file[.]exe | Triage™

General

Target
file.exe
Size 1.5MB
Sample230327-s3715aeb25
SHA256 e22cd3a8e74e1e54cdcb25232b5d7c77c8581df0df866725be0cbddfa48404de
MD5 22a52fd6cde6f16f8d8a533cab615d69
SHA1 8d650de9ebd4b0d77ef09c271a9e5483874bba30
SHA512 3bea0d75d1c1da0a47dbe8c7051a4065138eae195926d543119b4e8a70c1f11acc2aa93a03bd46bb7c0a506af0e7b7ecb5eea762734cb9778e1870df4849938c
SSDEEP 6144:2n9R71FvLHFla0OR/AOOp/QP/ojxzPPkq7n+UG39P:2n9R71FO8W59P
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 1.5MB

file.exe

IMPHASH 0687d0d0d948483526792bab9d2b83f9
SHA256 e22cd3a8e74e1e54cdcb25232b5d7c77c8581df0df866725be0cbddfa48404de
MD5 22a52fd6cde6f16f8d8a533cab615d69
SHA1 8d650de9ebd4b0d77ef09c271a9e5483874bba30
SHA512 3bea0d75d1c1da0a47dbe8c7051a4065138eae195926d543119b4e8a70c1f11acc2aa93a03bd46bb7c0a506af0e7b7ecb5eea762734cb9778e1870df4849938c
SSDEEP 6144:2n9R71FvLHFla0OR/AOOp/QP/ojxzPPkq7n+UG39P:2n9R71FO8W59P
MD5 SHA1 SHA512 SSDEEP

windows x86

PE Signature issue

Digest

9c:10:55:97:93:68:4f:7c:d4:99:30:e2:23:3b:55:64:32:40:c4:dd:b8:44:ee:73:af:9c:86:f4:ab:29:33:a6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

28070

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess CreateFileW RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap ReadConsoleW HeapSize WriteConsoleW

Name

.text

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

261KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.falcho

Size

694KB

Virtual Size

694KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.falcho

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.falcho

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

kernel32