file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 184KB
Sample230217-r2eshsfd51
SHA256 be1ac3e20d32bfd5c3ca1c7bbc8f5ad79db8a9a414112b91bad7e2b69700b8bf
MD5 f381b52387022c520dc4d51b342ae238
SHA1 7ada7c8c4f9c2260274f93b18f03a20ac6bc145a
SHA512 9ce9416d432dbb123f0e9ed9ee1c8cb44bf7d52e8da9f7cf973eca28c5888c697a00f014e1858272c6e8df050503ad422488fac3adbaf50c57c571b77ca15b6d
SSDEEP 3072:p/BghwGgv4bxyPJ/Tzm6W6UN9cma9EAS5MzSJzQUK:p/YJ7NyBb6f9Q9lSPQZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 184KB

file.exe

IMPHASH 9d64e6a2a7bb4f74b24f7b7e42936433
SHA256 be1ac3e20d32bfd5c3ca1c7bbc8f5ad79db8a9a414112b91bad7e2b69700b8bf
MD5 f381b52387022c520dc4d51b342ae238
SHA1 7ada7c8c4f9c2260274f93b18f03a20ac6bc145a
SHA512 9ce9416d432dbb123f0e9ed9ee1c8cb44bf7d52e8da9f7cf973eca28c5888c697a00f014e1858272c6e8df050503ad422488fac3adbaf50c57c571b77ca15b6d
SSDEEP 3072:p/BghwGgv4bxyPJ/Tzm6W6UN9cma9EAS5MzSJzQUK:p/YJ7NyBb6f9Q9lSPQZ
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

43724

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindActCtxSectionGuid ReadConsoleInputW GetWindowsDirectoryA FindFirstVolumeMountPointA FindFirstChangeNotificationA WaitForSingleObject ReadConsoleInputA VerifyVersionInfoA GetVersionExA GetCurrentProcess OpenEventA CreateFileMappingA SetLocaleInfoW GetProcAddress LoadLibraryA GlobalAlloc DeleteTimerQueueTimer GetConsoleTitleA DeleteFileA FindResourceA GetBinaryTypeW SetLastError CreateFileW WriteProfileStringW GetComputerNameExW GetConsoleAliasA WriteProfileSectionW SetVolumeMountPointA EnumResourceLanguagesW CommConfigDialogA EnumDateFormatsW ActivateActCtx DeleteVolumeMountPointA WritePrivateProfileStringW GetSystemDirectoryA GetStringTypeW GetLongPathNameA FindNextFileW EnumCalendarInfoA ReleaseActCtx FindFirstFileW CreateFileA WriteConsoleW LoadLibraryW GetProfileSectionW GetModuleHandleA FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapFree RtlUnwind RaiseException GetCommandLineW HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo HeapAlloc IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetCurrentThreadId CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage GetLocaleInfoW HeapReAlloc HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetFilePointer

user32

LoadMenuA GetMessagePos

advapi32

RevertToSelf

shell32

FindExecutableA

ole32

CoGetInstanceFromIStorage