file[.]exe | Triage™

General

Target
file.exe
Size 417KB
Sample230202-hs8jsshc5t
SHA256 6acee31b7d70a5d29bd227366ca6ff41aa3f40086fcb6cdac93181bbb4052bf8
MD5 ad4534b97345680890953fd0ff0d068c
SHA1 cb4978d1f7bd20f2b6ae882b8900dfd7d103e778
SHA512 51f40f9d6cb6a71869a5073218458da31e8dd86261d9f78e6a72e96f74c19f831058a7f68317e97dbd35a3f0ca899bcb05fb619dcbb7ebb5e91596934b7a3164
SSDEEP 6144:F3L2WW59qiI1TC5Xkcr4A9SD9QlzhEvtmWM79/CJTk637eQfnd5P7giB:ZI58bAv4FD9rmJ9CJb7d5z
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 417KB

file.exe

IMPHASH 51ceb91dba0ace98219e4727f07b1743
SHA256 6acee31b7d70a5d29bd227366ca6ff41aa3f40086fcb6cdac93181bbb4052bf8
MD5 ad4534b97345680890953fd0ff0d068c
SHA1 cb4978d1f7bd20f2b6ae882b8900dfd7d103e778
SHA512 51f40f9d6cb6a71869a5073218458da31e8dd86261d9f78e6a72e96f74c19f831058a7f68317e97dbd35a3f0ca899bcb05fb619dcbb7ebb5e91596934b7a3164
SSDEEP 6144:F3L2WW59qiI1TC5Xkcr4A9SD9QlzhEvtmWM79/CJTk637eQfnd5P7giB:ZI58bAv4FD9rmJ9CJb7d5z
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19547

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA GetDateFormatW lstrcpynA FindResourceExW WriteConsoleOutputCharacterA BuildCommDCBAndTimeoutsA EndUpdateResourceW VerSetConditionMask ReadConsoleA GetCurrentProcess SetHandleInformation GetComputerNameW GetProcessPriorityBoost GetWindowsDirectoryA GetGeoInfoW GetConsoleAliasExesW GlobalAlloc SetConsoleCursorPosition WriteConsoleW EnumResourceLanguagesA IsBadStringPtrA LCMapStringA InterlockedExchange GetCPInfoExW GetLastError SetLastError GetProcAddress VirtualAlloc EnumSystemCodePagesW SetTimerQueueTimer LoadLibraryA WriteConsoleA QueryDosDeviceW GetCommMask AddAtomA FoldStringW FoldStringA SetConsoleCursorInfo GetModuleHandleA GetCommTimeouts BuildCommDCBA ReadConsoleInputW TerminateJobObject GetWindowsDirectoryW GetTempPathA GlobalReAlloc LCMapStringW GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize TerminateProcess IsDebuggerPresent RaiseException GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar

user32

LoadMenuA GetListBoxInfo

winhttp

WinHttpOpen

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

192KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xib

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rasur

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

winhttp