file[.]exe | Triage™

General

Target
file.exe
Size 329KB
Sample230121-cez3lsad23
SHA256 c7c7c8ca1c12d2460133c8df2c2995a9755abf342e91c8bb2bb8c4f45d1bc97f
MD5 75e85a95793ba3e7a0361151fd0441b9
SHA1 ccf08317bc5e0ee39fd8d95a3d724eed03412472
SHA512 ee496366ff5a8317ad2a71d479d94351214131b4c47ab2342034db9e23ff9fbad3c0018823456a295c9f5703294307655e61e48f37f66bea9552b66d07d5b91a
SSDEEP 3072:RtbYL0xCZI1R1Tsdpm80dxCj7dxqsiUO5tZAgBUDkCQ2Eg9BSpx2JFSejIruW9R:4LAC0T7dxmasiUO5EgCoZsB3LOxr
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 329KB

file.exe

IMPHASH 2af8e8320b82cf2539acf29a7ac12797
SHA256 c7c7c8ca1c12d2460133c8df2c2995a9755abf342e91c8bb2bb8c4f45d1bc97f
MD5 75e85a95793ba3e7a0361151fd0441b9
SHA1 ccf08317bc5e0ee39fd8d95a3d724eed03412472
SHA512 ee496366ff5a8317ad2a71d479d94351214131b4c47ab2342034db9e23ff9fbad3c0018823456a295c9f5703294307655e61e48f37f66bea9552b66d07d5b91a
SSDEEP 3072:RtbYL0xCZI1R1Tsdpm80dxCj7dxqsiUO5tZAgBUDkCQ2Eg9BSpx2JFSejIruW9R:4LAC0T7dxmasiUO5EgCoZsB3LOxr
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

18447

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VerSetConditionMask FlushConsoleInputBuffer GetModuleHandleW ReadConsoleW GetWindowsDirectoryA GetGeoInfoW GetConsoleAliasExesW FindResourceExA LoadLibraryW GetNamedPipeInfo GetConsoleAliasW GetDevicePowerState LCMapStringA DeleteFiber SetLastError lstrcmpiA GetProcAddress InterlockedIncrement HeapSize LoadLibraryA OpenWaitableTimerW LocalAlloc DnsHostnameToComputerNameA AddAtomW CreateEventW SetCommMask FreeEnvironmentStringsW BuildCommDCBA VirtualProtect GetConsoleCursorInfo EndUpdateResourceA CreateWaitableTimerA GetConsoleProcessList EnumCalendarInfoExA LCMapStringW IsBadStringPtrW lstrlenA VirtualAlloc SetPriorityClass GetLastError HeapFree HeapAlloc Sleep ExitProcess GetStartupInfoW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar GetStringTypeW

user32

WindowFromDC GetCaretPos

gdi32

GetCharWidthA

advapi32

BackupEventLogW

Name

.text

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.toga

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cehu

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.piceped

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

advapi32