file[.]exe | Triage™

General

Target
file.exe
Size 259KB
Sample221214-b2yydsha64
SHA256 2a99354fb193d1f903e2c4a018d17a89b10ef4d27c52e13a37bea4409cf31afa
MD5 d15eed5f6ac5d3cc95de13046ea60775
SHA1 e16fcf7a973c8824ff81695b4f0fb87cdb15af03
SHA512 df5e681fd4c7bf4adcd7ebd33bd881cf7bdc757e124138084261697c04c65a02befb3764a2835688de5c8248002712b14c9096e1403b77b3a6261eccf249cb10
SSDEEP 3072:BR3ZDQL2eirvJi2qaswuaQsiAddz6K1vgL1Ae/UfVT5malxNy8bGbQ/E1PujKdpW:TCLq5B87KdPGRAe/UY8btow
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 259KB

file.exe

IMPHASH ec10adec496664473d17052d8437f7d1
SHA256 2a99354fb193d1f903e2c4a018d17a89b10ef4d27c52e13a37bea4409cf31afa
MD5 d15eed5f6ac5d3cc95de13046ea60775
SHA1 e16fcf7a973c8824ff81695b4f0fb87cdb15af03
SHA512 df5e681fd4c7bf4adcd7ebd33bd881cf7bdc757e124138084261697c04c65a02befb3764a2835688de5c8248002712b14c9096e1403b77b3a6261eccf249cb10
SSDEEP 3072:BR3ZDQL2eirvJi2qaswuaQsiAddz6K1vgL1Ae/UfVT5malxNy8bGbQ/E1PujKdpW:TCLq5B87KdPGRAe/UY8btow
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6924

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile WriteConsoleOutputCharacterA LoadResource SetWaitableTimer MoveFileExW GlobalSize CreateJobObjectW GetModuleHandleExW SetHandleInformation FreeEnvironmentStringsA SetTapeParameters TzSpecificLocalTimeToSystemTime GetPriorityClass GetConsoleAliasExesLengthW LeaveCriticalSection GetFileAttributesW ReadFile GetCompressedFileSizeA lstrcatA GetEnvironmentVariableA GetVolumePathNameA CreateJobObjectA CopyFileExW IsDBCSLeadByteEx GetLongPathNameW GetConsoleDisplayMode SetFileAttributesA GetTempFileNameA GetAtomNameA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetProfileStringA DeviceIoControl GlobalWire SetConsoleTitleW GetModuleHandleA QueryMemoryResourceNotification FreeEnvironmentStringsW VirtualProtect GetCurrentDirectoryA SetFileShortNameA InterlockedPushEntrySList SetEnvironmentVariableA CompareStringW EnumDateFormatsExW SetFilePointer SetDefaultCommConfigA LocalUnlock GetFullPathNameA GetLastError ExitProcess GetModuleHandleW Sleep GetProcAddress GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc EnterCriticalSection RtlUnwind HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA HeapSize GetLocaleInfoW GetLocaleInfoA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle GetProcessHeap GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA RaiseException

user32

GetProcessDefaultLayout

advapi32

GetServiceKeyNameA GetSidLengthRequired GetPrivateObjectSecurity EqualSid OpenEventLogW PrivilegedServiceAuditAlarmW

Sharing