file[.]exe | Triage™

General

Target
file.exe
Size 339KB
Sample221110-cgqa7affdp
SHA256 00a281e4d90eec2cbf82aadf81a2d46d32e950b96883faa87a674276218a926f
MD5 bf337b3888fa89362aab5bb2f31df79e
SHA1 bd5800bd1796a4d138adc256fc1e9b38aff522fd
SHA512 ca53187a375867a5dceebd4512df074be69544d9b106750353e04f95a0fa6c64f3dca6d6dd952757599b58a336db86c9be823cc32e8c454981a75bf98769708c
SSDEEP 6144:73SKLPTqMO0ysa9vWspb/rsSehn8C6ou0/WNek4MB:7RjTqMOdhtk18XoJj
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 339KB

file.exe

IMPHASH 555a1039e846788e46de9b61bebb85a0
SHA256 00a281e4d90eec2cbf82aadf81a2d46d32e950b96883faa87a674276218a926f
MD5 bf337b3888fa89362aab5bb2f31df79e
SHA1 bd5800bd1796a4d138adc256fc1e9b38aff522fd
SHA512 ca53187a375867a5dceebd4512df074be69544d9b106750353e04f95a0fa6c64f3dca6d6dd952757599b58a336db86c9be823cc32e8c454981a75bf98769708c
SSDEEP 6144:73SKLPTqMO0ysa9vWspb/rsSehn8C6ou0/WNek4MB:7RjTqMOdhtk18XoJj
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

32358

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryW GetVolumeInformationW SetComputerNameA EnumSystemCodePagesA LocalFree FindNextFileW TlsGetValue CopyFileExW MoveFileWithProgressA SetVolumeLabelA GetProfileSectionW VerifyVersionInfoA QueryDosDeviceW DosDateTimeToFileTime VirtualProtect DebugBreak GlobalGetAtomNameA MapViewOfFile GetWindowsDirectoryW GetModuleHandleW VirtualAlloc FindNextVolumeMountPointW IsBadReadPtr DeleteAtom LoadResource WriteConsoleInputW CopyFileW SetWaitableTimer LocalAlloc FindResourceA OpenEventA SearchPathA IsSystemResumeAutomatic CallNamedPipeA GetProcAddress GetModuleHandleA GetConsoleAliasesLengthA OpenFileMappingW GetSystemWindowsDirectoryA GetOEMCP GetMailslotInfo GetConsoleAliasA GetFileInformationByHandle GetDiskFreeSpaceExW DefineDosDeviceA GetCPInfo GetProcessAffinityMask GlobalFindAtomA MoveFileWithProgressW InterlockedExchangeAdd VerifyVersionInfoW ZombifyActCtx FindNextVolumeW LeaveCriticalSection GetComputerNameW MoveFileA SetConsoleTitleW GetPrivateProfileStructW InterlockedCompareExchange GetConsoleAliasExesLengthA InterlockedIncrement EnumCalendarInfoW InterlockedExchange GetNamedPipeHandleStateW AreFileApisANSI GetTickCount AddAtomW CreateFileA CloseHandle InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection RaiseException RtlUnwind HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError DeleteFileA GetStartupInfoW HeapFree TerminateProcess GetCurrentProcess IsDebuggerPresent TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId VirtualFree HeapReAlloc HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapSize GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetACP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW InitializeCriticalSectionAndSpinCount LoadLibraryA SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW FlushFileBuffers ReadFile SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW

user32

GetAltTabInfoW

winhttp

WinHttpWriteData

Sharing