file[.]exe | Triage™

General

Target
file.exe
Size 329KB
Sample230121-elscfsae49
SHA256 a3c3cb2e026ce76afda0767f8d2a3d062e84237d62348e3d5b397ea3f82fb365
MD5 261c262b0dd19fb155d254eef703ef05
SHA1 f118a49077eb16119e134dd4634bd3114096c211
SHA512 5085cf7c01e35fd5b81c77775e65c7de5f3b747446a2040d6be957d22ca99538b51b796d7033f7e720a15026a63c906ce94e665013ea5b092683c265efb69ea7
SSDEEP 6144:QLEIYvxoxY6fazskBh0EgCoZsBMiGOxn:QgIYSxFfYskBhfg6MO
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 329KB

file.exe

IMPHASH 2af8e8320b82cf2539acf29a7ac12797
SHA256 a3c3cb2e026ce76afda0767f8d2a3d062e84237d62348e3d5b397ea3f82fb365
MD5 261c262b0dd19fb155d254eef703ef05
SHA1 f118a49077eb16119e134dd4634bd3114096c211
SHA512 5085cf7c01e35fd5b81c77775e65c7de5f3b747446a2040d6be957d22ca99538b51b796d7033f7e720a15026a63c906ce94e665013ea5b092683c265efb69ea7
SSDEEP 6144:QLEIYvxoxY6fazskBh0EgCoZsBMiGOxn:QgIYSxFfYskBhfg6MO
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

18447

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VerSetConditionMask FlushConsoleInputBuffer GetModuleHandleW ReadConsoleW GetWindowsDirectoryA GetGeoInfoW GetConsoleAliasExesW FindResourceExA LoadLibraryW GetNamedPipeInfo GetConsoleAliasW GetDevicePowerState LCMapStringA DeleteFiber SetLastError lstrcmpiA GetProcAddress InterlockedIncrement HeapSize LoadLibraryA OpenWaitableTimerW LocalAlloc DnsHostnameToComputerNameA AddAtomW CreateEventW SetCommMask FreeEnvironmentStringsW BuildCommDCBA VirtualProtect GetConsoleCursorInfo EndUpdateResourceA CreateWaitableTimerA GetConsoleProcessList EnumCalendarInfoExA LCMapStringW IsBadStringPtrW lstrlenA VirtualAlloc SetPriorityClass GetLastError HeapFree HeapAlloc Sleep ExitProcess GetStartupInfoW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException InitializeCriticalSectionAndSpinCount GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleA GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar GetStringTypeW

user32

WindowFromDC GetCaretPos

gdi32

GetCharWidthA

advapi32

BackupEventLogW

Name

.text

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rovaj

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xapeb

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mawod

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

advapi32