file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 185KB
Sample230217-qxc8fsff48
SHA256 57faee26a7adc215fe009520e2096e005a55a605047d5fa30f0e24faf2c9fd8f
MD5 852dc3ce0ad1290aab2b5449af6cce50
SHA1 db4ffaf3894b10d6a3dfa33f28c0482355d70ce2
SHA512 5cc92f4686917555a26eac75bda67f095fcc93ba62c84ee239dca9e6b5877776fe4a9180a57a1771ce76040b3c001f1268055a0a74b051abff62d4676f7ce7b8
SSDEEP 3072:O4VDtqr48xK1yDLOQWeOy2+H+74Rs9JC1H0+g+Db78U5:OA/WKgDK3bhv4S9JC1H0+g+Db78U
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 185KB

file.exe

IMPHASH 9d64e6a2a7bb4f74b24f7b7e42936433
SHA256 57faee26a7adc215fe009520e2096e005a55a605047d5fa30f0e24faf2c9fd8f
MD5 852dc3ce0ad1290aab2b5449af6cce50
SHA1 db4ffaf3894b10d6a3dfa33f28c0482355d70ce2
SHA512 5cc92f4686917555a26eac75bda67f095fcc93ba62c84ee239dca9e6b5877776fe4a9180a57a1771ce76040b3c001f1268055a0a74b051abff62d4676f7ce7b8
SSDEEP 3072:O4VDtqr48xK1yDLOQWeOy2+H+74Rs9JC1H0+g+Db78U5:OA/WKgDK3bhv4S9JC1H0+g+Db78U
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

43724

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindActCtxSectionGuid ReadConsoleInputW GetWindowsDirectoryA FindFirstVolumeMountPointA FindFirstChangeNotificationA WaitForSingleObject ReadConsoleInputA VerifyVersionInfoA GetVersionExA GetCurrentProcess OpenEventA CreateFileMappingA SetLocaleInfoW GetProcAddress LoadLibraryA GlobalAlloc DeleteTimerQueueTimer GetConsoleTitleA DeleteFileA FindResourceA GetBinaryTypeW SetLastError CreateFileW WriteProfileStringW GetComputerNameExW GetConsoleAliasA WriteProfileSectionW SetVolumeMountPointA EnumResourceLanguagesW CommConfigDialogA EnumDateFormatsW ActivateActCtx DeleteVolumeMountPointA WritePrivateProfileStringW GetSystemDirectoryA GetStringTypeW GetLongPathNameA FindNextFileW EnumCalendarInfoA ReleaseActCtx FindFirstFileW CreateFileA WriteConsoleW LoadLibraryW GetProfileSectionW GetModuleHandleA FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapFree RtlUnwind RaiseException GetCommandLineW HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo HeapAlloc IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetCurrentThreadId CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetLocaleInfoW HeapReAlloc HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetFilePointer

user32

LoadMenuA GetMessagePos

advapi32

RevertToSelf

shell32

FindExecutableA

ole32

CoGetInstanceFromIStorage