file[.]exe | Triage™

General

Target
file.exe
Size 310KB
Sample230216-d2216afc2v
SHA256 e4c36dbf9f0fcd8cd2c61cc05c1230f1ebfc991ae3476e080102403100763bb4
MD5 5432af3b354ec4165d88443c06f8f5da
SHA1 f7904ffa9153241738b6224ccf09a8f3299dcca8
SHA512 ab923d5dcadefed18007c71ad6fc0190b70419fbdbf47e56c5d3b8ba79f57ce20ed3c78c95d746a4616d440261efeea97273807acc0b4a94d6d6ad64b74fa7fb
SSDEEP 6144:Avu3PwbwD7JwzB11154dkfmdIeFkpPUmzGgExKtPGd:Am1D7JybH54dkfmoRi6tPG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 310KB

file.exe

IMPHASH e4a81217ceeca700511172936e540786
SHA256 e4c36dbf9f0fcd8cd2c61cc05c1230f1ebfc991ae3476e080102403100763bb4
MD5 5432af3b354ec4165d88443c06f8f5da
SHA1 f7904ffa9153241738b6224ccf09a8f3299dcca8
SHA512 ab923d5dcadefed18007c71ad6fc0190b70419fbdbf47e56c5d3b8ba79f57ce20ed3c78c95d746a4616d440261efeea97273807acc0b4a94d6d6ad64b74fa7fb
SSDEEP 6144:Avu3PwbwD7JwzB11154dkfmdIeFkpPUmzGgExKtPGd:Am1D7JybH54dkfmoRi6tPG
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

44439

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA CreateFileA FindActCtxSectionGuid WriteConsoleInputA GetWindowsDirectoryA FindFirstVolumeMountPointA CreateDirectoryExW GlobalFlags WaitForSingleObject ReadConsoleInputA VerifyVersionInfoW GetVersionExA GetCurrentProcess OpenEventW CreateFileMappingA GetLocaleInfoW GetProcAddress LoadLibraryA GlobalAlloc DeleteTimerQueueTimer GetConsoleTitleA CopyFileA FindResourceA SetPriorityClass SetLastError GetProfileSectionW WriteProfileStringW GetConsoleAliasA WritePrivateProfileSectionA SetVolumeMountPointW EnumResourceLanguagesW TransactNamedPipe _hread EnumDateFormatsW ActivateActCtx DeleteVolumeMountPointA WritePrivateProfileStringA GetSystemDirectoryA GetStringTypeA GetLongPathNameA FindNextFileW EnumCalendarInfoA LocalAlloc ReleaseActCtx SetCriticalSectionSpinCount SetFilePointer WriteConsoleW LoadLibraryW FlushFileBuffers GetConsoleMode GetConsoleCP InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapFree RtlUnwind RaiseException DeleteFileA GetCommandLineW HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo HeapAlloc IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetCurrentThreadId GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess CloseHandle ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW HeapReAlloc HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle CreateFileW

user32

GetMenuBarInfo GetMessageTime

shell32

FindExecutableA

ole32

CoGetInstanceFromIStorage

Name

.text

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

182KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xayuca

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kipu

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tife

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dot

Size

512B

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

shell32

ole32