file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 192KB
Sample230120-bsyw2aaa65
SHA256 0b04a93712344d76e54cc4b38fafac4b7bf3aa038a10952efe0dafa542b6299e
MD5 901e053e9e2ead341b7a6e704c5b37d4
SHA1 10389e40122361e9deb0bf485d6e5bfce07a9fa5
SHA512 d0421833009246399535b621ed186419aa16db5a9373cf0d2ec20ec4fbda56c586941623bc61da1abee0ab518c6af56315208bcfbe40c5f269b0ff25f7e7fae1
SSDEEP 3072:+BN4X3pG6bqCaRzLX+Urtv5lGiWG0ECg9EUg3pzL5NtTutH:Sqk6BYaUrtrGfgGpzL5v
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 192KB

file.exe

IMPHASH b7fe544335f8a4238fde8ffc9deb4a27
SHA256 0b04a93712344d76e54cc4b38fafac4b7bf3aa038a10952efe0dafa542b6299e
MD5 901e053e9e2ead341b7a6e704c5b37d4
SHA1 10389e40122361e9deb0bf485d6e5bfce07a9fa5
SHA512 d0421833009246399535b621ed186419aa16db5a9373cf0d2ec20ec4fbda56c586941623bc61da1abee0ab518c6af56315208bcfbe40c5f269b0ff25f7e7fae1
SSDEEP 3072:+BN4X3pG6bqCaRzLX+Urtv5lGiWG0ECg9EUg3pzL5NtTutH:Sqk6BYaUrtrGfgGpzL5v
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

31622

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcessPriorityBoost GetConsoleAliasA CreateFileW GetSystemWindowsDirectoryW GlobalHandle FindFirstVolumeMountPointW CreateDirectoryExA ReleaseActCtx GetLogicalDriveStringsW ReadConsoleInputW GetComputerNameExA GetTempPathA GetCurrentDirectoryA DebugBreak LCMapStringW GetProcAddress GlobalAlloc IsDebuggerPresent FindActCtxSectionStringA GetLastError LoadLibraryW CreateNamedPipeW LocalFlags GetModuleHandleA GetConsoleAliasesLengthW CreateFileA GetVolumePathNameW ProcessIdToSessionId OpenFileMappingW lstrcmpW AddRefActCtx SetConsoleScreenBufferSize GetComputerNameA lstrcpynW GenerateConsoleCtrlEvent CopyFileW DosDateTimeToFileTime TlsGetValue CreateActCtxW DeleteVolumeMountPointW MoveFileWithProgressW ResetEvent CreateMailslotA WriteConsoleInputW GetTempPathW InterlockedCompareExchange EnumTimeFormatsA FindNextFileA VerifyVersionInfoA GetConsoleAliasW GetNumberOfConsoleInputEvents GetConsoleTitleW GetVolumeNameForVolumeMountPointW LoadLibraryA CloseHandle MultiByteToWideChar WideCharToMultiByte HeapReAlloc HeapAlloc GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapCreate VirtualFree VirtualAlloc SetHandleCount GetStdHandle GetFileType Sleep ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode RaiseException FlushFileBuffers SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile HeapSize DeleteFileA

gdi32

GetBrushOrgEx

advapi32

SetThreadToken

shell32

FindExecutableA

msimg32

AlphaBlend