file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 400KB
Sample230202-rbh29acb95
SHA256 d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
MD5 3e3fd9a5d1491021d0458bbfe076304a
SHA1 880af1b339ed093f20652de3e71c5c06f4bb8843
SHA512 5044a488e803bf4410335ffd9a9d1d2228b25c6472959becc91b9b3912bfd2552dfd4a39c97a40c3be13589b4ad10f75c036dcdb061b2fc01db97797cb64496c
SSDEEP 6144:vz3L76bhCDyUXwISmej8dhV6jqq7guo32TSEj9/CJTk637eQfnd58ABD:bHBDZXQmrT6u3uWqnj9CJb7d5
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

file.exe

.exe 400KB

file.exe

IMPHASH d9bb3534629ee1e0adad5f89cd30d412
SHA256 d3c12b4012e87ffd9280fe7ed9a4fa55a2090902cc4d628c037e7c03f1797d6b
MD5 3e3fd9a5d1491021d0458bbfe076304a
SHA1 880af1b339ed093f20652de3e71c5c06f4bb8843
SHA512 5044a488e803bf4410335ffd9a9d1d2228b25c6472959becc91b9b3912bfd2552dfd4a39c97a40c3be13589b4ad10f75c036dcdb061b2fc01db97797cb64496c
SSDEEP 6144:vz3L76bhCDyUXwISmej8dhV6jqq7guo32TSEj9/CJTk637eQfnd58ABD:bHBDZXQmrT6u3uWqnj9CJb7d5
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19067

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteConsoleOutputCharacterA BuildCommDCBAndTimeoutsA EndUpdateResourceW VerSetConditionMask ReadConsoleA GetCurrentProcess QueryDosDeviceA SetHandleInformation GetComputerNameW GetProcessPriorityBoost GetWindowsDirectoryA GetGeoInfoW GlobalAlloc SetConsoleCursorPosition WriteConsoleW EnumResourceLanguagesA LCMapStringA InterlockedExchange GetCPInfoExW GetLastError FindResourceExW GetProcAddress VirtualAlloc EnumSystemCodePagesW SetTimerQueueTimer LoadLibraryA WriteConsoleA AddAtomW GetCommMask FoldStringW FoldStringA SetConsoleCursorInfo GetModuleHandleA GetCommTimeouts BuildCommDCBA ReadConsoleInputW TerminateJobObject GetWindowsDirectoryW GetVolumeNameForVolumeMountPointW GetTempPathA GlobalReAlloc IsBadStringPtrW lstrcpynA SetLastError GetDateFormatW GetStartupInfoW HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte LCMapStringW RaiseException

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointA

advapi32

ReportEventW

ole32

ReadClassStm

Name

.text

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

191KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wiz

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xus

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ