file[.]exe | Triage™

General

Target
file.exe
Size 419KB
Sample230112-rx229aca6t
SHA256 c50a1df6e81646e5c38b8f8f24ed7c9b295fc1faae77ab033d7020230cec2668
MD5 6df53499af2cf344dbf9f986e3b7194c
SHA1 cf1060d9a9a3de93885b0317b0df8e4b78f96600
SHA512 03efc6744861f069049ff394955ad2ec44ad3fdd6516ca98b229baa30ac513b47592ac489736712ade9f9fc13d25904718f4b7f63a27da94311c8c46d63e08b4
SSDEEP 12288:J7gqZv/fmF2fgJ4SiHTHeeEUCRFURkFo2Y:J71FXm4f/DHT+5F02
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 419KB

file.exe

IMPHASH 060d17800c4ce70fe36e9f82e5d5defa
SHA256 c50a1df6e81646e5c38b8f8f24ed7c9b295fc1faae77ab033d7020230cec2668
MD5 6df53499af2cf344dbf9f986e3b7194c
SHA1 cf1060d9a9a3de93885b0317b0df8e4b78f96600
SHA512 03efc6744861f069049ff394955ad2ec44ad3fdd6516ca98b229baa30ac513b47592ac489736712ade9f9fc13d25904718f4b7f63a27da94311c8c46d63e08b4
SSDEEP 12288:J7gqZv/fmF2fgJ4SiHTHeeEUCRFURkFo2Y:J71FXm4f/DHT+5F02
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25404

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect GetConsoleAliasA SetComputerNameA GetSystemWindowsDirectoryW GlobalUnlock FindFirstVolumeMountPointW CreateDirectoryExW DeleteAtom GetLogicalDriveStringsW ReadConsoleInputW GetTempPathW GetCurrentDirectoryW WaitForDebugEvent LCMapStringA GetProcAddress GetModuleHandleA LocalAlloc GetBinaryTypeA SearchPathW VerifyVersionInfoW GetHandleInformation EndUpdateResourceW FindNextFileA CreateFileW LoadLibraryW GlobalFlags CopyFileA CreateActCtxW lstrlenA UpdateResourceA CreateActCtxA DeleteVolumeMountPointA MoveFileWithProgressA CreateMailslotA WriteConsoleInputW InterlockedExchangeAdd EnumTimeFormatsA SetFileValidData FindFirstFileW FreeEnvironmentStringsA GetTickCount SetLastError GetPrivateProfileStructA GetLastError CopyFileExW CreateFileA GetConsoleTitleW GetCommMask GetNumberOfConsoleInputEvents CompareStringA FindFirstVolumeA LoadLibraryA HeapSize WriteConsoleW MultiByteToWideChar WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter DeleteFileA GetStartupInfoW TerminateProcess GetCurrentProcess IsDebuggerPresent HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId SetFilePointer EnterCriticalSection LeaveCriticalSection CloseHandle HeapAlloc Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RaiseException VirtualAlloc HeapReAlloc LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwind InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP

user32

GetMenuInfo

gdi32

GetCharWidth32A GetCharABCWidthsA GetColorAdjustment GetTextFaceW GetBrushOrgEx

winhttp

WinHttpSetOption

Sharing