file[.]exe | Triage™

General

Target
file.exe
Size 178KB
Sample230214-nat7cach48
SHA256 6e2f7726ce14f9bd1d6d803e1ebea5e63df1c270c67d4e4812bd6ae6cad16ca8
MD5 ab2c6b2cee949fb8dbed37b50e6da8fa
SHA1 eb77b7f60eb906206485f75a44075472cfc73e30
SHA512 77f443d90acde722f57796bf5c5e82cf2d803c724538835a2239e9c69a0f491d4bc265e58ea894cd80e2b8021a0f4b60ee97f5fd56866157d944b1469fded088
SSDEEP 3072:2o53LZLT5nnKQlvXl7o+BniPr9xTbFTC5yltIOS+3Q2cfOa:1VLZLNnKQlflosij9xTZTRXzSMQhF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 178KB

file.exe

IMPHASH 798e86ce43c6c756580e060a65d134f9
SHA256 6e2f7726ce14f9bd1d6d803e1ebea5e63df1c270c67d4e4812bd6ae6cad16ca8
MD5 ab2c6b2cee949fb8dbed37b50e6da8fa
SHA1 eb77b7f60eb906206485f75a44075472cfc73e30
SHA512 77f443d90acde722f57796bf5c5e82cf2d803c724538835a2239e9c69a0f491d4bc265e58ea894cd80e2b8021a0f4b60ee97f5fd56866157d944b1469fded088
SSDEEP 3072:2o53LZLT5nnKQlvXl7o+BniPr9xTbFTC5yltIOS+3Q2cfOa:1VLZLNnKQlflosij9xTZTRXzSMQhF
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19753

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetMailslotInfo GetModuleHandleW GetTickCount GetCommConfig GetCurrentThread GetNumberFormatA GetGeoInfoW GlobalAlloc GetSystemDirectoryW LoadLibraryW ReadConsoleInputA DeleteVolumeMountPointW HeapCreate GetBinaryTypeA GetMailslotInfo CreateActCtxA GetStartupInfoA FillConsoleOutputCharacterW GetLastError GetProcAddress VirtualAlloc DisableThreadLibraryCalls ProcessIdToSessionId GetProcessWorkingSetSize CreateEventW GetNumberOfConsoleMouseButtons FindFirstChangeNotificationA HeapSetInformation FreeEnvironmentStringsW GetConsoleTitleW RequestWakeupLatency GetFileAttributesExW GetVersionExA FileTimeToLocalFileTime GetCurrentProcessId MoveFileWithProgressW GetTempPathA ReadConsoleOutputCharacterW LCMapStringW GetLocaleInfoA GetStringTypeW GetStringTypeA CopyFileExW InterlockedIncrement RemoveDirectoryW MultiByteToWideChar WideCharToMultiByte TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType DeleteCriticalSection VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA

user32

IsCharAlphaNumericA RealGetWindowClassW RealChildWindowFromPoint IsChild NotifyWinEvent LoadMenuA GetCursorInfo CharUpperW CharLowerBuffA ClipCursor GetKeyNameTextW

advapi32

LogonUserW ReportEventA IsValidAcl

ole32

CoRegisterMallocSpy

Sharing