file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 460KB
Sample230111-grf8gsaf26
SHA256 26549c4b843cbd5264b72ea2e2844de13d14ef4f80529b69b3ad01fc8017d3d5
MD5 eeb9b41aaa4038275c1217e71ed5440f
SHA1 05a4870c1f56b125d79d09347977401edcb443db
SHA512 1e570fefe59ac0da9139e57be7b5f827b694d6d865ae2eb42f2c68d2c0760ef373277f5c11db392669df03cec544fed16922a65e83d98d157ef564d1be989187
SSDEEP 12288:YqshzJDWs5YvLwdnQ3mgopbu/Yd2UK06OC+13G:YqsPWoAZ2gYbu/Yi0
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 460KB

file.exe

IMPHASH 23dff981b91df1879141d9140cd71ef9
SHA256 26549c4b843cbd5264b72ea2e2844de13d14ef4f80529b69b3ad01fc8017d3d5
MD5 eeb9b41aaa4038275c1217e71ed5440f
SHA1 05a4870c1f56b125d79d09347977401edcb443db
SHA512 1e570fefe59ac0da9139e57be7b5f827b694d6d865ae2eb42f2c68d2c0760ef373277f5c11db392669df03cec544fed16922a65e83d98d157ef564d1be989187
SSDEEP 12288:YqshzJDWs5YvLwdnQ3mgopbu/Yd2UK06OC+13G:YqsPWoAZ2gYbu/Yi0
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

28343

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesExA FreeEnvironmentStringsA GetModuleHandleW EnumCalendarInfoExW GetProcessHeap TlsSetValue GetPriorityClass LoadLibraryW InitializeCriticalSectionAndSpinCount GetSystemWindowsDirectoryA SetConsoleCursorPosition GetFileAttributesW GetConsoleFontSize MultiByteToWideChar GetTempPathW LCMapStringA SetLastError GetProcAddress AddConsoleAliasW BuildCommDCBW LoadLibraryA WriteConsoleA DnsHostnameToComputerNameA BeginUpdateResourceA SetCommMask EnumDateFormatsA SetConsoleCursorInfo lstrcmpiW GetCPInfoExA EndUpdateResourceA GlobalAddAtomW FindActCtxSectionStringW OpenFileMappingA SetFirmwareEnvironmentVariableA SetComputerNameW InterlockedIncrement IsBadStringPtrW VirtualAlloc RemoveVectoredExceptionHandler WriteConsoleW GetConsoleOutputCP SetEndOfFile GetLastError HeapFree HeapAlloc GetCommandLineA GetStartupInfoA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsFree GetCurrentThreadId InterlockedDecrement HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind ReadFile SetHandleCount GetFileType SetFilePointer GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA CloseHandle CreateFileA SetStdHandle GetConsoleCP GetConsoleMode LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers

user32

WindowFromDC

gdi32

GetCharWidthFloatW

advapi32

NotifyChangeEventLog IsTokenRestricted ClearEventLogA

winhttp

WinHttpSetDefaultProxyConfiguration

msimg32

TransparentBlt