file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 293KB
Sample230128-bl8snafa9v
SHA256 bf57038bd501934801f4ef8af2ba4a01d0aac484c550574b43e5eb94e7ee0597
MD5 04f7ede77002ee9767d96ceb414e1fc1
SHA1 b024d3a2824699fb34e91c0b5f7ecc1a02160899
SHA512 1e92423726b3309304b0561322c99e62965c95b527775fbfecb77a2d291fe06949b0393cc65d17744ddd05533b4f357211c4139b41ca5c786e18e37288e9ea87
SSDEEP 3072:dCWQLntv5UbXS3MKx0zhWqueUFsWu8SVDQlQsB8BZ3F1go9ClANbFrZVngc6I8lT:CLntSbC3MZ1aADzs65x9CEbnVnmW8dV
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 293KB

file.exe

IMPHASH 91bad5df5f4993944370e46a47a36cd6
SHA256 bf57038bd501934801f4ef8af2ba4a01d0aac484c550574b43e5eb94e7ee0597
MD5 04f7ede77002ee9767d96ceb414e1fc1
SHA1 b024d3a2824699fb34e91c0b5f7ecc1a02160899
SHA512 1e92423726b3309304b0561322c99e62965c95b527775fbfecb77a2d291fe06949b0393cc65d17744ddd05533b4f357211c4139b41ca5c786e18e37288e9ea87
SSDEEP 3072:dCWQLntv5UbXS3MKx0zhWqueUFsWu8SVDQlQsB8BZ3F1go9ClANbFrZVngc6I8lT:CLntSbC3MZ1aADzs65x9CEbnVnmW8dV
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

16879

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA CreateFiber GetConsoleAliasExesA SetLocalTime InterlockedIncrement GetConsoleAliasA GetCurrentProcess GetWindowsDirectoryA GetGeoInfoW SetCommTimeouts FindResourceExA GlobalAlloc SetCommConfig HeapCreate EnumSystemCodePagesA HeapValidate ReadFile IsBadStringPtrA LCMapStringA SetLastError GetProcAddress VirtualAlloc LoadLibraryA DnsHostnameToComputerNameA GetCommMask AddAtomA FoldStringA SetNamedPipeHandleState GetModuleHandleA BuildCommDCBA VirtualProtect GetCPInfoExA EndUpdateResourceA GetSystemTime HeapAlloc MultiByteToWideChar GetModuleHandleW Sleep ExitProcess GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree HeapReAlloc WriteFile GetStdHandle GetModuleFileNameA GetCPInfo InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

GetMenuItemID LoadMenuA ScreenToClient

Name

.text

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

90KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yaron

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.teloruc

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.diko

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.lakug

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ