file[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
file.exe
Size 863KB
Sample230321-qsdy7aaf75
SHA256 bb7b0935273ea7fc462a193d7eaa2a30ccc4c808bf152f389125e519c22a9069
MD5 ddd1f0c35557c3cb9de6d19c0cade01b
SHA1 6f4e5676e9f90e766a32470000793c3ae5aef683
SHA512 1c946ee7a1bce11230fd4a6f4835101d440128f8bbe90dadb488d8a12f7aa18fc4b709228144704c902781ae9cce4e6d7b2134d5f1267fb05a4e1659a6cca530
SSDEEP 24576:XyE8JiMHnEBiehIMZR9CjI21FiWOnoxkNMu4dXxbfat6Z:PCiMHEBieK+RX21FiWOnoxkNMu4dX9aE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 863KB

file.exe

IMPHASH ca4024c0e7ca045d1b257058baf9658b
SHA256 bb7b0935273ea7fc462a193d7eaa2a30ccc4c808bf152f389125e519c22a9069
MD5 ddd1f0c35557c3cb9de6d19c0cade01b
SHA1 6f4e5676e9f90e766a32470000793c3ae5aef683
SHA512 1c946ee7a1bce11230fd4a6f4835101d440128f8bbe90dadb488d8a12f7aa18fc4b709228144704c902781ae9cce4e6d7b2134d5f1267fb05a4e1659a6cca530
SSDEEP 24576:XyE8JiMHnEBiehIMZR9CjI21FiWOnoxkNMu4dXxbfat6Z:PCiMHEBieK+RX21FiWOnoxkNMu4dX9aE
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

337564

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

powrprof

CallNtPowerInformation

user32

RegisterClassW GetMessageW TranslateMessage DispatchMessageW PostMessageW DefWindowProcW GetWindowLongPtrW UnregisterClassW CreateWindowExW DestroyWindow SetWindowLongPtrW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpWriteData WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse

advapi32

SystemFunction036 ConvertStringSecurityDescriptorToSecurityDescriptorW BuildExplicitAccessWithNameW BuildSecurityDescriptorW RevertToSelf ImpersonateNamedPipeClient RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegCloseKey

kernel32

GetFileTime CreateProcessW Sleep SleepEx RemoveDirectoryW DeleteFileW CreateDirectoryW WriteConsoleW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP InitializeCriticalSection GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetCurrentDirectoryW GetFileAttributesW WriteFile SetUnhandledExceptionFilter SetProcessShutdownParameters SetConsoleCtrlHandler GetProcessTimes SuspendThread ResumeThread GetProcessId GetThreadContext Wow64GetThreadContext VerSetConditionMask IsProcessorFeaturePresent GetSystemInfo VerifyVersionInfoW GetTimeZoneInformation GetThreadLocale GetSystemDefaultLCID GetUserDefaultLCID GetModuleFileNameW DuplicateHandle GetLastError ConnectNamedPipe DisconnectNamedPipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus SetEvent WaitForSingleObject CreateEventW GetCurrentProcess TerminateProcess CreateThread OpenProcess UnregisterWaitEx RegisterWaitForSingleObject GetFileInformationByHandleEx SetLastError IsWow64Process GetModuleHandleW FormatMessageA VirtualQueryEx ReadProcessMemory GetSystemTimeAsFileTime FindClose CloseHandle GetProcAddress LoadLibraryW CreateFileW SetNamedPipeHandleState TransactNamedPipe CreateNamedPipeW WaitNamedPipeW GetVersion ReleaseSemaphore CreateSemaphoreW GetStdHandle GetFileSizeEx GetFileType LockFileEx ReadFile SetEndOfFile SetFilePointerEx UnlockFileEx GetFullPathNameW LocalFree OutputDebugStringW GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetACP WideCharToMultiByte InitializeCriticalSectionEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind GetCommandLineA GetCommandLineW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW HeapReAlloc HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindFirstFileExW FindNextFileW IsValidCodePage

Name

.text

Size

590KB

Virtual Size

589KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ