file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 421KB
Sample230203-ab15dscd2t
SHA256 bd367c0b495bdaf49adba791decda194c55a5403880a152ec113c7e61fecbf8d
MD5 5053e768c65b528396e53ae8ec181c4c
SHA1 f53250c26cdb5cc58347e0bbc5a820f1bb1e263e
SHA512 3829615a1b53e8a2023ff7478f5bda6e83dae591ffbae52f8a4c5fa13ad0542617e2197d8c2baa84d2fafad071257f3525c96c5e954514b14cedf9f5008e1daa
SSDEEP 6144:3xvAL9OfhSnbkJ73nOu2XRNUS5p4F8fERNjEp3lwKwpxhg7ELjV6ptCbNKNc:3xvAwfsnbkh3nO7RyP8fERxEpleyCf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 421KB

file.exe

IMPHASH 2ff60b2f756b6533c2643b340c02a5bb
SHA256 bd367c0b495bdaf49adba791decda194c55a5403880a152ec113c7e61fecbf8d
MD5 5053e768c65b528396e53ae8ec181c4c
SHA1 f53250c26cdb5cc58347e0bbc5a820f1bb1e263e
SHA512 3829615a1b53e8a2023ff7478f5bda6e83dae591ffbae52f8a4c5fa13ad0542617e2197d8c2baa84d2fafad071257f3525c96c5e954514b14cedf9f5008e1daa
SSDEEP 6144:3xvAL9OfhSnbkJ73nOu2XRNUS5p4F8fERNjEp3lwKwpxhg7ELjV6ptCbNKNc:3xvAwfsnbkh3nO7RyP8fERxEpleyCf
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19550

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceExW BuildCommDCBAndTimeoutsA EndUpdateResourceW GetCommState ReadConsoleA GetCurrentProcess QueryDosDeviceA SetHandleInformation GetWindowsDirectoryA GetGeoInfoW GetDateFormatA SetProcessPriorityBoost GlobalAlloc EnumResourceLanguagesA LCMapStringA InterlockedExchange GetCPInfoExW GetLastError lstrcpynA GetProcAddress VirtualAlloc EnumSystemCodePagesW SetTimerQueueTimer LoadLibraryA WriteConsoleA AddAtomW GetCommMask FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA GetConsoleCursorInfo ReadConsoleInputW TerminateJobObject GetTempPathA GlobalReAlloc IsBadStringPtrW WriteConsoleOutputCharacterW SetLastError GetComputerNameA LCMapStringW GetStartupInfoW HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointA

advapi32

ReportEventW

ole32

ReadClassStm

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

188KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.riy

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.hojosic

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ