file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 325KB
Sample230202-1w7qsabe51
SHA256 fb0fba19933650ebd71b9eaa698decc35ef6b3ee6273c8c1bc9c5da98d3e290d
MD5 e27fcbd599d93f7642073e1867f048e3
SHA1 7da5e90294b9c252da825547c5172e11db8cd98a
SHA512 c9b194b7948a7f676ad7143176a785097b29844a883532dc6cbac9616520f4ecaf0972e3f97779265cf2ee91fce70c49d4cdb5cb59fea53043b91e69909f2b29
SSDEEP 6144:Gl6TLh0iN/u1lyWu3T4TWLIXYgldPqlwKwpxEjV6ptCbNKN:Gl6TV0w8ybUWcileI
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 325KB

file.exe

IMPHASH 2ff60b2f756b6533c2643b340c02a5bb
SHA256 fb0fba19933650ebd71b9eaa698decc35ef6b3ee6273c8c1bc9c5da98d3e290d
MD5 e27fcbd599d93f7642073e1867f048e3
SHA1 7da5e90294b9c252da825547c5172e11db8cd98a
SHA512 c9b194b7948a7f676ad7143176a785097b29844a883532dc6cbac9616520f4ecaf0972e3f97779265cf2ee91fce70c49d4cdb5cb59fea53043b91e69909f2b29
SSDEEP 6144:Gl6TLh0iN/u1lyWu3T4TWLIXYgldPqlwKwpxEjV6ptCbNKN:Gl6TV0w8ybUWcileI
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19534

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceExW BuildCommDCBAndTimeoutsA EndUpdateResourceW GetCommState ReadConsoleA GetCurrentProcess QueryDosDeviceA SetHandleInformation GetWindowsDirectoryA GetGeoInfoW GetDateFormatA SetProcessPriorityBoost GlobalAlloc EnumResourceLanguagesA LCMapStringA InterlockedExchange GetCPInfoExW GetLastError lstrcpynA GetProcAddress VirtualAlloc EnumSystemCodePagesW SetTimerQueueTimer LoadLibraryA WriteConsoleA AddAtomW GetCommMask FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA GetConsoleCursorInfo ReadConsoleInputW TerminateJobObject GetTempPathA GlobalReAlloc IsBadStringPtrW WriteConsoleOutputCharacterW SetLastError GetComputerNameA LCMapStringW GetStartupInfoW HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointA

advapi32

ReportEventW

ole32

ReadClassStm

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xutibo

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bupufax

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ