file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 253KB
Sample230216-trclhsab6v
SHA256 02bba5bcdd9396b1fa6ff1f9ebb9151f070d74c33555f27147dbb481d8f3e92d
MD5 26d0f5ae9293c0f6a32a248015d3a7d4
SHA1 8269c728626c8b50d6c4a6dedf8f68d64f89827c
SHA512 36cf46d3aa7104c01b824240849e402d741a7a85b6241c18cde3a040c70dd6b64b5f95c93041e5e50e18f1654facea676719c272ea0425ddbba4efa79f5a4d45
SSDEEP 3072:4eiuLj5UGEEm5uurHG8DRRuqQ4SBkgBbwVC4eHPVW8E:rlLVE2uaGR4q/SDPBHT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 253KB

file.exe

IMPHASH 84dc6e6219363c02153241783e4708b9
SHA256 02bba5bcdd9396b1fa6ff1f9ebb9151f070d74c33555f27147dbb481d8f3e92d
MD5 26d0f5ae9293c0f6a32a248015d3a7d4
SHA1 8269c728626c8b50d6c4a6dedf8f68d64f89827c
SHA512 36cf46d3aa7104c01b824240849e402d741a7a85b6241c18cde3a040c70dd6b64b5f95c93041e5e50e18f1654facea676719c272ea0425ddbba4efa79f5a4d45
SSDEEP 3072:4eiuLj5UGEEm5uurHG8DRRuqQ4SBkgBbwVC4eHPVW8E:rlLVE2uaGR4q/SDPBHT
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

26943

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MapUserPhysicalPages DeleteVolumeMountPointA InterlockedIncrement WriteConsoleInputA GetFileAttributesExA GetModuleHandleW GetCurrentThread GetConsoleAliasesA GetNumberFormatA GetGeoInfoW CreateActCtxW LoadLibraryW GetConsoleAliasExesLengthW GetMailslotInfo GetBinaryTypeW GetACP GetLastError SetLastError GetProcAddress VirtualAlloc RemoveDirectoryA PrepareTape WriteConsoleA UnhandledExceptionFilter GetNumaProcessorNode InterlockedExchangeAdd OpenWaitableTimerW LocalAlloc IsSystemResumeAutomatic GetDiskFreeSpaceA OpenJobObjectW SetConsoleCursorInfo GetModuleHandleA HeapSetInformation EraseTape GetConsoleTitleW FatalAppExitA SetFileShortNameA GetVersionExA GetCurrentProcessId MoveFileWithProgressW InitializeCriticalSectionAndSpinCount LoadLibraryA HeapReAlloc FindFirstChangeNotificationW GetNativeSystemInfo GetProcessWorkingSetSize GetLocaleInfoA MultiByteToWideChar TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind GetCPInfo InterlockedDecrement GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapAlloc HeapFree Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW LeaveCriticalSection EnterCriticalSection

user32

GetClipCursor GetCursorInfo SetCaretPos GetKeyNameTextW RealGetWindowClassW IsChild LoadMenuA CharLowerBuffW CharUpperA CharUpperBuffA

advapi32

MapGenericMask LogonUserW ReportEventA

ole32

ReadClassStg CoRevokeMallocSpy

winhttp

WinHttpCheckPlatform