqnVqrKZTCNXEshRR8vw+A19uj19kkBmb4+zn:PeLto6MYwfYqnVlZON0Kiw/19uy4
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25766

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetComputerNameW LocalFlags InterlockedDecrement GetTickCount SearchPathA GetConsoleAliasExesLengthW EnumSystemCodePagesW LocalFree FindNextFileW TlsSetValue CopyFileExW MoveFileWithProgressW SetVolumeLabelW GetProfileSectionA VerifyVersionInfoA QueryDosDeviceW LocalReAlloc DosDateTimeToFileTime VirtualQuery WaitForDebugEvent GlobalGetAtomNameW MapViewOfFile GetWindowsDirectoryA GetModuleHandleW VirtualProtect FindNextVolumeMountPointW IsBadWritePtr GlobalDeleteAtom LoadResource WriteConsoleInputW CopyFileA CancelWaitableTimer LocalAlloc FindResourceW GetVolumeInformationA GetThreadPriority CallNamedPipeA GetProcAddress GetModuleHandleA GetConsoleAliasesLengthW OpenFileMappingW GetSystemWindowsDirectoryA GetOEMCP GetMailslotInfo GetConsoleAliasA GetFileInformationByHandle GetDiskFreeSpaceExA DefineDosDeviceW GetCPInfo GetProcessAffinityMask GlobalFindAtomA WriteConsoleA ReleaseActCtx FindNextVolumeA LoadLibraryA LeaveCriticalSection GetComputerNameW MoveFileW InitializeCriticalSection GetPrivateProfileStructA InterlockedExchangeAdd InterlockedIncrement EnumCalendarInfoA InterlockedExchange GetNamedPipeHandleStateA SetFileApisToANSI SetFileTime OpenEventA LoadLibraryW CreateFileA Sleep DeleteCriticalSection EnterCriticalSection RaiseException RtlUnwind GetLastError HeapReAlloc HeapAlloc HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter DeleteFileA GetStartupInfoW TerminateProcess GetCurrentProcess IsDebuggerPresent TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId HeapCreate VirtualFree VirtualAlloc HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetACP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW FlushFileBuffers SetStdHandle GetConsoleOutputCP WriteConsoleW ReadFile CloseHandle

user32

GetAltTabInfoW

advapi32

SetThreadToken

winhttp

WinHttpWriteData

Sharing