file[.]exe | Triage™

General

Target
file.exe
Size 382KB
Sample221227-fn4zpshe21
SHA256 b3b2b1d16284e32c5489e448211eb2733fe4aff4602e1ab48fa7272ee725eac2
MD5 7d70af32f56cfcf04b3e99e040ba08f8
SHA1 d47a3eeba277b86a1cecac8c67ba68e6e398439d
SHA512 1b81b769b71fc18e61bd882aabad35858945f5dbf650155e8be0137d3a126510260586e3c3af9cf9df1881e263f5dacdebdeaddd62341824b65c3fc8a067692d
SSDEEP 6144:bLtbO2EQZQ0ZbhEvGdUScOMd62jNoY/SRuEesK802BybtNi1YDZ:bRbds0DqzS6k2xt+tesK8pQtN
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 382KB

file.exe

IMPHASH 770342bbcc7220bf3afa71cf90800857
SHA256 b3b2b1d16284e32c5489e448211eb2733fe4aff4602e1ab48fa7272ee725eac2
MD5 7d70af32f56cfcf04b3e99e040ba08f8
SHA1 d47a3eeba277b86a1cecac8c67ba68e6e398439d
SHA512 1b81b769b71fc18e61bd882aabad35858945f5dbf650155e8be0137d3a126510260586e3c3af9cf9df1881e263f5dacdebdeaddd62341824b65c3fc8a067692d
SSDEEP 6144:bLtbO2EQZQ0ZbhEvGdUScOMd62jNoY/SRuEesK802BybtNi1YDZ:bRbds0DqzS6k2xt+tesK8pQtN
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

14564

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA CreateDirectoryExW GetLogicalDriveStringsW ReadConsoleInputW CallNamedPipeW GetSystemDirectoryA CreateMailslotW TlsSetValue GetProcAddress LocalAlloc MoveFileWithProgressW GetBinaryTypeA SearchPathA GetCommandLineA InterlockedIncrement VerifyVersionInfoW ConvertDefaultLocale FindFirstVolumeW LocalFree GlobalFlags ExitProcess CreateActCtxA GlobalFindAtomW GetConsoleAliasA VerSetConditionMask CreateMutexW DeactivateActCtx GetDiskFreeSpaceA MoveFileA SetEvent MoveFileExW OpenMutexA FindResourceW SetFileTime lstrcatA SetFilePointer FindFirstFileA FreeEnvironmentStringsA EnumResourceLanguagesA InterlockedCompareExchange SetConsoleMode InterlockedExchangeAdd AreFileApisANSI GetModuleHandleW GetTickCount CopyFileW LoadLibraryA GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree CloseHandle EnterCriticalSection LeaveCriticalSection HeapAlloc Sleep WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CreateFileA

user32

CharUpperBuffA

advapi32

InitiateSystemShutdownA

Sharing