file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 793KB
Sample230102-x1hexafg29
SHA256 f9a178c79497c66ee786f78ca40984758c41fa779f9eddbebdd69cbb5240b90a
MD5 8f20ddfac927369776d27051305cf120
SHA1 498da9ef2955db2380368e76a22d3e63008eadd1
SHA512 2341363905e92e384589adb8c46b3956e7f3b3505f05ffbe41f81d2bbcaf8cff058c656c233b0ab7ede42daedfa2657424e961ee13c898eb0ed0ec05d97158b5
SSDEEP 24576:hLAt3ieGOGoNOcfLtAz2QFPlePWBoyYIj:te/VNLFIAPx7Y
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 793KB

file.exe

IMPHASH 9deee1339fdd9dd87c8bd76cb88d8290
SHA256 f9a178c79497c66ee786f78ca40984758c41fa779f9eddbebdd69cbb5240b90a
MD5 8f20ddfac927369776d27051305cf120
SHA1 498da9ef2955db2380368e76a22d3e63008eadd1
SHA512 2341363905e92e384589adb8c46b3956e7f3b3505f05ffbe41f81d2bbcaf8cff058c656c233b0ab7ede42daedfa2657424e961ee13c898eb0ed0ec05d97158b5
SSDEEP 24576:hLAt3ieGOGoNOcfLtAz2QFPlePWBoyYIj:te/VNLFIAPx7Y
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

516404

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress GetProcessHeap FreeLibrary lstrlenA FindNextFileA lstrcmpA GlobalMemoryStatusEx VirtualAlloc VirtualFree SetLastError HeapFree SetEndOfFile WriteConsoleW HeapSize VirtualProtect IsBadReadPtr SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW CloseHandle CreateFileW ReadFile WriteFile GetLastError FindClose QueryPerformanceCounter IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RaiseException RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetFileType FindFirstFileExW FindNextFileW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapReAlloc GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation SetStdHandle lstrcmpiW

user32

GetDC

gdi32

GetCurrentObject

shell32

SHGetFolderPathA SHGetKnownFolderPath ShellExecuteA

iphlpapi

GetAdaptersInfo

gdiplus

GdipSaveImageToStream GdiplusShutdown GdiplusStartup GdipDisposeImage GdipCreateBitmapFromHBITMAP

urlmon

URLDownloadToFileA

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextA