file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 396KB
Sample230207-ab15dsge63
SHA256 3e8b0fcddfa2383fa427f08cd54244694a1ead2dabf009910932fadc5de267da
MD5 affc0e6269af242f035e5b58dc639ea6
SHA1 9ac7d81ec1a0ad7ac79ff044e1c8708643ceaea8
SHA512 7d5d63ed0ccec9fc0a3a2d973ca3d79f473c390f275247a7ad6115b8524e1326534825713e3b5e22457577501b80ad99c84762423585a49b989b98ac5b87cb62
SSDEEP 6144:CdmHLnioziaHhAGQvqjuxDWs20l7cd40uQj9ga:CwHTZMvObs20yVlj2
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 396KB

file.exe

IMPHASH 362b00b7c7bfeb7a79c15e736bbb9859
SHA256 3e8b0fcddfa2383fa427f08cd54244694a1ead2dabf009910932fadc5de267da
MD5 affc0e6269af242f035e5b58dc639ea6
SHA1 9ac7d81ec1a0ad7ac79ff044e1c8708643ceaea8
SHA512 7d5d63ed0ccec9fc0a3a2d973ca3d79f473c390f275247a7ad6115b8524e1326534825713e3b5e22457577501b80ad99c84762423585a49b989b98ac5b87cb62
SSDEEP 6144:CdmHLnioziaHhAGQvqjuxDWs20l7cd40uQj9ga:CwHTZMvObs20yVlj2
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19164

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement GetCommState GetCurrentProcess GetComputerNameW GetTickCount ReadConsoleW GetWindowsDirectoryA GetGeoInfoW SetProcessPriorityBoost GlobalAlloc IsProcessInJob GetSystemWindowsDirectoryA EnumSystemCodePagesA CreateSemaphoreA GetTempPathW LCMapStringA lstrcpynA GetLastError GetProcAddress VirtualAlloc LoadLibraryA GetProcessWorkingSetSize BuildCommDCBAndTimeoutsW GetCommMask AddAtomA FoldStringW FoldStringA GetModuleHandleA BuildCommDCBA ReadConsoleInputW DeleteTimerQueueTimer SetLocaleInfoA IsBadStringPtrW GetDateFormatW LCMapStringW GetStringTypeW HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess GetStartupInfoW RtlUnwind HeapAlloc HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA WideCharToMultiByte GetStringTypeA MultiByteToWideChar

user32

LoadMenuA GetListBoxInfo

gdi32

GetTextExtentExPointW

advapi32

ReportEventA

ole32

ReadClassStg

Name

.text

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

187KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cijoxa

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.coca

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mexazi

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ