file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 418KB
Sample230206-sy682aef42
SHA256 3eb02f79b52f4fa22c7df52011e1890dd329a4447f292e04ab9f3d4f7f599a91
MD5 328d800c83bef383466183388b4a5d6f
SHA1 7f099b688cc5a1302d724511d08c864d867f2999
SHA512 7adb2c0b56e024070a488d5e9e4a9e839f5c549e096d5b8b86e46069d6f94e3c0474a43dcc6bfeb3e291010b4947e5689a43feafb83621727c7915eddae49bd9
SSDEEP 12288:l9MYoF5mpY+6fQwAKutjhN5Lcy+0f7mz:lL45kGAK6N5Lplf7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 418KB

file.exe

IMPHASH 3882a8c8bd30a928bed87b80b367efbc
SHA256 3eb02f79b52f4fa22c7df52011e1890dd329a4447f292e04ab9f3d4f7f599a91
MD5 328d800c83bef383466183388b4a5d6f
SHA1 7f099b688cc5a1302d724511d08c864d867f2999
SHA512 7adb2c0b56e024070a488d5e9e4a9e839f5c549e096d5b8b86e46069d6f94e3c0474a43dcc6bfeb3e291010b4947e5689a43feafb83621727c7915eddae49bd9
SSDEEP 12288:l9MYoF5mpY+6fQwAKutjhN5Lcy+0f7mz:lL45kGAK6N5Lplf7
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25887

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement GetCommState GetCurrentProcess SetHandleInformation GetComputerNameW GetTickCount ReadConsoleW GetWindowsDirectoryA SetProcessPriorityBoost FindResourceExA IsProcessInJob ReadConsoleInputA GetSystemWindowsDirectoryA EnumSystemCodePagesA CreateSemaphoreA GetGeoInfoA IsBadStringPtrA GetTempPathW EndUpdateResourceW GetLastError GetProcAddress VirtualAlloc LoadLibraryA GetProcessWorkingSetSize LocalAlloc BuildCommDCBAndTimeoutsW QueryDosDeviceW GetCommMask AddAtomA FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA DeleteTimerQueueTimer SetLocaleInfoA lstrcpynA LCMapStringA GetDateFormatW LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointW

advapi32

ReportEventW

ole32

ReadClassStg

Name

.text

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

188KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rik

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xasefo

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ