file[.]exe | Triage™

General

Target
file.exe
Size 194KB
Sample230215-db6xeshc81
SHA256 d0fc3833c4afe9b5ff6bada0b6ff6f59cd82b0a16f69cdcee9ad85505880bead
MD5 c2bef42259e0d14b06d0dcb76cc14405
SHA1 0cadfa4aafe30624ed188dd46b07ffe64039b06a
SHA512 d595cbae7e60afd022c216c8c6632862ca6d9172681eaa6616f2a65ddf46e55e3c1b9575dcc16560e64c5b292a77672cb9a1b756fd4c7cc576bb686531b99812
SSDEEP 3072:dGN5bGLznBn65aehNDNVq/ynuTgxxjY7Vl/EiC7KVLLXHLPP:pLzBnh4/znig/+PJ7PP
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 194KB

file.exe

IMPHASH 4e0db68663e7214680ba4f7cafdd65a1
SHA256 d0fc3833c4afe9b5ff6bada0b6ff6f59cd82b0a16f69cdcee9ad85505880bead
MD5 c2bef42259e0d14b06d0dcb76cc14405
SHA1 0cadfa4aafe30624ed188dd46b07ffe64039b06a
SHA512 d595cbae7e60afd022c216c8c6632862ca6d9172681eaa6616f2a65ddf46e55e3c1b9575dcc16560e64c5b292a77672cb9a1b756fd4c7cc576bb686531b99812
SSDEEP 3072:dGN5bGLznBn65aehNDNVq/ynuTgxxjY7Vl/EiC7KVLLXHLPP:pLzBnh4/znig/+PJ7PP
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

19720

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement SystemTimeToFileTime SetMailslotInfo GetFileAttributesExA MoveFileWithProgressA GetModuleHandleW GetTickCount GetCurrentThread SetFileShortNameW ReadConsoleInputA CreateEventA GetBinaryTypeA GetGeoInfoA GetMailslotInfo GetSystemDirectoryA CreateActCtxA GetACP GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc DisableThreadLibraryCalls LoadLibraryA DeleteVolumeMountPointA UnhandledExceptionFilter GetProcessWorkingSetSize LocalAlloc IsSystemResumeAutomatic GetNumberFormatW RemoveDirectoryW GetModuleHandleA FindFirstChangeNotificationA HeapSetInformation GetConsoleTitleW GetVersionExA GetVolumeNameForVolumeMountPointW GetCurrentProcessId GetTempPathA CopyFileExA InitializeCriticalSectionAndSpinCount HeapSize HeapReAlloc MapUserPhysicalPages FillConsoleOutputCharacterA GetNumaProcessorNode MultiByteToWideChar TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind GetCPInfo InterlockedDecrement GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapAlloc HeapFree Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW LeaveCriticalSection EnterCriticalSection GetLocaleInfoA

user32

GetKeyNameTextW IsChild RealGetWindowClassA LoadMenuA CharUpperA CharLowerBuffW GetCursorInfo CharLowerBuffA ClipCursor

advapi32

LogonUserW ReportEventA IsValidAcl

ole32

CoRevokeMallocSpy

Sharing