file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 321KB
Sample230112-freh8afc28
SHA256 0411cb8baf2a90e7a9ec1a9ebbd88342e77aef16272b95a2f5dc3ad29feb809c
MD5 ca35fd2fbe0f15e3788587335a98dd34
SHA1 13856e2c74cccb80066d57196a2c0462fd8a6a39
SHA512 de2e34fa7476fd8170e256bb4f29966f0043c6f6ee8596750a0726359a4352700715376959455c5471418b761dfe3b0aa5a7747605731bf374c94378c75e59ca
SSDEEP 3072:DXO+qb61qv/Ahvta5ZLLIhT4L5tzPNSDbDyTnwY62jdF8M/WhJshxeDwMTaCBKmT:7rq2Iwtz4L5XSDtejdO6WseDnmg
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 321KB

file.exe

IMPHASH dc61e0c6faeada0c00413a0a116aa87d
SHA256 0411cb8baf2a90e7a9ec1a9ebbd88342e77aef16272b95a2f5dc3ad29feb809c
MD5 ca35fd2fbe0f15e3788587335a98dd34
SHA1 13856e2c74cccb80066d57196a2c0462fd8a6a39
SHA512 de2e34fa7476fd8170e256bb4f29966f0043c6f6ee8596750a0726359a4352700715376959455c5471418b761dfe3b0aa5a7747605731bf374c94378c75e59ca
SSDEEP 3072:DXO+qb61qv/Ahvta5ZLLIhT4L5tzPNSDbDyTnwY62jdF8M/WhJshxeDwMTaCBKmT:7rq2Iwtz4L5XSDtejdO6WseDnmg
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25567

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetModuleHandleW EnumCalendarInfoExW GetProcessHeap ReadConsoleW FindActCtxSectionStringA TlsSetValue GetSystemWindowsDirectoryA LeaveCriticalSection DnsHostnameToComputerNameW GetConsoleAliasW GetFileAttributesW MultiByteToWideChar IsBadStringPtrA lstrcmpiA GetProcAddress InterlockedIncrement SetComputerNameA LoadLibraryA WriteConsoleA SetCommMask SetConsoleCursorInfo FreeEnvironmentStringsW BuildCommDCBA EnumDateFormatsW GetFileAttributesExW EndUpdateResourceA GlobalAddAtomW AddConsoleAliasA GetTempPathA OpenFileMappingA GetConsoleSelectionInfo LCMapStringW RemoveVectoredExceptionHandler FindResourceExW VirtualAlloc UnregisterWait WriteConsoleW GetConsoleOutputCP ReadFile GetCommandLineA GetStartupInfoA HeapAlloc TlsGetValue TlsAlloc TlsFree SetLastError GetCurrentThreadId GetLastError InterlockedDecrement Sleep HeapSize ExitProcess EnterCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind SetHandleCount GetStdHandle GetFileType DeleteCriticalSection HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage RaiseException WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc InitializeCriticalSectionAndSpinCount CloseHandle CreateFileA GetModuleHandleA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers SetStdHandle SetEndOfFile

user32

GetDC

gdi32

GetCharWidthA

advapi32

ClearEventLogA

winhttp

WinHttpSetDefaultProxyConfiguration

msimg32

AlphaBlend