finanz[.]exe | Triage™

General

Target
finanz.exe
Size 210KB
Sample230105-lc2cbsfa4t
SHA256 f9aa16739f6abd1b313690e24c15b5d958e5cda35fd8bccfad3b7c7eb5ebc74e
MD5 dbade9bdcff53a58bb20881c07490662
SHA1 8cbb18ebcd69be1a356bdd8516889c1d0b09ee7d
SHA512 2c9563053cb604293adc6d0db51585cf17df114f8d4671b5d3ecdaf39455d69249d9b0ea30fe2d4c0ed5c8577eb37597586c5b56acb962ca739a0bf74018f2c6
SSDEEP 3072:GXsrymDLtwzfV5lA53PcPSkgGl8foBwZ3tWF7jmcnmcTdLXGpl:ugLt0V5l2PE3GZ9WFucj5
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

finanz.exe

.exe 210KB

finanz.exe

IMPHASH 7bca87c7309353055aed194207c93e99
SHA256 f9aa16739f6abd1b313690e24c15b5d958e5cda35fd8bccfad3b7c7eb5ebc74e
MD5 dbade9bdcff53a58bb20881c07490662
SHA1 8cbb18ebcd69be1a356bdd8516889c1d0b09ee7d
SHA512 2c9563053cb604293adc6d0db51585cf17df114f8d4671b5d3ecdaf39455d69249d9b0ea30fe2d4c0ed5c8577eb37597586c5b56acb962ca739a0bf74018f2c6
SSDEEP 3072:GXsrymDLtwzfV5lA53PcPSkgGl8foBwZ3tWF7jmcnmcTdLXGpl:ugLt0V5l2PE3GZ9WFucj5
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

24590

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasW GetModuleHandleW CreateDirectoryExW ReadConsoleInputW GetTempPathW GetSystemDirectoryW RemoveDirectoryW OutputDebugStringA GetProcAddress LocalAlloc GetBinaryTypeA SearchPathA VerifyVersionInfoA SetProcessPriorityBoost EndUpdateResourceA FindNextFileW FindFirstVolumeA LocalShrink GlobalFlags _llseek UpdateResourceA CreateActCtxW CopyFileW AddConsoleAliasW CreateMutexA GetCurrentActCtx GetDiskFreeSpaceA MoveFileW GetLogicalDriveStringsA SetEvent MoveFileExA CreateMailslotA WriteConsoleInputA TerminateThread GetCurrentProcess RtlCaptureContext InterlockedCompareExchange GetFileTime lstrcatA FindFirstFileW FreeEnvironmentStringsA SetErrorMode InterlockedExchangeAdd MoveFileWithProgressA GetTickCount SetLastError GetPrivateProfileStructW VerSetConditionMask LoadLibraryA GetLastError DeleteFileA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleA HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection Sleep ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException VirtualAlloc HeapReAlloc SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile HeapSize CloseHandle CreateFileA

gdi32

SetBrushOrgEx

Sharing