AppFile[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AppFile.exe
Size 324.8MB
Sample221220-rlqvvahh38
SHA256 4ddcf3a4a787e2ffcbd6edff204a911bd784e4f05cbf5f43a82e490fd1e2dfd3
MD5 5000b1dcba27abea28423bf3149abb65
SHA1 84d882c835e4b9b4ce30cc7b53ebc470f2a65fe0
SHA512 308de6bd649c074a1d4cbe401d77a1223892c0610370271c59173d654a0f54efe360dc608160f0b6089ca4ad8c32102f6aabb5b4da86f565887ea19c92d37477
SSDEEP 196608:QNLPtb59fs/9rulInB26E2A98Fv++JzATC4C8W:QB9fs/9ruKo61A9MhJzATzC8W
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

AppFile.exe

.exe 324.8MB

AppFile.exe

IMPHASH ae2b4986a7fde8136982562f3e126530
SHA256 4ddcf3a4a787e2ffcbd6edff204a911bd784e4f05cbf5f43a82e490fd1e2dfd3
MD5 5000b1dcba27abea28423bf3149abb65
SHA1 84d882c835e4b9b4ce30cc7b53ebc470f2a65fe0
SHA512 308de6bd649c074a1d4cbe401d77a1223892c0610370271c59173d654a0f54efe360dc608160f0b6089ca4ad8c32102f6aabb5b4da86f565887ea19c92d37477
SSDEEP 196608:QNLPtb59fs/9rulInB26E2A98Fv++JzATC4C8W:QB9fs/9ruKo61A9MhJzATzC8W
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

4954

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle VirtualAllocEx InitOnceExecuteOnce GetCommProperties SetConsoleActiveScreenBuffer DeleteFiber GetConsoleHistoryInfo LeaveCriticalSection FatalExit CreateBoundaryDescriptorA GetCurrentThreadId CreateSymbolicLinkA CloseThreadpoolWait SetVolumeLabelW FindCloseChangeNotification SetCurrentDirectoryW FindAtomA WTSGetActiveConsoleSessionId FormatMessageA DebugBreak GetDriveTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW RaiseException

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.cgtga

Size

176KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bundc

Size

876KB

Virtual Size

876KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.[0]

Size

320.0MB

Virtual Size

320.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ