file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 321KB
Sample230127-kcemwsbd8w
SHA256 4850e3fb4edd8b74b2bd35130e9c90662bfaa328f31c4521b92bcb284e2a24f8
MD5 9884a6823fe2c0a044fda32e0fd85cf5
SHA1 15586c76a90070479d34a43aebf03bc4e3285bfa
SHA512 50fbee6929be0b8d710b5e8e2222c85115924c16a2b377df9a1320960a2b26214308fcc7e328b6e89250fd4ffd8db39fe6292f5bb370e6382e10dba822151081
SSDEEP 3072:074TLGJx4luXMRrEOesqrwUFUAeLCDMVwDANYJjcIqmRCoi/Pyx/v04usu5X+:JLRluXTrp+CDmNYJwIqA7KGu55u
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 321KB

file.exe

IMPHASH 3ff0b1e3f0f47a57638794530d5c6447
SHA256 4850e3fb4edd8b74b2bd35130e9c90662bfaa328f31c4521b92bcb284e2a24f8
MD5 9884a6823fe2c0a044fda32e0fd85cf5
SHA1 15586c76a90070479d34a43aebf03bc4e3285bfa
SHA512 50fbee6929be0b8d710b5e8e2222c85115924c16a2b377df9a1320960a2b26214308fcc7e328b6e89250fd4ffd8db39fe6292f5bb370e6382e10dba822151081
SSDEEP 3072:074TLGJx4luXMRrEOesqrwUFUAeLCDMVwDANYJjcIqmRCoi/Pyx/v04usu5X+:JLRluXTrp+CDmNYJwIqA7KGu55u
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

20123

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceExW InterlockedIncrement GetConsoleAliasA GetComputerNameW EnumCalendarInfoExW GetWindowsDirectoryA GetGeoInfoW GlobalAlloc LoadLibraryW SetCommConfig HeapCreate LCMapStringA GetLastError SetLastError GetProcAddress VirtualAlloc EnumSystemCodePagesW BuildCommDCBW GetCPInfo LoadLibraryA DnsHostnameToComputerNameA AddAtomW CreateEventW GetCommMask SetNamedPipeHandleState SetConsoleCursorInfo lstrcmpiW GetModuleHandleA GetCommTimeouts VirtualProtect EndUpdateResourceA GetWindowsDirectoryW GetVolumeNameForVolumeMountPointW GetConsoleProcessList LCMapStringW GetStringTypeW IsBadStringPtrW GetConsoleAliasExesA CreateFiber MultiByteToWideChar GetStringTypeA HeapAlloc GetModuleHandleW Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree HeapReAlloc WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize RaiseException InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetACP GetOEMCP IsValidCodePage GetLocaleInfoA WideCharToMultiByte

user32

GetCaretPos GetMenuItemID LoadMenuA

gdi32

GetCharWidthA

advapi32

BackupEventLogA

winhttp

WinHttpOpen

msimg32

AlphaBlend

Name

.text

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

91KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vefulam

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.yiwenu

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.potu

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ