file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 348KB
Sample230216-xpr5zabc27
SHA256 9c02e9a54e16ca226fd6d902626e457a3bb2792b59f05160a3af1b2c799d997d
MD5 ab800a3649645935f145b7aa2011c8d6
SHA1 9b3a52b3c5962f0f8172001c22f8732b7600dfb8
SHA512 ae8aa4b377adcce36579bade94aaffebe511cff8f55dcd6ca195f1fa9dae38ff9f0c768cc5ac6fc1436d72c65ad3c8c2e176430dd916c3a6a2ceff2373f3cbb2
SSDEEP 6144:TOLhIiXp9idlMZ3f3Q/RzGr+JmWEwl0rM8/FfJEpgf9OL1bkmfyhHY:TOdIQcMZv3Q/R/JmqZ8S2Ygmm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 348KB

file.exe

IMPHASH 84dc6e6219363c02153241783e4708b9
SHA256 9c02e9a54e16ca226fd6d902626e457a3bb2792b59f05160a3af1b2c799d997d
MD5 ab800a3649645935f145b7aa2011c8d6
SHA1 9b3a52b3c5962f0f8172001c22f8732b7600dfb8
SHA512 ae8aa4b377adcce36579bade94aaffebe511cff8f55dcd6ca195f1fa9dae38ff9f0c768cc5ac6fc1436d72c65ad3c8c2e176430dd916c3a6a2ceff2373f3cbb2
SSDEEP 6144:TOLhIiXp9idlMZ3f3Q/RzGr+JmWEwl0rM8/FfJEpgf9OL1bkmfyhHY:TOdIQcMZv3Q/R/JmqZ8S2Ygmm
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

26943

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MapUserPhysicalPages DeleteVolumeMountPointA InterlockedIncrement WriteConsoleInputA GetFileAttributesExA GetModuleHandleW GetCurrentThread GetConsoleAliasesA GetNumberFormatA GetGeoInfoW CreateActCtxW LoadLibraryW GetConsoleAliasExesLengthW GetMailslotInfo GetBinaryTypeW GetACP GetLastError SetLastError GetProcAddress VirtualAlloc RemoveDirectoryA PrepareTape WriteConsoleA UnhandledExceptionFilter GetNumaProcessorNode InterlockedExchangeAdd OpenWaitableTimerW LocalAlloc IsSystemResumeAutomatic GetDiskFreeSpaceA OpenJobObjectW SetConsoleCursorInfo GetModuleHandleA HeapSetInformation EraseTape GetConsoleTitleW FatalAppExitA SetFileShortNameA GetVersionExA GetCurrentProcessId MoveFileWithProgressW InitializeCriticalSectionAndSpinCount LoadLibraryA HeapReAlloc FindFirstChangeNotificationW GetNativeSystemInfo GetProcessWorkingSetSize GetLocaleInfoA MultiByteToWideChar TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind GetCPInfo InterlockedDecrement GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapAlloc HeapFree Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW LeaveCriticalSection EnterCriticalSection

user32

GetClipCursor GetCursorInfo SetCaretPos GetKeyNameTextW RealGetWindowClassW IsChild LoadMenuA CharLowerBuffW CharUpperA CharUpperBuffA

advapi32

MapGenericMask LogonUserW ReportEventA

ole32

ReadClassStg CoRevokeMallocSpy

winhttp

WinHttpCheckPlatform