file[.]exe | Triage™

General

Target
file.exe
Size 3.7MB
Sample230119-rxexqagc34
SHA256 90a61538166854064428335c2b2beecf44fca5979e8fee4db712fc0b09f4729a
MD5 f75ca2b1d2dfdc1394518565fdeea79c
SHA1 d46c59044fcbd7622f369ed9ef4adcadd6d83f1c
SHA512 dd20f1497a703aa6089bf239fe422f46ff14babeeedcdde0b88a0c63f1ce22e3ec518a138ec068cbd3e2eacd7ccc2bb28b7c7bfe2d9adacc182a287fd41ffa74
SSDEEP 98304:6a5IPPWD56OIvSvC8h5kUL2oWTMhR8TaQzqiArN+PNE0:J5I2AOI6vF/kE2lTAR7QKsNb
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 3.7MB

file.exe

IMPHASH 3acde8160f19af8017a3f348656efecd
SHA256 90a61538166854064428335c2b2beecf44fca5979e8fee4db712fc0b09f4729a
MD5 f75ca2b1d2dfdc1394518565fdeea79c
SHA1 d46c59044fcbd7622f369ed9ef4adcadd6d83f1c
SHA512 dd20f1497a703aa6089bf239fe422f46ff14babeeedcdde0b88a0c63f1ce22e3ec518a138ec068cbd3e2eacd7ccc2bb28b7c7bfe2d9adacc182a287fd41ffa74
SSDEEP 98304:6a5IPPWD56OIvSvC8h5kUL2oWTMhR8TaQzqiArN+PNE0:J5I2AOI6vF/kE2lTAR7QKsNb
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

2126790

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

SetBkMode SelectObject DeleteObject GetStockObject CreateFontIndirectA SetTextColor GetObjectA

user32

AppendMenuA SendDlgItemMessageA GetDlgItem GetWindowLongA CreatePopupMenu ClientToScreen TrackPopupMenu GetCursorPos SendMessageA GetDlgItemTextA wsprintfA MessageBoxA LoadCursorA GetActiveWindow CheckDlgButton SetWindowTextA IsDlgButtonChecked SetWindowLongA CallWindowProcA GetClassInfoA CloseClipboard GetClipboardData EnumClipboardFormats SetDlgItemTextA EndDialog RegisterClassA DefDlgProcA SetActiveWindow SetMenuItemInfoA CheckMenuItem GetMenu InsertMenuItemA SetWindowPlacement SetTimer GetSystemMenu MoveWindow GetClientRect PostQuitMessage DestroyWindow DestroyIcon KillTimer GetSysColor CheckMenuRadioItem EnableMenuItem CharLowerBuffA GetWindowPlacement SetDlgItemInt GetSubMenu IsMenu GetWindowRect CreateDialogParamA DestroyCursor PostMessageA ChildWindowFromPoint InvalidateRect RemoveMenu LoadAcceleratorsA GetMessageA TranslateAcceleratorA IsDialogMessageA OpenClipboard CharUpperA SetFocus SetClipboardData EmptyClipboard LoadIconA TranslateMessage DispatchMessageA DestroyAcceleratorTable DialogBoxParamA GetSysColorBrush SetCursor UnregisterClassA CheckRadioButton IsWindow GetSystemMetrics EnableWindow GetWindowTextA RedrawWindow FindWindowA SetWindowPos wvsprintfA DestroyMenu

comdlg32

PageSetupDlgW CommDlgExtendedError FindTextW

kernel32

HeapSize GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA RtlUnwind HeapReAlloc VirtualAlloc HeapAlloc InitializeCriticalSectionAndSpinCount LoadLibraryA EnterCriticalSection LeaveCriticalSection IsDebuggerPresent UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsValidCodePage GetOEMCP GetACP GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapFree VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue DeleteCriticalSection GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW GetLastError WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetStdHandle WriteFile ExitProcess Sleep GetModuleHandleW SetUnhandledExceptionFilter GetCommandLineA FreeConsole GetProcAddress GetModuleHandleA GetCPInfo LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

Name

.text

Size

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.0aD

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.`[K

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.IBp

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

gdi32

user32

comdlg32

kernel32