file[.]exe | Triage™

General

Target
file.exe
Size 259KB
Sample221214-c1bbdaha95
SHA256 5b5a808fdddcda78b96a8acadf407b9fdf7d9dcbf6fd4e9b508e66d1612e688c
MD5 4530b505d8cbcc2461587e79fd53b7b5
SHA1 699c5ef6e177dbe9d3f144e19f9243ef3c791aca
SHA512 130ab788ed24375861290a881352b246a74d7ef8048e27dd0134d120811a92a1852d4a887b0a6f1ed74a999258292fe18ae987beecfa223e526ad3c4b37ed20c
SSDEEP 3072:2R3ZDQL2eirvJi2qaswuT08wWh7unglcAi/U+2T5rialxNy8bGbQ/E1PujKdpW:kCLq5B8T08wA2Ai/Uo8btow
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 259KB

file.exe

IMPHASH ec10adec496664473d17052d8437f7d1
SHA256 5b5a808fdddcda78b96a8acadf407b9fdf7d9dcbf6fd4e9b508e66d1612e688c
MD5 4530b505d8cbcc2461587e79fd53b7b5
SHA1 699c5ef6e177dbe9d3f144e19f9243ef3c791aca
SHA512 130ab788ed24375861290a881352b246a74d7ef8048e27dd0134d120811a92a1852d4a887b0a6f1ed74a999258292fe18ae987beecfa223e526ad3c4b37ed20c
SSDEEP 3072:2R3ZDQL2eirvJi2qaswuT08wWh7unglcAi/U+2T5rialxNy8bGbQ/E1PujKdpW:kCLq5B8T08wA2Ai/Uo8btow
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6924

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile WriteConsoleOutputCharacterA LoadResource SetWaitableTimer MoveFileExW GlobalSize CreateJobObjectW GetModuleHandleExW SetHandleInformation FreeEnvironmentStringsA SetTapeParameters TzSpecificLocalTimeToSystemTime GetPriorityClass GetConsoleAliasExesLengthW LeaveCriticalSection GetFileAttributesW ReadFile GetCompressedFileSizeA lstrcatA GetEnvironmentVariableA GetVolumePathNameA CreateJobObjectA CopyFileExW IsDBCSLeadByteEx GetLongPathNameW GetConsoleDisplayMode SetFileAttributesA GetTempFileNameA GetAtomNameA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetProfileStringA DeviceIoControl GlobalWire SetConsoleTitleW GetModuleHandleA QueryMemoryResourceNotification FreeEnvironmentStringsW VirtualProtect GetCurrentDirectoryA SetFileShortNameA InterlockedPushEntrySList SetEnvironmentVariableA CompareStringW EnumDateFormatsExW SetFilePointer SetDefaultCommConfigA LocalUnlock GetFullPathNameA GetLastError ExitProcess GetModuleHandleW Sleep GetProcAddress GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc EnterCriticalSection RtlUnwind HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA HeapSize GetLocaleInfoW GetLocaleInfoA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle GetProcessHeap GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA RaiseException

user32

GetProcessDefaultLayout

advapi32

GetServiceKeyNameA GetSidLengthRequired GetPrivateObjectSecurity EqualSid OpenEventLogW PrivilegedServiceAuditAlarmW

Sharing