file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 324KB
Sample230125-v7prfshc46
SHA256 f665feace3274a8d0f20b01af94ccc09ff114de5f8da6f4b32b08cdf86a70a43
MD5 3a08ad9e7276b2996c28f9f57ec08f2d
SHA1 30f30ba74de4593c1b4e0414fd612cc8b144ff90
SHA512 d67b6f4f41d33d61ead1189dd13d85dd3075a383530a8230ea4096e88e9cd3545957451b5861ab617a9f8e06cd0b6d61fd741d1d385448209417cee4d5c86ec6
SSDEEP 6144:kjZLmln7cuzqfiejX19+Fwe0+MOKXkex6yOUTn:k96nHzq66qrWwAUUTn
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 324KB

file.exe

IMPHASH 8ec76f5c59a9f0c161f9365e55dfcda6
SHA256 f665feace3274a8d0f20b01af94ccc09ff114de5f8da6f4b32b08cdf86a70a43
MD5 3a08ad9e7276b2996c28f9f57ec08f2d
SHA1 30f30ba74de4593c1b4e0414fd612cc8b144ff90
SHA512 d67b6f4f41d33d61ead1189dd13d85dd3075a383530a8230ea4096e88e9cd3545957451b5861ab617a9f8e06cd0b6d61fd741d1d385448209417cee4d5c86ec6
SSDEEP 6144:kjZLmln7cuzqfiejX19+Fwe0+MOKXkex6yOUTn:k96nHzq66qrWwAUUTn
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

20239

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenA GetCPInfo HeapAlloc EndUpdateResourceW InterlockedIncrement SetConsoleActiveScreenBuffer GetModuleHandleW GetGeoInfoW GetConsoleAliasExesW FindResourceExA GlobalAlloc LoadLibraryW GetSystemWindowsDirectoryA EnumSystemCodePagesA GetConsoleAliasW GetDevicePowerState LCMapStringA GetLastError SetLastError GetProcAddress IsBadStringPtrW BuildCommDCBW LoadLibraryA OpenWaitableTimerW DnsHostnameToComputerNameA CreateEventW GetCommMask AddAtomA SetCommMask FoldStringA SetNamedPipeHandleState SetConsoleCursorInfo lstrcmpiW VirtualProtect GetVolumeNameForVolumeMountPointW CreateWaitableTimerA GetConsoleProcessList ReadConsoleOutputCharacterW EnumCalendarInfoExA LCMapStringW GetStringTypeW SetPriorityClass CreateFiber VirtualAlloc GetComputerNameA MultiByteToWideChar GetStringTypeA HeapFree Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize RaiseException WriteFile GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleA RtlUnwind GetACP GetOEMCP IsValidCodePage GetLocaleInfoA WideCharToMultiByte

user32

GetCaretPos GetMenuItemID LoadMenuA

gdi32

GetCharWidthA

advapi32

BackupEventLogA

winhttp

WinHttpCheckPlatform

msimg32

AlphaBlend

Name

.text

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xeruko

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.lebilo

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reke

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ