file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 452KB
Sample230111-zceefsec63
SHA256 f2e3713a2ace78509ec8a27b0219e96b56f93f2664321b2cd4e0279f87d45222
MD5 52a8a5ddc8f10f1de68893a1e244935d
SHA1 a61530a7538d354226158bf12c3975f39fc681fa
SHA512 e88154b212102862cd4c93076f14dbefa13f07b209be40f607da51b745723f68c006d4b2e101d0c33d2d6cc076b3812080dff4551afbcd1950c85341c6e61dc4
SSDEEP 6144:Py42Sk5sqJL+nDWwngiCH/ElbmWeUbPffBsY7aw4kaP3Zi5rRRxFz:PISk5sqJL+DJngiCireUbPLF4T3ZibR
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 452KB

file.exe

IMPHASH cc224966c0ebf7118ef643f039d26f9d
SHA256 f2e3713a2ace78509ec8a27b0219e96b56f93f2664321b2cd4e0279f87d45222
MD5 52a8a5ddc8f10f1de68893a1e244935d
SHA1 a61530a7538d354226158bf12c3975f39fc681fa
SHA512 e88154b212102862cd4c93076f14dbefa13f07b209be40f607da51b745723f68c006d4b2e101d0c33d2d6cc076b3812080dff4551afbcd1950c85341c6e61dc4
SSDEEP 6144:Py42Sk5sqJL+nDWwngiCH/ElbmWeUbPffBsY7aw4kaP3Zi5rRRxFz:PISk5sqJL+DJngiCireUbPLF4T3ZibR
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25759

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW EnumCalendarInfoExW GetProcessHeap ReadConsoleW TlsSetValue GetSystemWindowsDirectoryA LeaveCriticalSection DnsHostnameToComputerNameW GetConsoleAliasW GetFileAttributesW WriteConsoleW GetConsoleFontSize MultiByteToWideChar IsBadStringPtrA GetTempPathW lstrcmpiA VirtualAlloc SetComputerNameA LoadLibraryA SetCommMask EnumDateFormatsA SetConsoleCursorInfo FreeEnvironmentStringsW BuildCommDCBA GetFileAttributesExW EndUpdateResourceA GlobalAddAtomW AddConsoleAliasA FindActCtxSectionStringW OpenFileMappingA LCMapStringW GetCurrentProcess InterlockedIncrement FindResourceExW GetProcAddress RemoveVectoredExceptionHandler GetConsoleOutputCP WriteConsoleA ReadFile GetCommandLineA GetStartupInfoA HeapAlloc TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId GetLastError InterlockedDecrement Sleep HeapSize ExitProcess EnterCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind SetHandleCount GetStdHandle GetFileType DeleteCriticalSection HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc InitializeCriticalSectionAndSpinCount CloseHandle CreateFileA GetModuleHandleA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers SetStdHandle SetEndOfFile

user32

WindowFromDC

gdi32

GetCharWidthA

advapi32

IsTokenRestricted DeregisterEventSource ClearEventLogA

winhttp

WinHttpSetDefaultProxyConfiguration

msimg32

AlphaBlend