file[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

file.exe
Size

939KB
MD5

eed1ea7bc3b7ecec9b27b042d5e5779f
SHA1

5ec2e8f08e7c065af33aeda7a4e4bf9b3b82d29a
SHA256

ea09c280645956baff7e4cdc2bfa9753104b9025ec81d6853fca43f8c2fcb732
SHA512

625fe3a705d606410a634cfb11e982541010f5fc2fa0e28efc9c52505c33fa9a4b2e41dfd9607cfeccb30daf92d7f8ad46b7e3fb806927658e69477363f27b9c
SSDEEP

12288:uo3uUMbBAjwdQ99ssa4/WAMxi8BZm85Nh3MS4b3+K4VCWgKcUNa2DJgMBN0PrIgP:uSbalxpl57yWtPXBN0

Score

1^/10

Malware Config

Signatures

Files

file.exe
.exe windows x64

d7845ac7f09a1e895d8fedf75d1e621e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

memcmp
_errno
realloc
__CxxFrameHandler3
_CxxThrowException
wcspbrk
_wtoi
_wcsnicmp
wcsrchr
__RTDynamicCast
wcsstr
wcschr
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
calloc
_vsnwprintf
wcstok_s
_vscwprintf
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
vswprintf_s
wcscat_s
wcscpy_s
_resetstkoflw
memmove_s
memcpy_s
memmove
_beginthreadex
wcsncmp
swscanf_s
__set_app_type
_fmode
iswspace
swprintf_s
_wcsicmp
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
malloc
memset
free
memcpy

advapi32

RegOpenKeyExW
GetLengthSid
RegCloseKey
OpenThreadToken
RegQueryValueExW
GetTokenInformation
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

kernel32

FileTimeToLocalFileTime
GetLocalTime
MulDiv
FileTimeToSystemTime
CreateFileW
ReadFile
lstrcmpW
FindFirstFileW
FindClose
FindNextFileW
GetLogicalDriveStringsW
SetErrorMode
QueryDosDeviceW
GetFileAttributesW
GetDriveTypeW
GetLogicalDrives
GetWindowsDirectoryW
GetDiskFreeSpaceExW
GetDateFormatW
ConvertDefaultLocale
GetTimeFormatW
GetLocaleInfoW
GetUserDefaultUILanguage
FormatMessageW
FindResourceExW
SizeofResource
CloseHandle
InitializeCriticalSection
LockResource
LoadResource
FindResourceW
DeleteCriticalSection
RaiseException
SetLastError
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
GetLastError
CreateMutexW
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
HeapSetInformation
CreateEventW
ResetEvent
GetCurrentThread
SetEvent
WaitForSingleObject
CreateProcessW
OutputDebugStringA
InterlockedPushEntrySList
VirtualAlloc
InterlockedPopEntrySList
VirtualFree
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
LCMapStringW
SystemTimeToFileTime
SwitchToThread
GetExitCodeProcess
CompareFileTime
CreateThread
lstrlenW

gdi32

ExtTextOutW
CreateDIBSection
GetCurrentObject
GetTextColor
GetTextExtentPointW
SetBkColor
CreatePatternBrush
PatBlt
GetTextExtentPoint32W
RestoreDC
GetTextMetricsW
SetWindowOrgEx
SetViewportOrgEx
ModifyWorldTransform
SetGraphicsMode
SaveDC
GetPixel
GetObjectA
CreateCompatibleBitmap
CreateSolidBrush
GetLayout
GetStockObject
SetBkMode
DeleteDC
BitBlt
SetLayout
CreateBitmap
CreateCompatibleDC
GetObjectW
DeleteObject
CreateFontIndirectW
SelectObject
SetTextColor
GetDeviceCaps
DPtoLP

user32

GetSystemMenu
GetMenuState
GetSysColorBrush
GetDC
PostMessageW
SendMessageW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetWindow
OffsetRect
DrawEdge
PtInRect
GetMessageW
LoadAcceleratorsW
GetDesktopWindow
SetWindowLongPtrW
LoadIconW
IsWindow
FindWindowExW
AllowSetForegroundWindow
CharNextW
CharUpperW
DestroyWindow
SetMenuItemInfoW
GetLastActivePopup
DialogBoxIndirectParamW
RegisterClassExW
GetClassInfoExW
GetMessagePos
SetMenuInfo
SetDlgItemTextW
ReleaseCapture
GetWindowDC
SetRectEmpty
GetKeyState
EqualRect
ScrollWindowEx
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollInfo
GetScrollInfo
GetSystemMetrics
DestroyMenu
LoadCursorW
CreateWindowExW
DestroyIcon
GetDlgItem
GetWindowTextLengthW
SetWindowTextW
GetWindowTextW
SetFocus
EnableWindow
EndDialog
GetWindowLongPtrW
DefWindowProcW
CallWindowProcW
GetParent
InvalidateRect
IsRectEmpty
GetWindowRect
TrackMouseEvent
ReleaseDC
EndPaint
BeginPaint
GetSysColor
IsWindowEnabled
SetCursor
GetClientRect
MapWindowPoints
IsWindowVisible
ShowWindow
GetFocus
PostQuitMessage
ScreenToClient
MoveWindow
GetWindowPlacement
SetForegroundWindow
KillTimer
SetTimer
GetNextDlgTabItem
GetWindowLongW
LockWindowUpdate
ExitWindowsEx
IsDialogMessageW
CreateDialogIndirectParamW
DrawTextW
LoadImageW
MessageBoxW
ShowCursor
FillRect
SystemParametersInfoW
GetAncestor
GetIconInfo
DrawIconEx
CreateIconIndirect
DrawFocusRect
GetClassNameW
InflateRect
GetDlgCtrlID
DeleteMenu
TrackPopupMenu
EnableMenuItem
GetSubMenu
LoadMenuW
LoadStringW
IsChild
RedrawWindow
UnregisterClassA
SetCapture
GetCursorPos
IsMenu
GetCapture
IsCharAlphaNumericW
SetRect
CopyRect
UnregisterClassW
RegisterClassW
SetWindowLongW
SetWindowPos

shell32

ord43
SHGetFileInfoW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFolderLocation
SHGetFolderPathW
ShellExecuteExW

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoGetObject
CoInitializeEx

oleaut32

VARIANT_UserFree
VARIANT_UserSize
SafeArrayGetDim
SafeArrayCreate
BSTR_UserFree64
BSTR_UserSize64
VARIANT_UserUnmarshal64
BSTR_UserSize
VARIANT_UserMarshal
VARIANT_UserFree64
VariantClear
VariantInit
LoadTypeLi
SysAllocStringLen
SysAllocString
SysFreeString
BSTR_UserMarshal
VARIANT_UserSize64
BSTR_UserUnmarshal64
BSTR_UserMarshal64
BSTR_UserUnmarshal
VARIANT_UserUnmarshal
BSTR_UserFree
VARIANT_UserMarshal64

comdlg32

GetOpenFileNameW
CommDlgExtendedError

rpcrt4

NdrCStdStubBuffer2_Release
UuidFromStringW
NdrStubCall3
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

gdiplus

GdipLoadImageFromStream
GdipDrawImageRectI
GdipDrawPath
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipDrawString
GdipSetTextRenderingHint
GdipGetTextRenderingHint
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipImageRotateFlip
GdipMeasureString
GdipReleaseDC
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipGetDC
GdipCreateBitmapFromStream
GdipAddPathArcI
GdipClosePathFigure
GdipAddPathLineI
GdiplusStartup
GdipDisposeImage
GdipCloneImage
GdipFillPath
GdipGetSmoothingMode
GdipCreateSolidFill
GdipDeletePath
GdipCreatePath
GdipDrawImageRectRectI
GdipGetImageWidth
GdipGetImageHeight
GdipFillRectangleI
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateLineBrushFromRectI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdipDrawRectangleI

comctl32

ImageList_LoadImageW
ord413
ord412
ord410
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
InitCommonControlsEx

shlwapi

PathIsUNCW
StrCmpIW
StrCmpNIW
StrCmpNW
StrStrIW
StrDupW
StrStrW
StrChrW

oleacc

AccessibleObjectFromWindow
LresultFromObject

Sections

.text
Size: 767KB - Virtual size: 767KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 198B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 103KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d7845ac7f09a1e895d8fedf75d1e621e

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

advapi32

kernel32

gdi32

user32

shell32

ole32

oleaut32

comdlg32

rpcrt4

version

gdiplus

comctl32

shlwapi

oleacc

Sections

.text Size: 767KB - Virtual size: 767KB

.orpc Size: 512B - Virtual size: 198B

.data Size: 17KB - Virtual size: 20KB

.pdata Size: 39KB - Virtual size: 39KB

.rsrc Size: 103KB - Virtual size: 104KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 767KB - Virtual size: 767KB

.orpc
Size: 512B - Virtual size: 198B

.data
Size: 17KB - Virtual size: 20KB

.pdata
Size: 39KB - Virtual size: 39KB

.rsrc
Size: 103KB - Virtual size: 104KB

.reloc
Size: 9KB - Virtual size: 8KB