file[.]exe | Triage™

General

Target
file.exe
Size 311KB
Sample230215-1w649aed68
SHA256 f5ea4f83a55c4da033fb68db2f3b06c3034755e8f2fdbddf402ec4744a8b586d
MD5 46ad5b4e812230b6bfc53cd0c726e357
SHA1 ff6f3e207d1b499360fdb428270d46136842ad19
SHA512 c0db918cb823b22ed1ac67f0ef521d64ab67573ec40400ad705ddd993c781edcded275d5387c9abee41c8b343af0ff1e17cd1e43208137f59f3222d96c743747
SSDEEP 6144:ZUgwcFG+PSMGEispszYpi6jnj32mNMgb4+0KxXt9G6Aw6NZe:ZUreSMfiws8AYLBagH0ARKZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 311KB

file.exe

IMPHASH 308f6e5717c80fbda640d081ccf649e4
SHA256 f5ea4f83a55c4da033fb68db2f3b06c3034755e8f2fdbddf402ec4744a8b586d
MD5 46ad5b4e812230b6bfc53cd0c726e357
SHA1 ff6f3e207d1b499360fdb428270d46136842ad19
SHA512 c0db918cb823b22ed1ac67f0ef521d64ab67573ec40400ad705ddd993c781edcded275d5387c9abee41c8b343af0ff1e17cd1e43208137f59f3222d96c743747
SSDEEP 6144:ZUgwcFG+PSMGEispszYpi6jnj32mNMgb4+0KxXt9G6Aw6NZe:ZUreSMfiws8AYLBagH0ARKZ
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

45459

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA CreateFileA FindActCtxSectionGuid WriteConsoleInputA GetCPInfoExW GetWindowsDirectoryA FindFirstVolumeMountPointA CreateDirectoryExW GlobalFlags WaitForSingleObject ReadConsoleInputW VerifyVersionInfoW GetVersionExA GetCurrentProcess OpenEventW CreateFileMappingA GetLocaleInfoW GetProcAddress LoadLibraryA GlobalAlloc DeleteTimerQueueTimer GetConsoleTitleW CopyFileA SetPriorityClass SetLastError GetProfileSectionA WriteProfileStringW GetConsoleAliasA WritePrivateProfileSectionA GetConsoleAliasesLengthA FindResourceA SetVolumeMountPointW GetModuleHandleW HeapAlloc GetThreadLocale GetProcessId CreateNamedPipeW EnumResourceLanguagesA TransactNamedPipe _hread EnumDateFormatsW ActivateActCtx DeleteVolumeMountPointA AddRefActCtx WritePrivateProfileStringA GetSystemDirectoryA GetStringTypeW GetLongPathNameW EnumCalendarInfoW EnumCalendarInfoA FindNextFileW ReleaseActCtx SetCriticalSectionSpinCount CopyFileExA SetFilePointer WriteConsoleW LoadLibraryW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapFree RtlUnwind RaiseException DeleteFileA GetCommandLineW HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess CloseHandle ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapReAlloc HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW

user32

GetMessageTime GetListBoxInfo GetMenuBarInfo

shell32

FindExecutableA

ole32

CoGetInstanceFromIStorage

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

182KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mile

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bipij

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tij

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bugok

Size

512B

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

shell32

ole32