file[.]exe | Triage™

General

Target
file.exe
Size 274KB
Sample230214-sdwa2adf6v
SHA256 c44fdab96164bfa9e4a50fd9018d28a783557d9cc778ff9e953b60efe1e1e2ec
MD5 cfc5b91e4364ab4f6d7d68f739e9c17d
SHA1 0df1053c45fd5befada3d0e50f9c865c15acf043
SHA512 ccd8340c0d4ee433b427051608e8ead14132566d881bf9a2d0129bee21a0ff6fcf5b829d74f874dad30e588f807e74ddbc2a9db5cc4c399f42e2f635639837e6
SSDEEP 6144:Jp1L+63CPr3N2u8m+pXjblxI5finCNrWFMlOcnTwTYjJsd:Jp1t3Kr3z+B/XsfiArIMlFnljJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 274KB

file.exe

IMPHASH 17104dba2e0e802750207f94b99930de
SHA256 c44fdab96164bfa9e4a50fd9018d28a783557d9cc778ff9e953b60efe1e1e2ec
MD5 cfc5b91e4364ab4f6d7d68f739e9c17d
SHA1 0df1053c45fd5befada3d0e50f9c865c15acf043
SHA512 ccd8340c0d4ee433b427051608e8ead14132566d881bf9a2d0129bee21a0ff6fcf5b829d74f874dad30e588f807e74ddbc2a9db5cc4c399f42e2f635639837e6
SSDEEP 6144:Jp1L+63CPr3N2u8m+pXjblxI5finCNrWFMlOcnTwTYjJsd:Jp1t3Kr3z+B/XsfiArIMlFnljJ
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19161

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesExA MoveFileWithProgressA GetModuleHandleW GetTickCount GetCommConfig GetCurrentThread GetGeoInfoW GlobalAlloc GetSystemDirectoryW ReadConsoleInputA CreateEventA DeleteVolumeMountPointW GetBinaryTypeA GetMailslotInfo CreateActCtxA LCMapStringA GetStartupInfoA GetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc DisableThreadLibraryCalls LoadLibraryA SetMailslotInfo UnhandledExceptionFilter GetProcessWorkingSetSize GetNumberFormatW RemoveDirectoryW FindFirstChangeNotificationA HeapSetInformation GetConsoleTitleW RequestWakeupLatency GetVersionExA FileTimeToLocalFileTime GetCurrentProcessId GetTempPathA CopyFileExA GetLocaleInfoA InterlockedIncrement ProcessIdToSessionId FillConsoleOutputCharacterA GetStringTypeW GetStringTypeA TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize InitializeCriticalSectionAndSpinCount WideCharToMultiByte MultiByteToWideChar LCMapStringW

user32

GetKeyNameTextW RealChildWindowFromPoint IsChild RealGetWindowClassA LoadMenuA GetCursorInfo CharUpperW CharLowerBuffA ClipCursor

advapi32

LogonUserW IsValidAcl ReportEventA

ole32

CoRegisterMallocSpy

Sharing