file[.]exe | Triage™

General

Target
file.exe
Size 498KB
Sample230105-bc8fjaac87
SHA256 cfbd8cbdc90f4c0afec635a6266dd4e53285acf7ef76d961cb47fc2564c27e0f
MD5 506fd7a42b81dd3c55346471307d3332
SHA1 efd73eff0986ba82449cf1e73174eb149f3f0fdf
SHA512 e3be1689fa14eea13c4510a7e76c14db452297b7ee0449e965e32ea19868ae57e112666532bfc4eb8ac29d8b421d9f59de43406c37fa562bf5e49d1dad19c1e6
SSDEEP 6144:rGLsu72A1GQmrsXtlalpr5XStL+eI1I6AEOn1WIXtoxupmL09jT:rGX7l18sdGY0eYTAEeWeoxupmL
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 498KB

file.exe

IMPHASH 9ffb6435807c3d3dd01b0864e7947205
SHA256 cfbd8cbdc90f4c0afec635a6266dd4e53285acf7ef76d961cb47fc2564c27e0f
MD5 506fd7a42b81dd3c55346471307d3332
SHA1 efd73eff0986ba82449cf1e73174eb149f3f0fdf
SHA512 e3be1689fa14eea13c4510a7e76c14db452297b7ee0449e965e32ea19868ae57e112666532bfc4eb8ac29d8b421d9f59de43406c37fa562bf5e49d1dad19c1e6
SSDEEP 6144:rGLsu72A1GQmrsXtlalpr5XStL+eI1I6AEOn1WIXtoxupmL09jT:rGX7l18sdGY0eYTAEeWeoxupmL
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25534

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ZombifyActCtx GetSystemWindowsDirectoryW GetComputerNameW SetEvent FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetCurrentThread ReadConsoleW GetVolumePathNameW LoadLibraryW DeleteVolumeMountPointW GetConsoleAliasW GetFileAttributesW MulDiv WriteConsoleW InterlockedExchange GetCPInfoExW SetLastError TlsGetValue VirtualAlloc SetComputerNameA LoadLibraryA OpenMutexA WriteConsoleA GetProcessWorkingSetSize SetCommMask FindFirstChangeNotificationA GetFileAttributesExW EndUpdateResourceA GlobalAddAtomW DebugBreak FindActCtxSectionStringW OpenFileMappingA GetConsoleSelectionInfo LCMapStringW FindFirstChangeNotificationW RemoveVectoredExceptionHandler SetCriticalSectionSpinCount GetProcAddress GetEnvironmentVariableW MultiByteToWideChar UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc GetLastError HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsSetValue TlsFree GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode HeapReAlloc LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetModuleHandleA HeapSize RtlUnwind RaiseException SetStdHandle GetConsoleOutputCP CreateFileA CloseHandle FlushFileBuffers

advapi32

BackupEventLogW IsTokenUntrusted RegQueryInfoKeyA CloseEventLog

Sharing