file[.]exe | Triage™

General

Target
file.exe
Size 258KB
Sample230116-jgyqwsfe2x
SHA256 d23b2edc3eb4be75bd35f3c952cdbdbbdffda5f123891232f170dcaea9038b9a
MD5 d99d1aebe61cf0a59338f1793a8dc1bf
SHA1 e3436566365a631bd879690c668bae35653569a9
SHA512 31625bc8f4daf9c4b8ae3afe607faf0bbfe5f6a2c60941ecfc754ed486b4fa6ff15cd4b4f36af7cf0bb1f84c92db703303f0c8509a46ecd0a776472b192a4e5d
SSDEEP 6144:n0h3fdLPmTPTm3jLNQA5y4tSkU4zqQna:n0hFjmTTqVQUtSkFP
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 258KB

file.exe

IMPHASH c2992a3f19e353386f6223d505e02441
SHA256 d23b2edc3eb4be75bd35f3c952cdbdbbdffda5f123891232f170dcaea9038b9a
MD5 d99d1aebe61cf0a59338f1793a8dc1bf
SHA1 e3436566365a631bd879690c668bae35653569a9
SHA512 31625bc8f4daf9c4b8ae3afe607faf0bbfe5f6a2c60941ecfc754ed486b4fa6ff15cd4b4f36af7cf0bb1f84c92db703303f0c8509a46ecd0a776472b192a4e5d
SSDEEP 6144:n0h3fdLPmTPTm3jLNQA5y4tSkU4zqQna:n0hFjmTTqVQUtSkFP
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

22628

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAddAtomA EndUpdateResourceW InterlockedIncrement ReadConsoleA GetConsoleAliasA GetCurrentProcess GetFileAttributesExA FreeEnvironmentStringsA GetModuleHandleW EnumCalendarInfoExW GetProcessHeap GetGeoInfoW GetSystemWow64DirectoryA GetPriorityClass WideCharToMultiByte LoadLibraryW GetSystemTimeAdjustment SetMessageWaitingIndicator lstrcmpiA FindResourceExW FindVolumeMountPointClose VirtualAlloc EnterCriticalSection BuildCommDCBW OpenWaitableTimerA LoadLibraryA OpenWaitableTimerW DnsHostnameToComputerNameA CreateEventW GetCommMask SetCommMask EnumDateFormatsA SetConsoleCursorInfo GetModuleHandleA OpenFileMappingW GetConsoleSelectionInfo LCMapStringW CreateFileA CloseHandle GetProcAddress IsBadStringPtrW WriteConsoleW GetConsoleOutputCP WriteConsoleA InterlockedDecrement InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError HeapFree TerminateProcess IsDebuggerPresent ExitProcess GetStartupInfoW GetCPInfo RtlUnwind RaiseException LCMapStringA GetStringTypeW WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapCreate VirtualFree HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize SetHandleCount GetFileType GetStartupInfoA GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle

user32

ScreenToClient ClientToScreen GetDC

advapi32

BackupEventLogW

winhttp

WinHttpSetTimeouts WinHttpReadData

Sharing