file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 396KB
Sample230206-2fcfdabd9s
SHA256 fae2b88ad0f4481f9de18459d8e7fc0385643b2a3ae84927a094ca9b793e6c7d
MD5 8b17cc544fa0b999f8f4ea975ce2dc55
SHA1 56e2b42214dd861953195dafc193371f676b8147
SHA512 160e0d6926d51170292d5e467e4efe9632e590ed77e2263d68f5dfde2d1e76bcfb68b63ad427a5d013211d0f74778da6a0aed887b9b6d24bd2cd020963162865
SSDEEP 6144:Ci9RLVpoN+bwZO0FzcLr4VP2rjret3LdCUObpuQj9qHOa:C0RReN6kOscv4J2QZCPFljGO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 396KB

file.exe

IMPHASH 362b00b7c7bfeb7a79c15e736bbb9859
SHA256 fae2b88ad0f4481f9de18459d8e7fc0385643b2a3ae84927a094ca9b793e6c7d
MD5 8b17cc544fa0b999f8f4ea975ce2dc55
SHA1 56e2b42214dd861953195dafc193371f676b8147
SHA512 160e0d6926d51170292d5e467e4efe9632e590ed77e2263d68f5dfde2d1e76bcfb68b63ad427a5d013211d0f74778da6a0aed887b9b6d24bd2cd020963162865
SSDEEP 6144:Ci9RLVpoN+bwZO0FzcLr4VP2rjret3LdCUObpuQj9qHOa:C0RReN6kOscv4J2QZCPFljGO
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19164

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement GetCommState GetCurrentProcess GetComputerNameW GetTickCount ReadConsoleW GetWindowsDirectoryA GetGeoInfoW SetProcessPriorityBoost GlobalAlloc IsProcessInJob GetSystemWindowsDirectoryA EnumSystemCodePagesA CreateSemaphoreA GetTempPathW LCMapStringA lstrcpynA GetLastError GetProcAddress VirtualAlloc LoadLibraryA GetProcessWorkingSetSize BuildCommDCBAndTimeoutsW GetCommMask AddAtomA FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA ReadConsoleInputW DeleteTimerQueueTimer SetLocaleInfoA IsBadStringPtrW GetDateFormatW LCMapStringW GetStringTypeW HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess GetStartupInfoW RtlUnwind HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointW

advapi32

ReportEventA

ole32

ReadClassStg

Name

.text

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

187KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nogefik

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vut

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vagiwit

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ