file[.]exe | Triage™

General

Target
file.exe
Size 297KB
Sample230129-npz15sdc59
SHA256 d6cec5739817a83c1d09bf8555eaabaaf5c2aa2ac546b0012eb98008b7ee17a0
MD5 da627411e7e85229355ed325520a7d4e
SHA1 3a603f52b7285be51b1533815eecc67b0447af35
SHA512 2541710fafa6b76eb37cfa7bf15f4b4c79ba7f1d342581e7861d97f540f699361314cd387c90e612635764b8c13b0084b2163bed35179b6a88202a7a42287f2f
SSDEEP 3072:6WhYL8bYLARCHd0FoTVq3AV9LzeXw2zyA89meL2TT3mYlNvy4k95sR/g8R8BkmmM:/YL8bY7HQobV9wv+zM5m0E954RmmF6T
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 297KB

file.exe

IMPHASH 9076ebdfe68716cd93d7fb2ff571e34b
SHA256 d6cec5739817a83c1d09bf8555eaabaaf5c2aa2ac546b0012eb98008b7ee17a0
MD5 da627411e7e85229355ed325520a7d4e
SHA1 3a603f52b7285be51b1533815eecc67b0447af35
SHA512 2541710fafa6b76eb37cfa7bf15f4b4c79ba7f1d342581e7861d97f540f699361314cd387c90e612635764b8c13b0084b2163bed35179b6a88202a7a42287f2f
SSDEEP 3072:6WhYL8bYLARCHd0FoTVq3AV9LzeXw2zyA89meL2TT3mYlNvy4k95sR/g8R8BkmmM:/YL8bY7HQobV9wv+zM5m0E954RmmF6T
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

16285

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetPriorityClass SetLocalTime InterlockedIncrement GetConsoleAliasA GetCurrentProcess SetHandleInformation GetWindowsDirectoryA GetGeoInfoW GetConsoleAliasExesW SetCommTimeouts FindResourceExA GlobalAlloc DnsHostnameToComputerNameW EnumSystemCodePagesA WriteConsoleW ReadFile GetDevicePowerState IsBadStringPtrA LCMapStringA SetLastError GetProcAddress FindVolumeMountPointClose VirtualAlloc LoadLibraryA WriteConsoleA GetCommMask AddAtomA SetCommMask FoldStringA SetNamedPipeHandleState GetModuleHandleA BuildCommDCBA GetCPInfoExA EndUpdateResourceA GetVolumeNameForVolumeMountPointW EnumResourceLanguagesW LCMapStringW GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW Sleep ExitProcess GetLastError WriteFile GetStdHandle GetModuleFileNameA TerminateProcess IsDebuggerPresent HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement HeapSize GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar

user32

GetMenuItemID LoadMenuA ScreenToClient

Name

.text

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

90KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xokevu

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pip

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.jeyar

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32