file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 305KB
Sample230206-kdkkjacg69
SHA256 6206cdaaacfd8a67b3311a6b4f69e6ee2e423bcab32b517647f4a594df569d3b
MD5 5d82d6c7b40ed7c19260ea7ade303f20
SHA1 de0edd14c7771ccb6be82994ea66e4fb6f617f65
SHA512 d2c3858c86b57eec643aeca7ca2edbb740e4afb77710b28399eb8efde86fd1ade586fea44a23c9ea1cb7177f93654e83ba43d69d15ef1642d92ee825c13bd40c
SSDEEP 3072:BNFbtJPL0+gF/RqcMRQq04Rg0oDpxG+UYOvwcQTUNP9sxA76ov3uo/MRUT:XBPLr68c8oPDjRMwcQT2Puk6om
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 305KB

file.exe

IMPHASH 13dc564127b9f6b618808536c7e12f68
SHA256 6206cdaaacfd8a67b3311a6b4f69e6ee2e423bcab32b517647f4a594df569d3b
MD5 5d82d6c7b40ed7c19260ea7ade303f20
SHA1 de0edd14c7771ccb6be82994ea66e4fb6f617f65
SHA512 d2c3858c86b57eec643aeca7ca2edbb740e4afb77710b28399eb8efde86fd1ade586fea44a23c9ea1cb7177f93654e83ba43d69d15ef1642d92ee825c13bd40c
SSDEEP 3072:BNFbtJPL0+gF/RqcMRQq04Rg0oDpxG+UYOvwcQTUNP9sxA76ov3uo/MRUT:XBPLr68c8oPDjRMwcQT2Puk6om
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

23699

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceExW EndUpdateResourceW GetCommState ReadConsoleA GetCurrentProcess SetHandleInformation GetWindowsDirectoryA GetDateFormatA SetProcessPriorityBoost GlobalAlloc IsProcessInJob CreateSemaphoreA GetGeoInfoA GetTempPathW LCMapStringA InterlockedExchange lstrcpynA GetProcAddress VirtualAlloc EnumSystemCodePagesW SetTimerQueueTimer LoadLibraryA GetProcessWorkingSetSize BuildCommDCBAndTimeoutsW QueryDosDeviceW GetCommMask AddAtomA FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA ReadConsoleInputW SetLocaleInfoA IsBadStringPtrW GetLastError GetComputerNameA LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointW

advapi32

ReportEventW

ole32

WriteClassStg

Name

.text

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

91KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.koz

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fatiz

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ