file[.]exe | Triage™

General

Target
file.exe
Size 197KB
Sample230213-m31ddscg45
SHA256 ea90e9a64e47feec4e20a41bc22ea2aca6fb0d16eb133d8ac6265d9d71981425
MD5 792018486680014dbde50ad58dd925f3
SHA1 ab781343e5b3ece458f6950accd1d5bf42b5172e
SHA512 2b46aae6220700bd994e20b0fdc89d97a076bbfc6b85a1554499c192c8ee8b713c31fc18934183e11df3873be1481256c5ec91fd99d6fb67bbc09a62f8b0fe2e
SSDEEP 3072:RvcUKbth3RgdwaI+5Gew8hhx3A6Pve6bTE6Mqd10VWG+f9iIbx/5nzzlC13eK13N:RvrGE9IeGew8hhxAQbH0+9iYVNZC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 197KB

file.exe

IMPHASH 209f9c826abdd7bbdb83ab4abd6db0b8
SHA256 ea90e9a64e47feec4e20a41bc22ea2aca6fb0d16eb133d8ac6265d9d71981425
MD5 792018486680014dbde50ad58dd925f3
SHA1 ab781343e5b3ece458f6950accd1d5bf42b5172e
SHA512 2b46aae6220700bd994e20b0fdc89d97a076bbfc6b85a1554499c192c8ee8b713c31fc18934183e11df3873be1481256c5ec91fd99d6fb67bbc09a62f8b0fe2e
SSDEEP 3072:RvcUKbth3RgdwaI+5Gew8hhx3A6Pve6bTE6Mqd10VWG+f9iIbx/5nzzlC13eK13N:RvrGE9IeGew8hhxAQbH0+9iYVNZC
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

35661

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA CreateFileW FindActCtxSectionStringW WriteConsoleInputW GetCPInfoExA GetWindowsDirectoryW FindFirstVolumeMountPointW CreateDirectoryExA LocalFlags WaitForMultipleObjects ReadConsoleInputA VerifyVersionInfoW GetVersionExA GetProcessId OpenEventW CreateFileMappingW GetLocaleInfoW GetProcAddress LocalAlloc GetCommandLineA GetUserDefaultLCID OpenMutexW GetConsoleTitleA SearchPathA GetPriorityClass GetLastError GetProfileSectionW WriteProfileStringW GetConsoleAliasW WritePrivateProfileSectionW GlobalFlags GetConsoleAliasesLengthA FindResourceA SetVolumeMountPointW GetModuleHandleA HeapAlloc GetComputerNameA GetCurrentProcessId CreateNamedPipeW EnumResourceLanguagesW TransactNamedPipe _hwrite EnumTimeFormatsW ZombifyActCtx DeleteVolumeMountPointA ReleaseActCtx WritePrivateProfileStringA GetSystemDirectoryA GetSystemPowerStatus SetThreadAffinityMask GetLongPathNameA EnumTimeFormatsA EnumCalendarInfoA FindNextFileA SetLastError SetCriticalSectionSpinCount ReadFile WriteConsoleW RaiseException RtlUnwind HeapFree MoveFileA DeleteFileA GetCommandLineW HeapSetInformation GetStartupInfoW EncodePointer DecodePointer IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection ExitProcess WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime Sleep HeapSize WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW HeapReAlloc CloseHandle

user32

GetComboBoxInfo

Sharing