file[.]exe | Triage™

General

Target
file.exe
Size 230KB
Sample221228-rlpmsaae83
SHA256 f504094e6c21d8a8524e499e3055ec9bc8afa61aa092d7b7e81296ed336babd7
MD5 808d9cb2d0e9e2a0c3cc5d93042d0c9d
SHA1 a59b47027826dcd4652fd428efa25e9052600b14
SHA512 0b1c296213d70e1ef3877e904213b562cea6c441750246b6432c946dd820d3456ed1787c064e890281dbecec6fa97901f27532eef378a54ef58c9089f460598f
SSDEEP 3072:mWxSLowlF587Pvr2CVaq+jRCVNe9rJeSxbNgFDJQgdxcR8rwD3tdmdhEH:nSLFsvr25seJsdJlxcRWi3tm
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 230KB

file.exe

IMPHASH afeea56f0d60974ff405eae98c848b6b
SHA256 f504094e6c21d8a8524e499e3055ec9bc8afa61aa092d7b7e81296ed336babd7
MD5 808d9cb2d0e9e2a0c3cc5d93042d0c9d
SHA1 a59b47027826dcd4652fd428efa25e9052600b14
SHA512 0b1c296213d70e1ef3877e904213b562cea6c441750246b6432c946dd820d3456ed1787c064e890281dbecec6fa97901f27532eef378a54ef58c9089f460598f
SSDEEP 3072:mWxSLowlF587Pvr2CVaq+jRCVNe9rJeSxbNgFDJQgdxcR8rwD3tdmdhEH:nSLFsvr25seJsdJlxcRWi3tm
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

15449

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetConsoleAliasW GetModuleHandleA CreateDirectoryExA GetLogicalDriveStringsW ReadConsoleInputW GetTempPathW GetSystemDirectoryW CreateMailslotW OutputDebugStringW GetProcAddress LocalAlloc MoveFileWithProgressA GetBinaryTypeA SearchPathA GetCommandLineW InterlockedIncrement VerifyVersionInfoW ConvertDefaultLocale FindNextFileW FindFirstVolumeW LocalFree GlobalFlags ExitThread CreateActCtxA GlobalFindAtomW CopyFileW VerSetConditionMask CreateMutexA GetCurrentActCtx GetDiskFreeSpaceW MoveFileA SetEvent MoveFileExW OpenMutexW FindResourceA SetFileTime AddVectoredExceptionHandler lstrcatA SetEndOfFile FindFirstFileA FreeEnvironmentStringsA EnumResourceLanguagesW InterlockedCompareExchange InterlockedExchangeAdd AreFileApisANSI GetModuleHandleW SetLastError HeapAlloc GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree SetFilePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW CreateFileA CloseHandle

user32

CharUpperBuffA

Sharing