file[.]exe | Triage™

General

Target
file.exe
Size 259KB
Sample221214-dhwp2aca2s
SHA256 a0b2eb754e754a40e1cafcb1e63d9ebcc354a34cde949e781f8fa551888f669a
MD5 38b1c7d6b116082ac583a44a5781fdfc
SHA1 98878be07dc629a453dcec9e81c5712be5054176
SHA512 37daccf7f871427a17f778e5dba3205c6d20b37201ecebdd97f6a757e0a4f790e00be28577e5e480dab59a7dd3805c53e4899181c04a2f9a3c3c6dff9ea8b3e8
SSDEEP 3072:qR3ZDQL2eirvJi2qaswue1vx9WyHwQ3nggkAu/UGsT5bIzDalxNy8bGbQ/E1Puj9:gCLq5B8e1vyyHATAu/UZA78btow
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 259KB

file.exe

IMPHASH ec10adec496664473d17052d8437f7d1
SHA256 a0b2eb754e754a40e1cafcb1e63d9ebcc354a34cde949e781f8fa551888f669a
MD5 38b1c7d6b116082ac583a44a5781fdfc
SHA1 98878be07dc629a453dcec9e81c5712be5054176
SHA512 37daccf7f871427a17f778e5dba3205c6d20b37201ecebdd97f6a757e0a4f790e00be28577e5e480dab59a7dd3805c53e4899181c04a2f9a3c3c6dff9ea8b3e8
SSDEEP 3072:qR3ZDQL2eirvJi2qaswue1vx9WyHwQ3nggkAu/UGsT5bIzDalxNy8bGbQ/E1Puj9:gCLq5B8e1vyyHATAu/UZA78btow
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6924

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile WriteConsoleOutputCharacterA LoadResource SetWaitableTimer MoveFileExW GlobalSize CreateJobObjectW GetModuleHandleExW SetHandleInformation FreeEnvironmentStringsA SetTapeParameters TzSpecificLocalTimeToSystemTime GetPriorityClass GetConsoleAliasExesLengthW LeaveCriticalSection GetFileAttributesW ReadFile GetCompressedFileSizeA lstrcatA GetEnvironmentVariableA GetVolumePathNameA CreateJobObjectA CopyFileExW IsDBCSLeadByteEx GetLongPathNameW GetConsoleDisplayMode SetFileAttributesA GetTempFileNameA GetAtomNameA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetProfileStringA DeviceIoControl GlobalWire SetConsoleTitleW GetModuleHandleA QueryMemoryResourceNotification FreeEnvironmentStringsW VirtualProtect GetCurrentDirectoryA SetFileShortNameA InterlockedPushEntrySList SetEnvironmentVariableA CompareStringW EnumDateFormatsExW SetFilePointer SetDefaultCommConfigA LocalUnlock GetFullPathNameA GetLastError ExitProcess GetModuleHandleW Sleep GetProcAddress GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc EnterCriticalSection RtlUnwind HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection FatalAppExitA SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle CreateFileA HeapSize GetLocaleInfoW GetLocaleInfoA WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle GetProcessHeap GetTimeZoneInformation WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA RaiseException

user32

GetProcessDefaultLayout

advapi32

GetServiceKeyNameA GetSidLengthRequired GetPrivateObjectSecurity EqualSid OpenEventLogW PrivilegedServiceAuditAlarmW

Sharing