file[.]exe | Triage™

General

Target
file.exe
Size 409KB
Sample221214-bdsfpsha46
SHA256 bf9af0d6ba9b3352be2095f141d0dd85c79bfc9ac6fbeb5929f29cc40ea3f9f0
MD5 97af7d2059a5ab192856719d31cbabc8
SHA1 56bc3a22acf147373a52ff46b944b623611637d8
SHA512 39d63f644723b972bf25fef3568f84a226173a31492778c58b06f496b94701d3a583016e92284415a7e6fe862826e52d00a4d6e15a2ec83911796af97175770a
SSDEEP 6144:ypLxX/AY5sOEY4JKdPDKHVCILBw+ZHBTNE6URu5lpU870/VG87aAo8btow:sh/AY5sdWGHVCIL9ZhjURGCVL7aLqJ
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 409KB

file.exe

IMPHASH ec10adec496664473d17052d8437f7d1
SHA256 bf9af0d6ba9b3352be2095f141d0dd85c79bfc9ac6fbeb5929f29cc40ea3f9f0
MD5 97af7d2059a5ab192856719d31cbabc8
SHA1 56bc3a22acf147373a52ff46b944b623611637d8
SHA512 39d63f644723b972bf25fef3568f84a226173a31492778c58b06f496b94701d3a583016e92284415a7e6fe862826e52d00a4d6e15a2ec83911796af97175770a
SSDEEP 6144:ypLxX/AY5sOEY4JKdPDKHVCILBw+ZHBTNE6URu5lpU870/VG87aAo8btow:sh/AY5sdWGHVCIL9ZhjURGCVL7aLqJ
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6924

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile WriteConsoleOutputCharacterA LoadResource SetWaitableTimer MoveFileExW GlobalSize CreateJobObjectW GetModuleHandleExW SetHandleInformation FreeEnvironmentStringsA SetTapeParameters TzSpecificLocalTimeToSystemTime GetPriorityClass GetConsoleAliasExesLengthW LeaveCriticalSection GetFileAttributesW ReadFile GetCompressedFileSizeA lstrcatA GetEnvironmentVariableA GetVolumePathNameA CreateJobObjectA CopyFileExW IsDBCSLeadByteEx GetLongPathNameW GetConsoleDisplayMode SetFileAttributesA GetTempFileNameA GetAtomNameA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetProfileStringA DeviceIoControl GlobalWire SetConsoleTitleW GetModuleHandleA QueryMemoryResourceNotification FreeEnvironmentStringsW VirtualProtect GetCurrentDirectoryA SetFileShortNameA InterlockedPushEntrySList SetEnvironmentVariableA CompareStringW EnumDateFormatsExW SetFilePointer SetDefaultCommConfigA LocalUnlock GetFullPathNameA GetLastError ExitProcess GetModuleHandleW Sleep GetProcAddress GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc EnterCriticalSection RtlUnwind HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA HeapSize GetLocaleInfoW GetLocaleInfoA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle GetProcessHeap GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA RaiseException

user32

GetProcessDefaultLayout

advapi32

GetServiceKeyNameA GetSidLengthRequired GetPrivateObjectSecurity EqualSid OpenEventLogW PrivilegedServiceAuditAlarmW

Sharing