file[.]exe | Triage™

General

Target
file.exe
Size 328KB
Sample230121-cf5pgsad27
SHA256 3688828a3dccb9ace0cf601277b4ec4ea1739dd65ddf0be1991558a67b2e53e9
MD5 67c1e80209a489e873801e6d1c804ce3
SHA1 274c010e84ead020872817c11e5309f3cda0b757
SHA512 d39f2bc1dd60a7cf86554e45b3fa7cd9c901c2504d150dfd1c0a6ca6af953caa51cc44013d3d07d0987c26c25416379b39c16e208a74bca04cba16e77b32d313
SSDEEP 6144:9WLeNZlUlK5AdMuJXzPCBgGWDgCoZsBemIOxr:9WCNvPGauFDw4g6T
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 328KB

file.exe

IMPHASH 2af8e8320b82cf2539acf29a7ac12797
SHA256 3688828a3dccb9ace0cf601277b4ec4ea1739dd65ddf0be1991558a67b2e53e9
MD5 67c1e80209a489e873801e6d1c804ce3
SHA1 274c010e84ead020872817c11e5309f3cda0b757
SHA512 d39f2bc1dd60a7cf86554e45b3fa7cd9c901c2504d150dfd1c0a6ca6af953caa51cc44013d3d07d0987c26c25416379b39c16e208a74bca04cba16e77b32d313
SSDEEP 6144:9WLeNZlUlK5AdMuJXzPCBgGWDgCoZsBemIOxr:9WCNvPGauFDw4g6T
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

18447

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VerSetConditionMask FlushConsoleInputBuffer GetModuleHandleW ReadConsoleW GetWindowsDirectoryA GetGeoInfoW GetConsoleAliasExesW FindResourceExA LoadLibraryW GetNamedPipeInfo GetConsoleAliasW GetDevicePowerState LCMapStringA DeleteFiber SetLastError lstrcmpiA GetProcAddress InterlockedIncrement HeapSize LoadLibraryA OpenWaitableTimerW LocalAlloc DnsHostnameToComputerNameA AddAtomW CreateEventW SetCommMask FreeEnvironmentStringsW BuildCommDCBA VirtualProtect GetConsoleCursorInfo EndUpdateResourceA CreateWaitableTimerA GetConsoleProcessList EnumCalendarInfoExA LCMapStringW IsBadStringPtrW lstrlenA VirtualAlloc SetPriorityClass GetLastError HeapFree HeapAlloc Sleep ExitProcess GetStartupInfoW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar GetStringTypeW

user32

WindowFromDC GetCaretPos

gdi32

GetCharWidthA

advapi32

BackupEventLogW

Name

.text

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

91KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xulicol

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zuwafax

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pazi

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

advapi32