file[.]exe | Triage™

General

Target
file.exe
Size 260KB
Sample221214-cf6a1sha76
SHA256 beb0183f34a686d02a58287c271770edc68b22e0bef3ba8b8fa180635cc08a85
MD5 58ce9897be8d577f8400fb1056fd6551
SHA1 ba417a9fb0b7878aea8848f090ffe6ecfbbfa4df
SHA512 e235358311d355755b87c2b34c21c3e805d7936069b422a9963c588dd75b2ac507e4d6e7837e32f695229eec3808035e2a3f69860c5a92fa321a40f51eb7a400
SSDEEP 3072:4Ey4hOL5QSbvJi2qqcYumqIQXwc+W5bgXvi+g+YfECrT5oalxNy8bGbQ/E1PujKq:ChLxpRxxDIbIEVfEJ8btow
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 260KB

file.exe

IMPHASH ec10adec496664473d17052d8437f7d1
SHA256 beb0183f34a686d02a58287c271770edc68b22e0bef3ba8b8fa180635cc08a85
MD5 58ce9897be8d577f8400fb1056fd6551
SHA1 ba417a9fb0b7878aea8848f090ffe6ecfbbfa4df
SHA512 e235358311d355755b87c2b34c21c3e805d7936069b422a9963c588dd75b2ac507e4d6e7837e32f695229eec3808035e2a3f69860c5a92fa321a40f51eb7a400
SSDEEP 3072:4Ey4hOL5QSbvJi2qqcYumqIQXwc+W5bgXvi+g+YfECrT5oalxNy8bGbQ/E1PujKq:ChLxpRxxDIbIEVfEJ8btow
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6924

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile WriteConsoleOutputCharacterA LoadResource SetWaitableTimer MoveFileExW GlobalSize CreateJobObjectW GetModuleHandleExW SetHandleInformation FreeEnvironmentStringsA SetTapeParameters TzSpecificLocalTimeToSystemTime GetPriorityClass GetConsoleAliasExesLengthW LeaveCriticalSection GetFileAttributesW ReadFile GetCompressedFileSizeA lstrcatA GetEnvironmentVariableA GetVolumePathNameA CreateJobObjectA CopyFileExW IsDBCSLeadByteEx GetLongPathNameW GetConsoleDisplayMode SetFileAttributesA GetTempFileNameA GetAtomNameA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetProfileStringA DeviceIoControl GlobalWire SetConsoleTitleW GetModuleHandleA QueryMemoryResourceNotification FreeEnvironmentStringsW VirtualProtect GetCurrentDirectoryA SetFileShortNameA InterlockedPushEntrySList SetEnvironmentVariableA CompareStringW EnumDateFormatsExW SetFilePointer SetDefaultCommConfigA LocalUnlock GetFullPathNameA GetLastError ExitProcess GetModuleHandleW Sleep GetProcAddress GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc EnterCriticalSection RtlUnwind HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA HeapSize GetLocaleInfoW GetLocaleInfoA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle GetProcessHeap GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA RaiseException

user32

GetProcessDefaultLayout

advapi32

GetServiceKeyNameA GetSidLengthRequired GetPrivateObjectSecurity EqualSid OpenEventLogW PrivilegedServiceAuditAlarmW

Sharing