file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 319KB
Sample230111-y4envsec28
SHA256 df2abd290a9089f10d59fc5eb57e93894820cd91d7c6bc1bf64418f1618ea7fa
MD5 321b7e0145499cd4e3ae5ede29c5a55d
SHA1 73861a4189fd9a85f155cbd0003fd2398338bd7e
SHA512 a1ac2acd053bf4f7272183c0f38e90d89aa626967c39118d02a79fcbabd6efc8c5d8502f21420f2337818ff5e57a1d4588a3be5cf7b54dcda7d061ac283b945f
SSDEEP 6144:Bj6LVFg29FjZb+rlttyT0FAP3Zi5NVxFz:Bo62XjZb+rlttywE3ZiTV
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 319KB

file.exe

IMPHASH cc224966c0ebf7118ef643f039d26f9d
SHA256 df2abd290a9089f10d59fc5eb57e93894820cd91d7c6bc1bf64418f1618ea7fa
MD5 321b7e0145499cd4e3ae5ede29c5a55d
SHA1 73861a4189fd9a85f155cbd0003fd2398338bd7e
SHA512 a1ac2acd053bf4f7272183c0f38e90d89aa626967c39118d02a79fcbabd6efc8c5d8502f21420f2337818ff5e57a1d4588a3be5cf7b54dcda7d061ac283b945f
SSDEEP 6144:Bj6LVFg29FjZb+rlttyT0FAP3Zi5NVxFz:Bo62XjZb+rlttywE3ZiTV
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25759

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW EnumCalendarInfoExW GetProcessHeap ReadConsoleW TlsSetValue GetSystemWindowsDirectoryA LeaveCriticalSection DnsHostnameToComputerNameW GetConsoleAliasW GetFileAttributesW WriteConsoleW GetConsoleFontSize MultiByteToWideChar IsBadStringPtrA GetTempPathW lstrcmpiA VirtualAlloc SetComputerNameA LoadLibraryA SetCommMask EnumDateFormatsA SetConsoleCursorInfo FreeEnvironmentStringsW BuildCommDCBA GetFileAttributesExW EndUpdateResourceA GlobalAddAtomW AddConsoleAliasA FindActCtxSectionStringW OpenFileMappingA LCMapStringW GetCurrentProcess InterlockedIncrement FindResourceExW GetProcAddress RemoveVectoredExceptionHandler GetConsoleOutputCP WriteConsoleA ReadFile GetCommandLineA GetStartupInfoA HeapAlloc TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId GetLastError InterlockedDecrement Sleep HeapSize ExitProcess EnterCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind SetHandleCount GetStdHandle GetFileType DeleteCriticalSection HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc InitializeCriticalSectionAndSpinCount CloseHandle CreateFileA GetModuleHandleA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers SetStdHandle SetEndOfFile

user32

WindowFromDC

gdi32

GetCharWidthA

advapi32

IsTokenRestricted DeregisterEventSource ClearEventLogA

winhttp

WinHttpSetDefaultProxyConfiguration

msimg32

AlphaBlend