file[.]exe | Triage™

General

Target
file.exe
Size 221KB
Sample221109-jmh8dsgegj
SHA256 ae7c9e849e06f8e17846aef42fcc5128095d16a2ab93dfc69b3a4e04d6b44299
MD5 b48c8a0297dd4d1e66f0d33eee81c765
SHA1 bf1d7089673464e28caace417a16313c88ded860
SHA512 e9cf0ce1b6296a6e0d7b66eb7ae68164a644d4ffb17fb361cdc1b7f38168d0ac845926832cc5fe22aaf821859a3781667ce4a666e097399c3c099ba38aa4a676
SSDEEP 3072:PTFHC3KILYGeuIRwol8b8wj1m8cj7d02EzM+Yc8k3Avbtf+OSFlYJ1Q15Omb5a:rVC3LYGe3nam/502EVYcp4kiJ1Q1A4a
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 221KB

file.exe

IMPHASH 51522ab0e98b4dca455a6f19859ffac0
SHA256 ae7c9e849e06f8e17846aef42fcc5128095d16a2ab93dfc69b3a4e04d6b44299
MD5 b48c8a0297dd4d1e66f0d33eee81c765
SHA1 bf1d7089673464e28caace417a16313c88ded860
SHA512 e9cf0ce1b6296a6e0d7b66eb7ae68164a644d4ffb17fb361cdc1b7f38168d0ac845926832cc5fe22aaf821859a3781667ce4a666e097399c3c099ba38aa4a676
SSDEEP 3072:PTFHC3KILYGeuIRwol8b8wj1m8cj7d02EzM+Yc8k3Avbtf+OSFlYJ1Q15Omb5a:rVC3LYGe3nam/502EVYcp4kiJ1Q1A4a
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25382

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryW GetVolumeInformationA SetComputerNameA LocalFlags InterlockedDecrement GetTickCount SearchPathA GetConsoleAliasExesLengthW EnumSystemCodePagesW LocalFree FindNextFileW TlsSetValue CopyFileExW MoveFileWithProgressW SetVolumeLabelW GetProfileSectionA VerifyVersionInfoA QueryDosDeviceW LocalReAlloc DosDateTimeToFileTime VirtualQuery WaitForDebugEvent GlobalGetAtomNameA MapViewOfFile GetWindowsDirectoryA GetModuleHandleW VirtualProtect FindNextVolumeMountPointW IsBadWritePtr DeleteAtom LoadResource WriteConsoleInputW CopyFileA CancelWaitableTimer LocalAlloc FindResourceA OpenEventA IsSystemResumeAutomatic CallNamedPipeA GetProcAddress GetModuleHandleA GetConsoleAliasesLengthW OpenFileMappingW GetSystemWindowsDirectoryA GetOEMCP GetMailslotInfo GetConsoleAliasA GetFileInformationByHandle GetDiskFreeSpaceExW DefineDosDeviceA GetCPInfo GetProcessAffinityMask GlobalFindAtomA WriteConsoleA ReleaseActCtx FindNextVolumeW LoadLibraryA LeaveCriticalSection GetComputerNameW MoveFileA SetConsoleTitleW GetPrivateProfileStructA InterlockedCompareExchange InterlockedIncrement EnumCalendarInfoA InterlockedExchange GetNamedPipeHandleStateA SetFileApisToANSI AddAtomA CreateFileA CloseHandle Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection RaiseException RtlUnwind GetLastError HeapReAlloc HeapAlloc HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter DeleteFileA GetStartupInfoW TerminateProcess GetCurrentProcess IsDebuggerPresent TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId HeapCreate VirtualFree VirtualAlloc HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetACP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW FlushFileBuffers ReadFile SetStdHandle GetConsoleOutputCP WriteConsoleW

user32

GetAltTabInfoW

winhttp

WinHttpWriteData

Sharing