file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 300KB
Sample230206-xdf9bsfc96
SHA256 219b99bc99eb5f9f345edb720629bb34422d16604316643a1d04f98cfee34638
MD5 6bb0339c7f458dc6eeb38080b0552c5f
SHA1 3f76fa5794d88dcb7a1bb187ed26bfce2d72b564
SHA512 9ad2e2d617ba539c5f50dbde9b74c322baf1a05fb32f7f1079801324aa99bdb6873f06b8079f5677ecac9aa4af2c49e2e24de106d694b5e92f63c1047a55cf2d
SSDEEP 3072:CwQb6bFIuLZJ4knRGvuCJRXWHei+/8Utnp3suQjiMTE5F+nyafM:CFG/LZH02CUG8a2uQj9Q+nya
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 300KB

file.exe

IMPHASH 51be71b2c29d21213553f83049808f1a
SHA256 219b99bc99eb5f9f345edb720629bb34422d16604316643a1d04f98cfee34638
MD5 6bb0339c7f458dc6eeb38080b0552c5f
SHA1 3f76fa5794d88dcb7a1bb187ed26bfce2d72b564
SHA512 9ad2e2d617ba539c5f50dbde9b74c322baf1a05fb32f7f1079801324aa99bdb6873f06b8079f5677ecac9aa4af2c49e2e24de106d694b5e92f63c1047a55cf2d
SSDEEP 3072:CwQb6bFIuLZJ4knRGvuCJRXWHei+/8Utnp3suQjiMTE5F+nyafM:CFG/LZH02CUG8a2uQj9Q+nya
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19164

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommState GetCurrentProcess GetComputerNameW GetTickCount ReadConsoleW GetWindowsDirectoryA SetProcessPriorityBoost GlobalAlloc IsProcessInJob ReadConsoleInputA GetSystemWindowsDirectoryA EnumSystemCodePagesA CreateSemaphoreA GetGeoInfoA IsBadStringPtrA GetTempPathW InterlockedIncrement GetLastError GetProcAddress VirtualAlloc LoadLibraryA GetProcessWorkingSetSize BuildCommDCBAndTimeoutsW GetCommMask AddAtomA FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA DeleteTimerQueueTimer SetLocaleInfoA lstrcpynA LCMapStringA GetDateFormatW LCMapStringW GetStringTypeW HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess GetStartupInfoW RtlUnwind HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointW

advapi32

ReportEventW

ole32

ReadClassStg

Name

.text

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.punu

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pije

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bevatal

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ