file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 321KB
Sample230206-twdpdaeg98
SHA256 b1174532d2b70144c1f9a18b4bfb2fe33e27cfe75608508ce1ddde0ecad51508
MD5 283ca6b9729a764872c84df0203e87f2
SHA1 e45f93053ee0d1d58caca373a0701f2ad7e04485
SHA512 f5ca0cab39ec5ea66e4640347e425daf2636efafbb2c66819c221711be7fd47302e06eae665343dbb0de02196a99d41108580b37e45340024ec2188d21c3cecc
SSDEEP 6144:G5Lrgy0YVu5/A1s/4o6fd8m2guQj9w4JgPaMc:G5PgYuG2AoSd8Slj6Ta
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 321KB

file.exe

IMPHASH ed881b7f770873f8ac396ee0fe0bd4cf
SHA256 b1174532d2b70144c1f9a18b4bfb2fe33e27cfe75608508ce1ddde0ecad51508
MD5 283ca6b9729a764872c84df0203e87f2
SHA1 e45f93053ee0d1d58caca373a0701f2ad7e04485
SHA512 f5ca0cab39ec5ea66e4640347e425daf2636efafbb2c66819c221711be7fd47302e06eae665343dbb0de02196a99d41108580b37e45340024ec2188d21c3cecc
SSDEEP 6144:G5Lrgy0YVu5/A1s/4o6fd8m2guQj9w4JgPaMc:G5PgYuG2AoSd8Slj6Ta
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

25839

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommState GetCurrentProcess GetComputerNameW GetTickCount ReadConsoleW GetWindowsDirectoryA SetProcessPriorityBoost FindResourceExA IsProcessInJob ReadConsoleInputA GetSystemWindowsDirectoryA EnumSystemCodePagesA CreateSemaphoreA GetGeoInfoA IsBadStringPtrA GetTempPathW LCMapStringA InterlockedIncrement GetProcAddress VirtualAlloc LoadLibraryA GetProcessWorkingSetSize LocalAlloc BuildCommDCBAndTimeoutsW QueryDosDeviceW GetCommMask AddAtomA FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA EndUpdateResourceA DeleteTimerQueueTimer SetLocaleInfoA lstrcpynA GetLastError GetDateFormatW LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapAlloc HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointW

advapi32

ReportEventW

ole32

ReadClassStg

Name

.text

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kereze

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pupe

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cawure

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ