file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 253KB
Sample230216-3vmqbscf82
SHA256 f3023985d6f2ad22cfb6cb0635aef04b002a38e6da8b83ba970c9e34bcd8fdfe
MD5 a75c04cbe8a7bd50077ac3a012776cf9
SHA1 87a9d27689c1ff748043712d973ff19335b000ed
SHA512 7ff073c4e8a9ed7fe507d974f2e9ad462c214084c967918b0fad745fac05420eba3d201511f6de4b801d1fbfd5429519108572b92a23dfaf4e9ad9b699695ae6
SSDEEP 3072:tTFF2Lc5U7KmPfApndhk0wm2qsrAGJ17RkJZ5gw0lHFaY6HPVZRNkYE:BF8LZKFNdi0wmrSv4JZ5gTaY6HRlE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 253KB

file.exe

IMPHASH 99ff8bff99c874b1a1169c1f42931c72
SHA256 f3023985d6f2ad22cfb6cb0635aef04b002a38e6da8b83ba970c9e34bcd8fdfe
MD5 a75c04cbe8a7bd50077ac3a012776cf9
SHA1 87a9d27689c1ff748043712d973ff19335b000ed
SHA512 7ff073c4e8a9ed7fe507d974f2e9ad462c214084c967918b0fad745fac05420eba3d201511f6de4b801d1fbfd5429519108572b92a23dfaf4e9ad9b699695ae6
SSDEEP 3072:tTFF2Lc5U7KmPfApndhk0wm2qsrAGJ17RkJZ5gw0lHFaY6HPVZRNkYE:BF8LZKFNdi0wmrSv4JZ5gTaY6HRlE
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

26879

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteConsoleInputA MoveFileWithProgressA GetModuleHandleW GetCurrentThread GetConsoleAliasesA GetNumberFormatA GetGeoInfoW LoadLibraryW GetConsoleAliasExesLengthW GetVersionExW GetFileAttributesA GetMailslotInfo CreateActCtxA GetBinaryTypeW GetACP InterlockedExchange GetLastError GetProcAddress VirtualAlloc RemoveDirectoryA GetNumaHighestNodeNumber PrepareTape WriteConsoleA UnhandledExceptionFilter InterlockedExchangeAdd OpenWaitableTimerW LocalAlloc IsSystemResumeAutomatic GetDiskFreeSpaceA OpenJobObjectW SetConsoleCursorInfo GetModuleHandleA HeapSetInformation EraseTape GetStringTypeW GetConsoleTitleW FatalAppExitA SetFileShortNameA GetCurrentProcessId InitializeCriticalSectionAndSpinCount LoadLibraryA HeapReAlloc DeleteVolumeMountPointA MapUserPhysicalPages GetNativeSystemInfo GetProcessWorkingSetSize GetLocaleInfoA MultiByteToWideChar TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapAlloc HeapFree Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA LeaveCriticalSection EnterCriticalSection

user32

GetClipCursor GetCursorInfo SetCaretPos GetKeyNameTextW RealGetWindowClassW IsChild LoadMenuA CharLowerBuffW CharUpperA CharUpperBuffA

advapi32

ReportEventW SetKernelObjectSecurity MapGenericMask LogonUserA

ole32

CoUninitialize ReadClassStg

winhttp

WinHttpCheckPlatform