file[.]exe | Triage™

General

Target
file.exe
Size 417KB
Sample230202-lnrx2aff92
SHA256 ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
MD5 ba05aa05612678241f55ddca000e2f61
SHA1 6d0c71ab98ec5a3686ae7a63108398a71a56972e
SHA512 c0baa978e10a33f28238700c21950abd0696dfccf5c647378729559ac242975c26e176e02abb1b77d1230670fcbbc3561fb3dcf0afc8fbfdc1354abe669e6490
SSDEEP 6144:rYL8gwE59S9dRd9qM3SVFLjruj8zeKsGhc9/CJTk637eQfnd586V9pGB:U15E9dRd0lVF/y8kGhc9CJb7d5/
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 417KB

file.exe

IMPHASH 51ceb91dba0ace98219e4727f07b1743
SHA256 ab1aefbe820f7c7dfa9e0ccb6089da9ec71f11a0d44488054c5a8b8b52e925e4
MD5 ba05aa05612678241f55ddca000e2f61
SHA1 6d0c71ab98ec5a3686ae7a63108398a71a56972e
SHA512 c0baa978e10a33f28238700c21950abd0696dfccf5c647378729559ac242975c26e176e02abb1b77d1230670fcbbc3561fb3dcf0afc8fbfdc1354abe669e6490
SSDEEP 6144:rYL8gwE59S9dRd9qM3SVFLjruj8zeKsGhc9/CJTk637eQfnd586V9pGB:U15E9dRd0lVF/y8kGhc9CJb7d5/
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19547

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA GetDateFormatW lstrcpynA FindResourceExW WriteConsoleOutputCharacterA BuildCommDCBAndTimeoutsA EndUpdateResourceW VerSetConditionMask ReadConsoleA GetCurrentProcess SetHandleInformation GetComputerNameW GetProcessPriorityBoost GetWindowsDirectoryA GetGeoInfoW GetConsoleAliasExesW GlobalAlloc SetConsoleCursorPosition WriteConsoleW EnumResourceLanguagesA IsBadStringPtrA LCMapStringA InterlockedExchange GetCPInfoExW GetLastError SetLastError GetProcAddress VirtualAlloc EnumSystemCodePagesW SetTimerQueueTimer LoadLibraryA WriteConsoleA QueryDosDeviceW GetCommMask AddAtomA FoldStringW FoldStringA SetConsoleCursorInfo GetModuleHandleA GetCommTimeouts BuildCommDCBA ReadConsoleInputW TerminateJobObject GetWindowsDirectoryW GetTempPathA GlobalReAlloc LCMapStringW GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapSize TerminateProcess IsDebuggerPresent RaiseException GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar

user32

LoadMenuA GetListBoxInfo

winhttp

WinHttpOpen

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

192KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gagocim

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.referex

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

winhttp