file[.]exe | Triage™

General

Target
file.exe
Size 340KB
Sample221109-rht34ahef7
SHA256 d22dbf6ffaa26c5423b52934a9aea676e9919902e95b418538d760e746c7ee8a
MD5 b35b61426a4bdcc3db21bb9937082d98
SHA1 798cac3537852a30570ea3f1ecc1fc1e3ec27281
SHA512 3f79020f1e8b6e1ef47b9c47db98e296cb501ea113b93392896f2fc89e1b57cbe76751c7bf496b5229b459a8de4cdd779d3c0da65c02f6cba7717578d1ae6b3e
SSDEEP 6144:46LDTjTKkAJZPsyrHzWMfTSZWAR2D8kyp1zm+OVai:46DjTfyrHzWMHeTnphrmf
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 340KB

file.exe

IMPHASH 55041289a20b43277c2c76ab57d307b7
SHA256 d22dbf6ffaa26c5423b52934a9aea676e9919902e95b418538d760e746c7ee8a
MD5 b35b61426a4bdcc3db21bb9937082d98
SHA1 798cac3537852a30570ea3f1ecc1fc1e3ec27281
SHA512 3f79020f1e8b6e1ef47b9c47db98e296cb501ea113b93392896f2fc89e1b57cbe76751c7bf496b5229b459a8de4cdd779d3c0da65c02f6cba7717578d1ae6b3e
SSDEEP 6144:46LDTjTKkAJZPsyrHzWMfTSZWAR2D8kyp1zm+OVai:46DjTfyrHzWMHeTnphrmf
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

32838

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryW GetVolumeInformationA SetComputerNameA LocalFlags InterlockedDecrement GetTickCount SearchPathW GetConsoleAliasExesLengthA EnumSystemCodePagesA LocalFree FindNextFileW TlsGetValue CopyFileExW MoveFileWithProgressA SetVolumeLabelA GetProfileSectionW VerifyVersionInfoA QueryDosDeviceW DosDateTimeToFileTime VirtualProtect WaitForDebugEvent GlobalGetAtomNameA MapViewOfFile GetWindowsDirectoryW GetModuleHandleW VirtualAlloc FindNextVolumeMountPointW IsBadWritePtr DeleteAtom LoadResource WriteConsoleInputW CopyFileW CancelWaitableTimer LocalAlloc FindResourceA OpenEventA SearchPathA IsSystemResumeAutomatic CallNamedPipeA GetProcAddress GetModuleHandleA GetConsoleAliasesLengthW OpenFileMappingW GetSystemWindowsDirectoryA GetOEMCP GetMailslotInfo GetConsoleAliasA GetFileInformationByHandle GetDiskFreeSpaceExW DefineDosDeviceA GetCPInfo GetProcessAffinityMask GlobalFindAtomA WriteConsoleA InterlockedExchangeAdd VerifyVersionInfoW ZombifyActCtx FindNextVolumeW MoveFileWithProgressW LoadLibraryA LeaveCriticalSection GetComputerNameW MoveFileA SetConsoleTitleW GetPrivateProfileStructW InterlockedCompareExchange InterlockedIncrement EnumCalendarInfoW InterlockedExchange GetNamedPipeHandleStateW SetFileApisToANSI AddAtomA CreateFileA Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection RaiseException RtlUnwind GetLastError HeapReAlloc HeapAlloc HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter DeleteFileA GetStartupInfoW TerminateProcess GetCurrentProcess IsDebuggerPresent TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate VirtualFree HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetACP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW FlushFileBuffers ReadFile SetStdHandle GetConsoleOutputCP WriteConsoleW CloseHandle

user32

GetAltTabInfoW

winhttp

WinHttpWriteData

Sharing