file[.]exe | Triage™

General

Target
file.exe
Size 342KB
Sample230125-lml1dsff25
SHA256 e0ddfb5a3473969006cc485d8040b5321bc3769e7a5f5dfd7a8a9e5fe1227ac6
MD5 87a0c1c312f80b7750ebee3ac4c0670c
SHA1 a0738269e1b869c914767811145149b63db3ae61
SHA512 47dab64a859dec1bfb640316daeede9fe26e50f703f73c4e7ceea2c67d4555279a338e7a6d6c41c5255d970c83f939981564a2b3d8fb3a6cc3b6ba10e031c625
SSDEEP 6144:C9YLM8gPcKQiDKXQmSrweFS0bO+n1QybGDjq7VWRFBMolz90BB:wY4rhQKo2Q3O77VWR5lzKB
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 342KB

file.exe

IMPHASH 861af707b319724b1132a7a971c54bc2
SHA256 e0ddfb5a3473969006cc485d8040b5321bc3769e7a5f5dfd7a8a9e5fe1227ac6
MD5 87a0c1c312f80b7750ebee3ac4c0670c
SHA1 a0738269e1b869c914767811145149b63db3ae61
SHA512 47dab64a859dec1bfb640316daeede9fe26e50f703f73c4e7ceea2c67d4555279a338e7a6d6c41c5255d970c83f939981564a2b3d8fb3a6cc3b6ba10e031c625
SSDEEP 6144:C9YLM8gPcKQiDKXQmSrweFS0bO+n1QybGDjq7VWRFBMolz90BB:wY4rhQKo2Q3O77VWR5lzKB
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

17727

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCPInfo FindResourceExW EndUpdateResourceW InterlockedIncrement GetConsoleAliasA SetConsoleActiveScreenBuffer GetModuleHandleW GetGeoInfoW GetPriorityClass GlobalAlloc LoadLibraryW CreateEventA GetSystemWindowsDirectoryA EnumSystemCodePagesA GetNamedPipeInfo GetDevicePowerState IsBadStringPtrA LCMapStringA SetLastError GetConsoleAliasExesA GetProcAddress VirtualAlloc HeapSize LoadLibraryA OpenWaitableTimerW DnsHostnameToComputerNameA AddAtomW GetCommMask FoldStringW lstrcmpiW BuildCommDCBA VirtualProtect GetConsoleCursorInfo GetVolumeNameForVolumeMountPointW CreateWaitableTimerA GetConsoleProcessList EnumCalendarInfoExA LCMapStringW CreateFiber lstrlenA ReadConsoleOutputCharacterA GetComputerNameA GetLastError HeapFree Sleep ExitProcess GetStartupInfoW HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapAlloc HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException WriteFile GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetACP GetOEMCP IsValidCodePage GetModuleHandleA GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar GetStringTypeW

user32

LoadMenuA SetCaretPos GetMenuItemID

gdi32

GetCharWidthA

advapi32

BackupEventLogW

Name

.text

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

93KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pag

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.muyo

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taveza

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

advapi32