file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 252KB
Sample230216-ty8mjaae69
SHA256 b466be611c7dcbda603596a11d17aeaea5f717fa8eb7e450adf8dac4e58ec9f5
MD5 1170cb74565efdaa18f0ab25e07b322f
SHA1 a03b0d86293071df0ab70ad316faa1a3adf650c7
SHA512 9fa56d7cb51a72c68ae2c43799f0c09cc0befffb5a0c0836b1df3e4b10c2139312267fb67238928926beac89d09b8153070478b60066177e5d14bc7385881725
SSDEEP 3072:K9QoLi5UwKvm5uaFQCizRq6ab4BGzviyvMhg78oMeB6HPVcv8U:KxLoKxaFQZU6azUagoMeB6HqU
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 252KB

file.exe

IMPHASH 84dc6e6219363c02153241783e4708b9
SHA256 b466be611c7dcbda603596a11d17aeaea5f717fa8eb7e450adf8dac4e58ec9f5
MD5 1170cb74565efdaa18f0ab25e07b322f
SHA1 a03b0d86293071df0ab70ad316faa1a3adf650c7
SHA512 9fa56d7cb51a72c68ae2c43799f0c09cc0befffb5a0c0836b1df3e4b10c2139312267fb67238928926beac89d09b8153070478b60066177e5d14bc7385881725
SSDEEP 3072:K9QoLi5UwKvm5uaFQCizRq6ab4BGzviyvMhg78oMeB6HPVcv8U:KxLoKxaFQZU6azUagoMeB6HqU
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

26943

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MapUserPhysicalPages DeleteVolumeMountPointA InterlockedIncrement WriteConsoleInputA GetFileAttributesExA GetModuleHandleW GetCurrentThread GetConsoleAliasesA GetNumberFormatA GetGeoInfoW CreateActCtxW LoadLibraryW GetConsoleAliasExesLengthW GetMailslotInfo GetBinaryTypeW GetACP GetLastError SetLastError GetProcAddress VirtualAlloc RemoveDirectoryA PrepareTape WriteConsoleA UnhandledExceptionFilter GetNumaProcessorNode InterlockedExchangeAdd OpenWaitableTimerW LocalAlloc IsSystemResumeAutomatic GetDiskFreeSpaceA OpenJobObjectW SetConsoleCursorInfo GetModuleHandleA HeapSetInformation EraseTape GetConsoleTitleW FatalAppExitA SetFileShortNameA GetVersionExA GetCurrentProcessId MoveFileWithProgressW InitializeCriticalSectionAndSpinCount LoadLibraryA HeapReAlloc FindFirstChangeNotificationW GetNativeSystemInfo GetProcessWorkingSetSize GetLocaleInfoA MultiByteToWideChar TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind GetCPInfo InterlockedDecrement GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapAlloc HeapFree Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW LeaveCriticalSection EnterCriticalSection

user32

GetClipCursor GetCursorInfo SetCaretPos GetKeyNameTextW RealGetWindowClassW IsChild LoadMenuA CharLowerBuffW CharUpperA CharUpperBuffA

advapi32

MapGenericMask LogonUserW ReportEventA

ole32

ReadClassStg CoRevokeMallocSpy

winhttp

WinHttpCheckPlatform