file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 421KB
Sample230203-bxdfwshf64
SHA256 5038afc9317be5ae2bd3bfeda959b82a085f2b3c52d14df2b76fc09aa3352307
MD5 7ae178f4d0825f84851e172ef5718b1e
SHA1 f19ebecf5fea973803f5a41bb7bfe7c48a5a459c
SHA512 f1c12b2d00db498d9e78908428dd4f8b520ccd19b06a86d0f6dff96186d9365efaf23e4dad0ed1aa20ce7d3790d126d56b268a5d4d614757d26e80d8a30289a1
SSDEEP 6144:7hItLzMLGn0XFySOZXr96lbLYuYa3lwKwpxXjV6ptCbNKN:7hIt3M60Vli7uQneleL
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 421KB

file.exe

IMPHASH 8da36f6dce34183aedb624e434f46f7f
SHA256 5038afc9317be5ae2bd3bfeda959b82a085f2b3c52d14df2b76fc09aa3352307
MD5 7ae178f4d0825f84851e172ef5718b1e
SHA1 f19ebecf5fea973803f5a41bb7bfe7c48a5a459c
SHA512 f1c12b2d00db498d9e78908428dd4f8b520ccd19b06a86d0f6dff96186d9365efaf23e4dad0ed1aa20ce7d3790d126d56b268a5d4d614757d26e80d8a30289a1
SSDEEP 6144:7hItLzMLGn0XFySOZXr96lbLYuYa3lwKwpxXjV6ptCbNKN:7hIt3M60Vli7uQneleL
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19478

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteConsoleOutputCharacterA EndUpdateResourceW GetCommState ReadConsoleA GetCurrentProcess SetHandleInformation GetWindowsDirectoryA GetGeoInfoW GetDateFormatA SetProcessPriorityBoost GlobalAlloc IsProcessInJob EnumResourceLanguagesA GetTempPathW LCMapStringA InterlockedExchange GetCPInfoExW GetLastError FindResourceExW VirtualAlloc EnumSystemCodePagesW SetTimerQueueTimer LoadLibraryA WriteConsoleA BuildCommDCBAndTimeoutsW AddAtomW QueryDosDeviceW GetCommMask FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA GetConsoleCursorInfo ReadConsoleInputW GlobalReAlloc IsBadStringPtrW lstrcpynA GetProcAddress GetComputerNameA LCMapStringW GetStartupInfoW HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointW

advapi32

ReportEventW

ole32

ReadClassStm

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

188KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.zofi

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fedam

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ