file[.]exe | Triage™

General

Target
file.exe
Size 205KB
Sample230216-fj5qfaff21
SHA256 aac70bf337cfe79c19c2cf03955b742205d73c23e779ffe38694fc284f275393
MD5 aa5dfeeb4aa25de41501d771c89c3156
SHA1 a9f730b9f5f7fb55f013d10480fc46a8b5924fd0
SHA512 b27fbf30a38769e7aa6bd3bb6d619589550ec5bc7715ff6013a9e190272312bcda464a77da47b5aab862dec16f31354d28ec7ba0ebfe214e6fcbc0145fb91e34
SSDEEP 3072:Hv0ydF24MkoTO5L8YXlaEajJO3Km8CF2QSSxP6eeBuUL9zrLWQ:Hcydqa5t0EfZMQSeP6eeB7Rj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 205KB

file.exe

IMPHASH e4a81217ceeca700511172936e540786
SHA256 aac70bf337cfe79c19c2cf03955b742205d73c23e779ffe38694fc284f275393
MD5 aa5dfeeb4aa25de41501d771c89c3156
SHA1 a9f730b9f5f7fb55f013d10480fc46a8b5924fd0
SHA512 b27fbf30a38769e7aa6bd3bb6d619589550ec5bc7715ff6013a9e190272312bcda464a77da47b5aab862dec16f31354d28ec7ba0ebfe214e6fcbc0145fb91e34
SSDEEP 3072:Hv0ydF24MkoTO5L8YXlaEajJO3Km8CF2QSSxP6eeBuUL9zrLWQ:Hcydqa5t0EfZMQSeP6eeB7Rj
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

44455

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA CreateFileA FindActCtxSectionGuid WriteConsoleInputA GetWindowsDirectoryA FindFirstVolumeMountPointA CreateDirectoryExW GlobalFlags WaitForSingleObject ReadConsoleInputA VerifyVersionInfoW GetVersionExA GetCurrentProcess OpenEventW CreateFileMappingA GetLocaleInfoW GetProcAddress LoadLibraryA GlobalAlloc DeleteTimerQueueTimer GetConsoleTitleA CopyFileA FindResourceA SetPriorityClass SetLastError GetProfileSectionW WriteProfileStringW GetConsoleAliasA WritePrivateProfileSectionA SetVolumeMountPointW EnumResourceLanguagesW TransactNamedPipe _hread EnumDateFormatsW ActivateActCtx DeleteVolumeMountPointA WritePrivateProfileStringA GetSystemDirectoryA GetStringTypeA GetLongPathNameA FindNextFileW EnumCalendarInfoA LocalAlloc ReleaseActCtx SetCriticalSectionSpinCount SetFilePointer WriteConsoleW LoadLibraryW FlushFileBuffers GetConsoleMode GetConsoleCP InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapFree RtlUnwind RaiseException DeleteFileA GetCommandLineW HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo HeapAlloc IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetCurrentThreadId GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess CloseHandle ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW HeapReAlloc HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle CreateFileW

user32

GetMenuBarInfo GetMessageTime

shell32

FindExecutableA

ole32

CoGetInstanceFromIStorage

Name

.text

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bavifi

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gafo

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xahi

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xajigu

Size

512B

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

shell32

ole32