file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 394KB
Sample230128-tf7bragg41
SHA256 693f31a5ca4725de280a4286060c4d1c8ade1fde322906b8f438b4bb796ff566
MD5 d7e03c4e12795600c2a22bfb80040474
SHA1 e0cce8deae2ce0882324fcd30ead47edc79cee55
SHA512 78a7bafcf7de19add90d1931335d08441f868cc426da90f90cf763c16607bbb71777ac90cf119b32444ac0f8b48ca599b22d0dac5eed5d552349b0f27be51ee1
SSDEEP 6144:xLaqlMAckTs9NWF9GIRva7YbSqOfEeZQbVicTrqSwzIDMH0P:xW3kg3W7GZweqbVrTrqSAeM
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 394KB

file.exe

IMPHASH d191080c270d3118935d8b6a682d2ca4
SHA256 693f31a5ca4725de280a4286060c4d1c8ade1fde322906b8f438b4bb796ff566
MD5 d7e03c4e12795600c2a22bfb80040474
SHA1 e0cce8deae2ce0882324fcd30ead47edc79cee55
SHA512 78a7bafcf7de19add90d1931335d08441f868cc426da90f90cf763c16607bbb71777ac90cf119b32444ac0f8b48ca599b22d0dac5eed5d552349b0f27be51ee1
SSDEEP 6144:xLaqlMAckTs9NWF9GIRva7YbSqOfEeZQbVicTrqSwzIDMH0P:xW3kg3W7GZweqbVrTrqSAeM
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

16923

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetPriorityClass GetConsoleAliasExesA SetLocalTime InterlockedIncrement GetConsoleAliasA GetCurrentProcess SetHandleInformation GetWindowsDirectoryA GetGeoInfoW SetCommTimeouts FindResourceExA GlobalAlloc SetCommConfig EnumSystemCodePagesA HeapValidate ReadFile GetDevicePowerState IsBadStringPtrA LCMapStringA SetLastError GetProcAddress FindVolumeMountPointClose VirtualAlloc LoadLibraryA DnsHostnameToComputerNameA GetCommMask AddAtomA FoldStringA SetNamedPipeHandleState GetModuleHandleA BuildCommDCBA GetCPInfoExA EndUpdateResourceA GetVolumeNameForVolumeMountPointW EnumResourceLanguagesW LCMapStringW MultiByteToWideChar GetModuleHandleW Sleep ExitProcess GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree GetCPInfo InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapSize WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind HeapReAlloc WideCharToMultiByte GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

GetMenuItemID LoadMenuA ScreenToClient

Name

.text

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

186KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gixe

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.lisik

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.lifo

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bakeh

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ