file[.]exe | Triage™

General

Target
file.exe
Size 240KB
Sample221212-qthnrsbd72
SHA256 23d523c68fb7d4101367fa9271254b54ebea48c61ec70e7721515ca293a977f2
MD5 f274cd034e563e9b0a5ed60dc29ac2e4
SHA1 b37699435e629df81daf44e83a89194928137b2b
SHA512 3b7c9713376105bb462a0a15ca9d45cc180695505f94c00841a3204d58087e3714a405f3fbb5905440b0c9763c7a26a3c6d7b4ad44484e29af054b17e2cab381
SSDEEP 3072:wQng+LA3/orf1v4Zu5J7eoo2ekQirJfY1w8Bs/1DohdBcf0Eq5omKDRbR8pgX:7L5rf1vRLzEQRYBq1Doyftq5+DcpgX
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 240KB

file.exe

IMPHASH 7ec7f49ed6c361cf3d1f933afdd59bc5
SHA256 23d523c68fb7d4101367fa9271254b54ebea48c61ec70e7721515ca293a977f2
MD5 f274cd034e563e9b0a5ed60dc29ac2e4
SHA1 b37699435e629df81daf44e83a89194928137b2b
SHA512 3b7c9713376105bb462a0a15ca9d45cc180695505f94c00841a3204d58087e3714a405f3fbb5905440b0c9763c7a26a3c6d7b4ad44484e29af054b17e2cab381
SSDEEP 3072:wQng+LA3/orf1v4Zu5J7eoo2ekQirJfY1w8Bs/1DohdBcf0Eq5omKDRbR8pgX:7L5rf1vRLzEQRYBq1Doyftq5+DcpgX
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

16262

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryW CallNamedPipeW EnumSystemCodePagesW EnumDateFormatsA OpenMutexA GetConsoleAliasesLengthA CompareStringA AreFileApisANSI CreateFileW EnumCalendarInfoExA RequestWakeupLatency GetConsoleAliasA CreateFileA SetComputerNameA GetSystemWindowsDirectoryA GetModuleHandleA GlobalUnlock FindFirstVolumeMountPointW CreateDirectoryExW GetLogicalDriveStringsA ReadConsoleInputA FindNextVolumeMountPointW SearchPathW MoveFileW CallNamedPipeA GetCurrentDirectoryW GetDriveTypeW CreateMailslotA CommConfigDialogW GetProcAddress LocalAlloc CancelTimerQueueTimer SetHandleInformation CreateJobObjectW WriteConsoleOutputAttribute FindFirstVolumeA LocalFlags InterlockedIncrement DuplicateHandle GetTickCount BackupSeek GetSystemDirectoryA VerSetConditionMask GetComputerNameW EnumSystemLocalesW InterlockedFlushSList WritePrivateProfileSectionW WritePrivateProfileStructA GetStringTypeExW GetPrivateProfileSectionNamesW GetFileAttributesW TransactNamedPipe ActivateActCtx SearchPathA CopyFileA GetComputerNameExW GetVolumePathNameA GetShortPathNameW ReadFile ResetEvent LocalShrink LocalLock GlobalUnfix SetCommState WriteConsoleInputW DeleteAtom FindResourceW GetConsoleSelectionInfo GetOverlappedResult GetPrivateProfileStructA ConvertThreadToFiber InterlockedCompareExchange InterlockedExchangeAdd EnumCalendarInfoW GetConsoleMode EnumCalendarInfoA GetConsoleAliasExesLengthA InterlockedDecrement GetModuleHandleW ZombifyActCtx SetConsoleCtrlHandler AddAtomA GetThreadPriority FreeEnvironmentStringsW InterlockedExchange GetConsoleTitleW SetVolumeMountPointA ClearCommError lstrlenA CreateDirectoryExA GlobalFindAtomA TerminateJobObject lstrcpynA HeapAlloc GetLastError DeleteFileA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException InitializeCriticalSectionAndSpinCount RtlUnwind LoadLibraryA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

Sharing