file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 319KB
Sample230206-tmc2gsaa4x
SHA256 9a5332f62b382da141cb5e72abe6b48f2b293e7f97367da0981908cdac532daf
MD5 34482ccfec4adc294c97920e46b19bc9
SHA1 4e5aa8da8bd593e4e9de724b3968cf1ac3e2136d
SHA512 364fb66e09667583a6041481b256cca3ada25feaeec632aea8c1213f8e24904740511208dc37821f67951cb5aed57688ffc294cc2f73d1948754991f19be3882
SSDEEP 3072:fzr/FLF5LbR60YDprphzm1gxHAMJV9KMm/LC1//+sxA7r09BOdMsjV:rRLrLg0YdrbSyNAYHKxjClRkcwjV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 319KB

file.exe

IMPHASH ed881b7f770873f8ac396ee0fe0bd4cf
SHA256 9a5332f62b382da141cb5e72abe6b48f2b293e7f97367da0981908cdac532daf
MD5 34482ccfec4adc294c97920e46b19bc9
SHA1 4e5aa8da8bd593e4e9de724b3968cf1ac3e2136d
SHA512 364fb66e09667583a6041481b256cca3ada25feaeec632aea8c1213f8e24904740511208dc37821f67951cb5aed57688ffc294cc2f73d1948754991f19be3882
SSDEEP 3072:fzr/FLF5LbR60YDprphzm1gxHAMJV9KMm/LC1//+sxA7r09BOdMsjV:rRLrLg0YdrbSyNAYHKxjClRkcwjV
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25839

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommState GetCurrentProcess GetComputerNameW GetTickCount ReadConsoleW GetWindowsDirectoryA SetProcessPriorityBoost FindResourceExA IsProcessInJob ReadConsoleInputA GetSystemWindowsDirectoryA EnumSystemCodePagesA CreateSemaphoreA GetGeoInfoA IsBadStringPtrA GetTempPathW LCMapStringA InterlockedIncrement GetProcAddress VirtualAlloc LoadLibraryA GetProcessWorkingSetSize LocalAlloc BuildCommDCBAndTimeoutsW QueryDosDeviceW GetCommMask AddAtomA FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA EndUpdateResourceA DeleteTimerQueueTimer SetLocaleInfoA lstrcpynA GetLastError GetDateFormatW LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointW

advapi32

ReportEventW

ole32

ReadClassStg

Name

.text

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

91KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fuci

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sagihol

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.biz

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ