file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 585KB
Sample221111-ctl5asgce9
SHA256 05bcaf0a6deee95e6a1ae7d78c373f8065b24be7e614deae9db466d37661387f
MD5 3fde2ed3a80ecde8772f936c357ddf72
SHA1 1b1b103f80cc260da08eca0186d751a7e4f26ad5
SHA512 188f1a35625855da5016efd5c5b862761264f8ef41c3e2ded457dc695bc51c0c0df8593422e2db4c26f9b74f4d817ee3c9eaab1aa56e7c2171218b716007d964
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxB:ZAT1BWEtBVUNiM3
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.dll 585KB

file.exe

IMPHASH bf309f28e2e75a572eb2f2244be62b26
SHA256 05bcaf0a6deee95e6a1ae7d78c373f8065b24be7e614deae9db466d37661387f
MD5 3fde2ed3a80ecde8772f936c357ddf72
SHA1 1b1b103f80cc260da08eca0186d751a7e4f26ad5
SHA512 188f1a35625855da5016efd5c5b862761264f8ef41c3e2ded457dc695bc51c0c0df8593422e2db4c26f9b74f4d817ee3c9eaab1aa56e7c2171218b716007d964
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxB:ZAT1BWEtBVUNiM3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

15144

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA InvalidateRect GetMessageW DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW LoadStringW ShowWindow DispatchMessageW SetGestureConfig GetGestureInfo TranslateAcceleratorW TranslateMessage LoadCursorW PostQuitMessage UpdateWindow BeginPaint EndPaint CloseGestureInfoHandle ScreenToClient

gdi32

Polyline LineTo CreatePen MoveToEx DeleteObject SelectObject

ole32

CoLoadLibrary

crypt32

CryptStringToBinaryA

kernel32

GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc GetFileSizeEx WriteConsoleW SetConsoleCtrlHandler GetFileType GetStdHandle GetProcessHeap EnumSystemLocalesW SetFilePointerEx ReadFile ReadConsoleW OutputDebugStringW CreateFileW HeapSize CloseHandle GetUserDefaultLCID IsValidLocale GetStringTypeW DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCurrentThread HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

ACKZMHIObnaQHKwlzPq AOVudbyKxJVZeQMXsOLO AYyJBXGifeSEtCQk AhOoclQccPuG BkVECfpqiLatpcAjjeEXOZfyXY Bnyskkwd BwmAydmTqsNeDELdYUdLwTih CYNaQxtMawBMSIzdZWbTGpErba ConsmUhFFyb CzQwMEDCqCtUXGrJoKOLql DJCyeSXwKMnRyfbsSLCKxPpa DWugusOEsHPtXKgDd DfOfLuSCMIvgQaJYk DfkbPshiZaYhOSaqjIqPzONzY DllRegisterServer DnmCJIXEMkYokzeRRfG EKbIjoXzthxYq EWsrDBYLifLIKCx EYRKsLUkgMAWuxrfaIJmSgUBLc EfTrrBRRqguoDIjHNVAsJ EfiQnj FHJZnjTrtY FNDTVN FPWBMLNUrKgqAM FSOTatWmqbOxAfLsjwDimOJuI FVrtzByTqOLDyxlp FWyuZZnJq FbRCkW FtrghRYdy FunHXBytaEElTSmUSQaxzW FyjmimNSHaN GFvfuuOTsiXRZem GQuEvZTMELOxgCfrdhLu GTAOBqoXXNUuwQk GXBXUVZCqiUSlXidXO GpVGqWWnqIQjvlapeLvmZfi HKiZorFwnyyKVvRyl HQChNQSgCDQFBj HSHotINBWmzydlPTEIfsXGwf HVltrVWSPTyRN HbmDTfXglURaCPuXXtLWU HmUBBZu HnPoMgPYcGNsOhwCJGXNIe IDcRKhVmGJDZIQUlXXSXviO IFKCtEkfbx IHwQGYmyDi IJrjGqhERio IJtycxPsTSa IZsbRuJSZRMQltptMtlTIjq IemmPHlIUKfWUEFjL IoBQwhYmCRZqMXpUaubCn JJUbACbSOWX JJsDDeNgoEWNWyBpXLgKa JTTXkkGF JlCiEpVZnS JnmiFnk JprrRmuaDn KEekdWh KHEZQjbrCpYNETUhvaqOH KRPfoFibPSzSrtMziDiZJMjpEk KZqNGoq LQjcpeEdSdviWRBnc LXjroPDxbnZvuHAaofawR LcvIvMcywgnRCiIHovfshoSI LeBqVZwmAMKFKJEYOao LhjWUlVqYLdqrpdT LpnuGzVsvTJPoNZtEU MKiBXwXJxM MMbpxrmFfmd MNJtcYtYTpkhtNJwmsGayBExl MbSqjor MlUEOKTwxQO MmNhNY MtZNktTtZeSsetQdMIobnqgJN NDzloBRTiOCzFqnDESlYiGJz NHdMlFCbsRIZHAlXLut NylPFThbliBOEyrujKtyjpW OGGltngRdRjeETLJuyE OMhWNPrtGvXrDc OXTIbdKaaFNFhpZoL OmcpNNkGQNlfySxzyKHLT PBXSLAddeyA PDTTTYnwZWtmvgsDhQsjZU PRnncKInMtiadcjSSOQMFBQ PTqVRIJDpUraWiQ PrQvtewtRmO QGzPJQYQmszmRrRK QSZlVaTGjIxGWOeZfGN RDswoygaJbJWfRato RStXZYXYudckPDHz RgqjGZSoUeEcIqnMvAU SFcQiGXaye SJVNBxANqxZOkCrdHcqd SKGYjRmKvjRyc SOrXsIFXOx SpMHiyCka SwRuhANDGtYeZvIvL TEXYMBzoUnbpqCNMtncyH TNIcGjIUdTpSRDDkLMLiSmMzjL TPWLClLTaJmbJ TvNJOHLJssnMTyGMYYfTRZkQfY TviEPpUFMOuUAzSe UNNICJvBjyUFXwAOWRR UPNJpwqsqZmrRvPv VSCiqDUzUFFEzRcrCcWUIyxW VZZOFVhvSPFWJPbDSgML VrvAiARvhpsioDTvCsDpBWulVj VwTwbiJHhVyxhwrqGO WQOHTkDrFPqAa WRbhXlsUMohyHwwIcen WbAqAdgWVyvU WbVnejTmAenfcQVIpnq WfvnosCpZU WniHGai WoHUOvKkHgGCLHAfQWqMp WrenSYFI WxbfuHhPfdKZdIwvT XCQdNrvyrBIWZmxBXQ XGweHugOKIsErBIXlQtoAf XPdTfv XeJMUhn XgIYUiiYvZqAYkCpBzIRepfusc XxxGZdkAjnOvfCGXaUp YBwmARMK YFIukFX YIEzPijPuSEUDublpbKSuo YMDJlOFuodaYAQLeGQkc YWtaIGvg YfUzklBKELBicHcyYN YjskFIhoFvtxplXgXtnfIf YnhRnVOJVBWcCRg ZHJCTtneVBcLxFiFnGg aIjZFMDS aMTTokAjPrlPNl aQixWbkkl aauGXTnoHerQPEAdpmbxW aqXPJQsGuQNY bKpSPr bkIIqsWVbyUjvq bpwKexxmwQXToabxrI buYYvJRiQBDrx bwKTgNcwzNCMMazxQnksgPoMYH cIWTVLVTkeeCrLMzOeeRZrGJSv cIggJm ceCdpaLIInGREyzrMnutvv ceMUenqSerxOIsyip cyFldXcQbpghTEMTx dOcHvEogkqlHGvXiyXDlb dcBcGkFtILZfVKGjwlp dieMqBUxL dseZAioHVrcmpyJiL eQeKgkbvLQvnFKFOHCrntYX eSncnJDMjHJgWfLETuvOrPwuX eVWxywjPCGLxjCmBqwiSHDmQ eZJKYQozWFVwxNEiBgKs eZpNtEcqYmYlHr einEDhZnOdZQrqsLeDT ekpgkrLywwy eksViUURftndlwRdwIOqJPqDbM frcgaAFkyvENrvcg fyBPxsvBwdDxNn gcoxAPyjuxZE giCfzkFJgbNQVgrGIg hkTCpTyWVfVskuIaLTwIdI hkhQezBRO hlJDgJZgKgSWhsjKu hwtxKkvclLfqYPlzuN hwxxBxRyxQvU hytdxlppfBzgJ iGYEbafnUGwaqzLwiEkDcEoFXc iGYlltWJoEZkQUuBZjn iPQPztCACXTCftDZTvNvjn idIPfAiQBpOOJt iqDXnYKHYuvKDk isQnIHOKAYStRuHNa jRGQIAgrasRFSKFjASMTRGjUAQ jbtWQsliCJlKJi jxFwRFjTxqZBeWyYyGUjJht kJiLoUyRaJSlGAQwQY kXCRbDFCWsWkgDZ knVlSRpuMXigHbteRSdN lFuQHVlMqkcpyquJwPy lShqxKkjpAzGfSkJhI lUawyisBWFPUEeYWPOsrwiE laANAlWCv lkGHxNVNbj lsAeLBJdMVmYYItQoJSvCRYH lygWnYwnRJeU mIfOwaNjapchucclSR mYMzZFRyhlLMj mqDuazu nGtnIzcC nWOEkAFtcfB nucLASLksxzsTOm nvMQpNuTqWTeGVaTRoGxbvqP oRLRCOOs obtutjxbDeJGmWXwrNJO ogHMlfmoMSWiLsw ogYQVDGHrtTXPfRS ojDemZqmxKRkSOPmqat pKXkqiQt pZosDkvKboDlpSeaEkq qWEuWVdjXRrRKsKgJReOLq qWXEkPM qkRSaAJ rEPTSIjZh rSJyHvLUOTZicMruxCvEGoHc raNMBQY risZAsSaIagieXrdZnOhDzYIOB ruuEEEOFWCU sHmlVkEuiFuMGKlJpwXdZx sVJjsSsGPX sfUPtIbRemdA sqcseOa tILyVSAhgCdrEHfPBfVtFyoi tPjnuDplapdPIcrqZRmFXK tXfRwwpgGyZPDKAjlNIXEtOWG tkSvHbCTSiszhkEsUzPu tnLzaHFO tpEZEjlvmSwPCfGBwV tuYBrkIdkvGeYBclqo uYRaNlNJkGdzz ulHKyMUqbCPZAAnMrkdggm urRIlPSgdtAFARiFapAop urbspxQGSLCjnzsgbM utGMzHLpjYPEvUwmqbMaXd vRJFekacz vZXxIAQsf vhilLLLSQAgorQlDYcrg vjySCWm vxGqOYVxeIQzHyntqWqhQk vyEVtiIRlJmXCZssjhwmvCSgCi wQVxSUwsFAtnvfvsRKP xDofRk xFSCNuFr xNdkmblWjdxgkFdiybZ xaKbvIFmKuHEoQWRK xlqihUCH xuhPWlfWSOvzDpLXCOqs yBaBzgnZJat yNjzoWhmYhDVouThktWX yVPAgpehBiCzOhTsXpBCKvKh yZEOJgzErmiOalDcqbqqDtPb ycObxXXeiPKAAyH yeWcDVvwyxEtlDMveHTXhTdOct ynHEUiKCFMINWfolddVsmMgYDs zCGWJxJejbcdgDMKVsDv zNEbsppOqODrSjTVrDiLrOtygu zNJRmDXDLDbdIKXouATLf zloZBAmto zvTLkjiEXqTKQtLGxHslDrtLr