file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 621KB
Sample221110-tk9bxadafn
SHA256 8d455347da9305b8f1d2f004a973ff2075ea48764543b4b3e9c30d26e9331adf
MD5 184d92bc95310a135b3c431d9e4c91d8
SHA1 13b959e4bbe02bf159521cad2a6bbeb9c9b6bb57
SHA512 b40ab772b7073e22598697e00e495c6cabbd208f673d6f3003b5cad5597f83f9c6524f4d7a737955c41157063fb4f055c6687a6cf574f2732ebf0bca2735c341
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiogQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XDZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.dll 621KB

file.exe

IMPHASH bf309f28e2e75a572eb2f2244be62b26
SHA256 8d455347da9305b8f1d2f004a973ff2075ea48764543b4b3e9c30d26e9331adf
MD5 184d92bc95310a135b3c431d9e4c91d8
SHA1 13b959e4bbe02bf159521cad2a6bbeb9c9b6bb57
SHA512 b40ab772b7073e22598697e00e495c6cabbd208f673d6f3003b5cad5597f83f9c6524f4d7a737955c41157063fb4f055c6687a6cf574f2732ebf0bca2735c341
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiogQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XDZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

11860

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA InvalidateRect GetMessageW DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW LoadStringW ShowWindow DispatchMessageW SetGestureConfig GetGestureInfo TranslateAcceleratorW TranslateMessage LoadCursorW PostQuitMessage UpdateWindow BeginPaint EndPaint CloseGestureInfoHandle ScreenToClient

gdi32

Polyline LineTo CreatePen MoveToEx DeleteObject SelectObject

ole32

CoLoadLibrary

crypt32

CryptStringToBinaryA

kernel32

GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc GetFileSizeEx WriteConsoleW SetConsoleCtrlHandler GetFileType GetStdHandle GetProcessHeap EnumSystemLocalesW SetFilePointerEx ReadFile ReadConsoleW OutputDebugStringW CreateFileW HeapSize CloseHandle GetUserDefaultLCID IsValidLocale GetStringTypeW DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCurrentThread HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

ACeujVZMknFDjv AHuDGMflBfPryOEYjuTfbzJdEM ATjQPkInxPUGuUu AmbryhtjKWGeCnsRXR AukYzjkZpQjlyb BEHGKvjtYm BRUFxz BUZBRSzPLxRhY BZCzGXtURmWdIZoaE BZqjzJIejob BmZYhYQxzCQQ BubGPfVJvMw CBkyPEXjXbRUHKXJo CEsNfdgPgd CVPqxJEtookkvK CaJBhuFKGDiSQoojdQF CcKlmw CfrkXlNpYveSkH CtcUKaNM CtmIxtaSEWrJoeKFHYsQVRF DCcTBPjgUmKACiowmtURUFfgN DRpUgpG DYDsOtWxMUufQk DacmPRKwn DdBIgVVvJpDDYojhSveGWyVC DllRegisterServer EDkUTFetsWTlyEplV EZveIcVQbxXQvHAc EetKwkljiiO EiwSmYwuw EjKZnNkyirwOPcLJfvNShOHV ElumsVBNoiVQFecpcx FVCmCSsewcOgpmVCPhNN FeniiccJDJZQOquCQEDZFbp GhuZhUSaPqDNPQyLmKmMs GidoxoYzkYTZBUKjTczrNz GmOuZYJiGNspxqOxoBCu GoueteXAa HZyUwOgdhWiacaSFvYDsgUbdhh HtmqUvH HvKfMTiGc HwiGZdXrkhPSBdQhcNF IOKBBQdlpeQCrqGhE IftUczqAOEEpksLc IujIKjACwijLXf JPOlfklrHwimOYpdWU JldHyQJYHPfgwSota KHRcAfeWiWXczrzetcsf KSBSWsMPLKrvLpLuQEVBQaA KXPHHrx KqKYPtMNYPZwVVbFgnJskTDgXZ KrLeibTbke KtNQbfYVcdlRzCxJLbItSH KtZFnRWCN KyUDQzimOqrGaUdqnpHCadI LNVXKJhSBOeqiQPpxZuBrf LbOnTCPkjmOOEdhEeyEy LlFIOHcteRaL MAmiSwkyFlQMDaCByXR MHyRvOCLFO MbZnllsXkfnyOmtthLrL MbsuSbHtpeltWArBKaXuf MltZiwCXSxF NFzpzSbcGrv NXasCwwz NfwIIEvnLCKXIrpxWtDCbXx NgkonMKeLNPfNxT NlplQAUkkIZ OQruapyPUnukiDhEvANkgElZqh ORBMTIE OdtvuFxrrpfsY OoZePWcMAAdh PbgMOKpkqAeEgOBtpecKal PhHcvOzcWKVEzqGUAuH PqcNviu PxhniQgzegWvoSCaIPorRhqOEt PzcLCLdBlIdqBxBTbNiI RFSoSJnzzPHjPzvZCOvWT RSrAlLsSbnJmicoYtpKsPYkwFn ReujwDwTrVxLhVwaWvQS RqzpZDiLuFMWsJ SUemGjmeVuPs ScnrskpiicPdg SeCKWgTgmmtDUvFC SjnxUxHKGlth StNIEkqRHMtB StepECvENJONrwlynYAOx SyluAQQc SyvpWCmyZbMrEFnfTmyrBRH TLTUEROtrtYd TdNJCbJiInjtCOpp TndRvx TpEywJZSeYXzmbHgod TrziFVlHgMVVONOLNIfRem TzKueUFolaHBJPFhx UClTVsmfYtgzIL URuQMqrUPMSAGVyWQTqN UbLvGEZfkFcvnnw VXfdoDKAoHiAA VeRxloJdVvetDztDxLQT VkIbTCoknzceJuPcnCXzzPj VqNxpzS WPumZrRRafooNh WQIBBQj WUVuwTliAyCBAOHuSOD WsADtJekvYjSfChaZ XBRWcmDQWuUdmmFxx XDLVzSefOKneeAsytcH XDecZDvu XNmJlnrJjgZEjPQQeoOIT XWdPewUOSEaHKCHnynymDhLttF XmEMSisfXGvwdcnUI XxYbsglQgKXTYWUmlX YOqqPZdimbNEuvMaM YXgNyXKelZfQK YrlEvikMuwUvtjDbAASCV YrpQLSvKN YtyiKWITImQlOTP ZMAtbEQuVEpze ZOTjVFL ZXigMFrErZGCgnGQdpTo ZcqfXQvmSIhHXuDEPmA ZmNbZwqyJPRHpqmUZOmpJexK aOxloUcrMaTBrKRkXkvrKaAy aXDBQtKlOSCf azZsnWvbQULjBuaCVG bCHMpZKuNDwxXrs bFyNFHBUflbBAfRZV bGaVPXQawxz bVRtqQ bWXHfJrBjrdcVRLbuT blakCcJabYayatiII bsEGIgCVUNZeSRsr btMHyPMu bteqpXpGuaIzWJWPXQj buvNCuoglefZoipISdUp bvumZozkETqFchaDGgv cKgbFcy chPwzpRWTYf cliUpMkAyvnx cpEBzofbApJInexgeY cpNZFVzZSKe cpmbLfWGBjxaaZNR csebqY czlJGyv dOrUqBBEUz disvxAJjTCcpofcItH djhGwwWdNkNOGnSMVhO drTNkYg elaOoLpqFiyIbnyvaU fAKHjGkpTjHcAAfMvshh fBFgQesCsDDEqolwHzSbbSIs fDZRRfyfwlYoeFo fLcYUVhVDDHHRUryudAO fWkhxqQSpEMsqhItVIr fZQaoqMpByybzlfgG fadaIHaPgvjpA fodVsUcqiRZtLe fwWFiWowsdju gQiEYElmfk gexCIfMSOkWBVEs gnKyXNiVXhIQQVNkxutn hHoSVYFgUoRXoGwPBdTY hKiUTWNKTCBHARIejKtitX hTcXrfT hdpzQLMeXdHLAXI hqmMcxlMowrqdmwCD huwZDnzyRrUuSv hwwioGqcSiONSnnoqSgGGlYG hwxiWyDPZ iIMUBUcxlPgIoCou iXVpeLZjxHYfZy ickoyirauzuqSYooWRxIBKP ixEhmcgYbORYTvwI jXSCkxhrXSnIiziUsUkSa jhMrQlkZnbNzE jnmtHhyvcXOtUsFySuhzSRFwZ jqfPKICr kFVNBreOaZSGgseVYXfZAQSt kLMzjQJrPZFPf kONtiEAEi kUNUwtZ lIEZQCqZKko lZiHnzEuXoXZIzRd larnkUFYFI lfFBdv mJFTxuzjmKwZE mJPUafqK mRinbRZ miGqUGeEk muHYTksHDRccMJtbMIVY nEWvJUznqPuIORIkmbdcWjKd nXCjDafayJLQ nfPVFCecEC ntSsSyvUegFeD nttFqgw nuflNZYxVuFptSebTKUXxH oFyUMrjmgKtGCEsn oJhfaaiLZFHiBCXJlPO oPpitKCbVriCZu oTMlKNA pOQozXdpf pqXsDgFAKqxqyeZwyCjZ qhBjRUFjPgGnZCYf qnqswBvEbONoReovLIKnVYuSA qpggbjTvfN rGJIMlvpqBhxViL rUmobKc rfqEeKHAx rsgxCEvQpI rstbQmhTSxcrhUlcaxRFhGIXK rxpoWUmUrHlSIHeznkyrivE rzgTPjoxRh sFmMISJDeOoy sGzvLqVdsbQ sRyuPhAwDlOgUlGVpIfduYySp sTHzpfVYU sUKvQIa sVMFsGCCfvDfoTh sfAGqCcFJlYOMkqZahTjTiAX stMogsRXrfH tBAtJGzOlooKPbZ tTdsornziSGMnYRGtlv taVJVqMCMlkFIDWVCcDLV twRKUF uTtYPS ujLBGDEExK ujfIFiuxQFuoWpBYlfPja unVwakRZhbHEVJWGGZDyCZP utlgNYXohozxx uvBxDGCDNqLbDaufFb vycQUvI vzdSRyxeERBiXlOkqVUB wAHuFSGPWcgVtPzRzoUTnbwo wiIXJqSWsUXvPbq wjeHVSTrDxCzMVNUFEQoz xPjfyQjUovqeohLapv xeyyJZUMQlYiCHikxXoEko xmDlQKqSmhiJfARRXzslVED xzJluXH yAYxFjbdwTSooJJzoq yBpkXiNAKugdWlxIPQKL yIApLlDSJNmmOc yMokeHArDgIyDvmsuwd yVLTygbNjHTxXaOuZBkHmpajxq yhCymcBLApUWyPqapsEDJtfjMV yjGXMXnz yprPVXLUkdnzWv yzkENTmBV zQnFkEsglvSmYtKlkFDTme zdMhYw

Name

.text

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

616B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ