file[.]exe | Triage™

General

Target
file.exe
Size 259KB
Sample221213-3ettpsbf81
SHA256 3239a2628d29fedb483a68d687ec0d70cd86a2420f57d3c8159cef925d932d6a
MD5 980a096742a87eaddc48b516b347487d
SHA1 5635d7e0b1ff4b5f28cfb78566228a62985cf14f
SHA512 7fd488460a850ec0bfa881c7fcfa1959472b6a3eb9f0099eae787c9f7565cee865141e1170dc8aa1fa47c6e833ae4e4ecb78056912eb6b304b3e92c39e413dbd
SSDEEP 3072:GMfkLH49e3QHI4JiELn5MIprMqZtFa7XgyCAJTy59N5f3JalxNy8bGbQ/E1PujKq:RkLYI8LBdntFacFAJTyD3N8btow
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 259KB

file.exe

IMPHASH 1f1c40217078e6644c106961b763581a
SHA256 3239a2628d29fedb483a68d687ec0d70cd86a2420f57d3c8159cef925d932d6a
MD5 980a096742a87eaddc48b516b347487d
SHA1 5635d7e0b1ff4b5f28cfb78566228a62985cf14f
SHA512 7fd488460a850ec0bfa881c7fcfa1959472b6a3eb9f0099eae787c9f7565cee865141e1170dc8aa1fa47c6e833ae4e4ecb78056912eb6b304b3e92c39e413dbd
SSDEEP 3072:GMfkLH49e3QHI4JiELn5MIprMqZtFa7XgyCAJTy59N5f3JalxNy8bGbQ/E1PujKq:RkLYI8LBdntFacFAJTyD3N8btow
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6930

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile WriteConsoleOutputCharacterA LoadResource SetWaitableTimer MoveFileExW GlobalSize CreateJobObjectW GetModuleHandleExW SetHandleInformation FreeEnvironmentStringsA SetTapeParameters TzSpecificLocalTimeToSystemTime GetPriorityClass GetConsoleAliasExesLengthW LeaveCriticalSection GetFileAttributesW ReadFile GetCompressedFileSizeA lstrcatA GetEnvironmentVariableA GetVolumePathNameA WritePrivateProfileStringW CreateJobObjectA CopyFileExW IsDBCSLeadByteEx GetLongPathNameW GetConsoleDisplayMode SetFileAttributesA GetTempFileNameA GetAtomNameA LoadLibraryA LocalAlloc GetProfileStringA DeviceIoControl GlobalWire GetModuleFileNameA SetConsoleTitleW GetModuleHandleA QueryMemoryResourceNotification FreeEnvironmentStringsW VirtualProtect GetCurrentDirectoryA SetFileShortNameA InterlockedPushEntrySList SetEnvironmentVariableA CompareStringW EnumDateFormatsExW SetFilePointer SetDefaultCommConfigA LocalUnlock GetFullPathNameA GetLastError ExitProcess GetModuleHandleW Sleep GetProcAddress GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc EnterCriticalSection RtlUnwind HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread WriteFile GetStdHandle DeleteCriticalSection FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA HeapSize GetLocaleInfoW GetLocaleInfoA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle GetProcessHeap GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA RaiseException

user32

GetProcessDefaultLayout

advapi32

GetServiceKeyNameA GetSidLengthRequired EqualSid OpenEventLogW DestroyPrivateObjectSecurity PrivilegedServiceAuditAlarmW

Sharing