file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 591KB
Sample221110-cngbvsffhm
SHA256 402c8936f89a241c4ed3cc2ee2db70c2fde4f6802e4db0e718e1e751b76bb3ae
MD5 ef071d9feb263e3db9965aa216a2c9b4
SHA1 95c9650005888e762cc00df48e7c9c38e721ab04
SHA512 d9a753d524dddb982f6ee2d5f14a0383efc515968bf92f227eabf3cb804eea97d8c6b66a30db2220ade9df9fe8893224ad1ee7b472f6b3dd803f481ed44ed73a
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmt1L:1ml8U52n1pkxoI0nwfmP
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.dll 591KB

file.exe

IMPHASH 7478292598c4b3e108c368ee3209fb38
SHA256 402c8936f89a241c4ed3cc2ee2db70c2fde4f6802e4db0e718e1e751b76bb3ae
MD5 ef071d9feb263e3db9965aa216a2c9b4
SHA1 95c9650005888e762cc00df48e7c9c38e721ab04
SHA512 d9a753d524dddb982f6ee2d5f14a0383efc515968bf92f227eabf3cb804eea97d8c6b66a30db2220ade9df9fe8893224ad1ee7b472f6b3dd803f481ed44ed73a
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmt1L:1ml8U52n1pkxoI0nwfmP
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

22928

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA InvalidateRect GetMessageW DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW LoadStringW ShowWindow DispatchMessageW SetGestureConfig GetGestureInfo TranslateAcceleratorW TranslateMessage LoadCursorW PostQuitMessage UpdateWindow BeginPaint EndPaint CloseGestureInfoHandle ScreenToClient

gdi32

Polyline LineTo CreatePen MoveToEx DeleteObject SelectObject

ole32

CoLoadLibrary

crypt32

CryptStringToBinaryA

kernel32

GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc GetFileSizeEx WriteConsoleW SetConsoleCtrlHandler GetFileType GetStdHandle GetProcessHeap EnumSystemLocalesW SetFilePointerEx ReadFile ReadConsoleW OutputDebugStringW CreateFileW HeapSize CloseHandle GetUserDefaultLCID IsValidLocale GetStringTypeW LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetCurrentThread FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

AJIiNUiq AaXmgfeBZNlwHmMGAQbmmHu AlgcgszV BBPMwSBCYGuw BCwVXBSlgmsZiGLWASOQT BdKlAFBcrCpDNiixiAR BhUqxDXXB BjEnJJYsEQXZGVek ByUzpMB CERjCtKtOBPFlgt CWmyGpmEmlwMPMgz CaYPLWtPIJJrPMZvPUkOdxAyo CuWzCXtyPctgVnnYZPlKZYiBX CwJZdWdyEqH CyNMshTjvwbNyGMOQzAzcl DIxQwZkshooKaSLdksk DMzTpeWYvHUfu DllRegisterServer ENWAHgTGB EXWSentGHLq EhsRdUEgq ElDYcBsIDMkkx FIeieYSUSLr FJJXuQFTDbJcmtywZV FVUInYUpimGvOHh FcYktMfphCltrtWiufHO FgpqiQH FtNcLBiAAdgGufloGYKWrOTvuJ FzXmVgikTkmIuvWulyQpa GMQZCMKummTCDpkAnW GOeHxKXz GUFueKWPxxYtAOpfWaeuCQA GVBSnJvHIGvyaayJNvuPJ GViuJJGfsKuvgaoPxmwFYeDPO GYZhuzJBkvv GaSbybogQEmjKCUkVDzZ GncibKYZIR HBylDcMfPGiVRxzNA HKeSaBzJXfbHgiOMncNlAOMLC HZvexLltQYbHdojznPJwnDmU HlqIdO HoZqQapVdydBu ICZtsiESXXipBvmSWZAw IYvJxoGFECU IcjnZOhXWwFPNZroT IeXbXrXcwLUT JELilaUtZOIvP JINkkIbPxWXMTxq JPPPYWO JRdJrHzCLz JTlryKVFulNrybNPiGPMv JfnvcQLZMIUqWJdOgCkJ JqgpwzfzQqMdbUzV KDfPnBUztVsTZbgIo KPVkCZnypkGMKXHHkm KSXujvSMLQ KTQkoHAjmAjkUIaMtzJVquQ KZPwFOliXYXnKQv KyZLyjzfce LHBbTqawphkzcNxpxw LHhhKpgKbFfgAIJoNcG LTmYWreWUmtR LlYDcZGCfqrjaoPfrHfLCfX MGgmxbpeJfExjQxupVv MPLiOPfGHOYXRhNoTp MSBEhXlaMpIO MWWxbCpwFOZMyStymHllAGG MWelfBPNwu MaQdRupdJvWAejfYQJbTTttzOk MvVVCSinTI NBkitqdCKhidsOCErTUjvpTC NiSHmj OAgPgySkrbIYOrq OAzbXPwLrDFCnFRvQcmsBHqk OFJOqAghOjhKFTDhCN OIGMfp OKmiARxDg OMnJkGfjXZlMBQjcZ OVIwnm PFyAZI PJOlij PMuwTHUCxfMKgiwrs PbaQwcJVqeUp PwKlNjhtJNAKsJakKWsZVIT QMXJxIAGPkCFvmSb QYbcXEaYRwYJlCsmmbP QefGbZzZrWYPXCCyzfFED RFNXKoZZMkRfcbHCawOELT RSXNXCjxmUyWWF RczIXPlghQRGcZoxQBoef SAfKPzvkcGPqTUPrV SMpJDSWdLssYMKfUIbSs SexjMlvjVHh SkIFWZwUgtEkUWqDWYOfz SsoYVPljsrB TMpVHLeWLrmQWVstWGKjKbWGG TeWoupzb TqAPnVTZdfZnmQXHiFXsUvb UBofHc ULqLeHpsfLDKXoxNlkvO UQlfPuMDyLTcyefmnHJfEU UVjKYeUCWzZKGNFNsbyRurbnUs UeimQaONsmoKTIznTQgf UtnVxLCkPEpFNzrjDMjuCNP UvcSdTtmgNvFIrqol VGktZtdMgxiybCFf VMHldWr VXBvWMPTtfudUGfuZ VkFtiNuCKBSqBqZWuMsZfR WDyXHgzd WuXswrX WwVCutKAzBTcZxnfusEdIOlMdL XoFMyLuIr XyBSNImXozLIhkYhssBVL XzMXoGipzIHNvfqIOVfNQ YEXqBafINNBCUTVQ YISAAowuFWRJyrnrKgwMXKjvU YRaMkAHVQBiDLMqVS YWhpmIld ZEIokTw ZFnpcihkttjOIWWxFOuK ZVBAjgoaFLynDdYGhwWSlanc ZWnFxDmMxmCPB ZyIgrANWWyo ZyImDKAZPAFBntMU aBdGnd aGZlhuYYfqwtXRgS aHPaaLQRDVpNCakcbKxk aPRmTrMDAJZdpLzxTWobX aPXXnEowW asUafgRQkDokfcILkZ bDSSUEmBzdmbBqqQHvseY bqRDKHBYaNjHOeiShbkLU bzGEyyetsYuVkipPtUsCW cAoCdQfQkA cBWOzaShyKim cLnMipYdpAqDQOMahSeAbZC cbwQIXMcgAiMTfiHLIpqoirN cjeiYvkipFZxwq coJElYEKyCHuZEpBTjMc dPhPupmVKQnYVRnsVWLmJAS dvutjUYWWbyJYu dzCyspjXTTCrMuUd eRoKxsFQ eWshHfxoOzwesCbaiiajoXW eayLvEuEnTMDt ejKLuTafIIRpBn fLaLMbGpgy fpwiBoVySRbGdLBEG fuCNNLvCeWLVSKB gcrwYimXoU glaMPHeOdXLMpZPubYgn hBmEixktWqeVrIzJRp hCrSDPPslDVfwgyUZXcwsu hnRnHmzwBNtwGJUifxbBn ieKuEjnIwfJYedUtiT iiYsrlXnLmXMpzNEUjUnf jIifJX jObJhkL jOkIsPVfXLGqUE jPoyAl jVXFPHvwljborG jkMNluDGMJrJuIvZqmJlyWTQqC joZWawfGesvRxQBBaFeaGtSG kHgqgel kPIxSV kRSzbLeIv kcVEtygQIiUEaOdXkBQKbhx kghTuInvesaNivxTLlxcm khPqnpvP kjqrQnWFJKpuHObepOgFmkr ktIaSEStQqaujjtiVeEcbk lBaapoMMoWEemaNHzS lChWmYxgmDFxzHVknw lLnDtiniuCTBIFF ldMuYBrLjcJkiPjqUMJFZfB llYfptpRaHBlpTOVgKPzSwPUrC lmYrQrdfNmmwbdsR mAYTXRrvnZOaxemFSQFFnyOFrn mBQlmweGv mChKDWrybIgv mGZYtSfYWBGjlcEeXyM mYXvzWcLpQOnTMhaV mvlhBVliOxaieenwT nCUPzZhKKDjOYmJO nMfJLeLDdsSMUUnSDx nYxRbTLZIlyFXagdVbaZTmKd nhGHNsrv njAUbEcYWHlmiyntFaxFbFZI nmcRbbrWKCX nqVRTHCMLaSJLMAsuq ntniPkBDxtt nuZBoYCeUPSTZwuAIPkCSKcX oAqRKEhvwL oESHCdvfvdUZyhavUMPuB odMdFuuGfavJr orwdIArRZXSy pCQWbxUNPUvLVfNxHdG pGTWXgbQ pOUAerbFqLVZorcZn ppWQiILgCtFbNMp pxFFnOXLjRm qAjgiPOwmNEOHrDdKWTzMkLx qSnhqxApxKbaamdT qrFKtvUfbUJ qxZPFotsLJloweo rBzpiusN rUPFmi rmxwovcRWVyVWc rqZJJKDdSMXMSzMdiC rwNmxlwcYUxQQ rxJbUUpvPZMarbozyUp sUdEkwXMSWcAWMPhZ sdVPVSdyybJzbOKY syuEOKR sznSTaOYFgjmctxFAPMUfBp tKZjJLFLXRqe tUaFATMHbqrK thspunyCa thukxTpvgeZotBpytKsQyHnN twkndTAbGpJkR uOrLim uWSLqQIHaOp uZMxalzmHt uZqdAhrgTvjqSZrpCiMB uqYkDRoexVRce utWFpV uvzTmaQptHZqGNnUnaLkyjKOHa vNqOmJddNqbC vUAMivBVXknpyyxW vjCWojzdbZUpEtFKp wCmkYXaTqYqldAdNuoyJd wKuyOSBXjTYfChuOoznuVCFOa wLHdoW wZTtAgGPzxNYXAHULA wvfKKYgEtoIbrKXLOsElWVMq wvtIpRQJIZtHLrcgVrMppep xBfQVzehMIfv xKMTSQXVIjOolQhsUpgNabCH xaJCVTHwP xqBtnweukgjsVENLYnBesyYf xyuWyPNoKhOILj yCCNLPv yCTdfrqbTJvMqERZjYXIhcZqxK yIEvnQhxGRpxjCfveEsV yNmFdJDFA yRTeByvvJbEkx ydBXPaV yrZCRsdvOjQSWHXFY zANFfZTRXwDaAFhL zAmqUioIGilZgAoZiqF

Name

.text

Size

260KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

452B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ