file[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

file.exe
Size

545KB
MD5

a41a6ac1f465981ddd378cbe85e6e5aa
SHA1

d5bd3d9a46f165c12814344379a1afee1af762cb
SHA256

00be39766b1a091a3f59c367143d21d511991a465c8eb0a39c907d4cd398c90a
SHA512

cce91f59f994313b00411dd860d5a4f1a1d362bc5394586b4b23cedf5d42f5be18bad243fe2e79a77ef529b7d13480e71001589d7091a1db3c080de504ef2c27
SSDEEP

12288:z1/jIWMWMYzh6byzPNMf4in4qFPddnlpKuooue:z1/jIOMYN6byxo7BRdhXKuooF

Score

1^/10

Malware Config

Signatures

Files

file.exe
.exe windows x64

631fdb37f5587bb06fab5c930edc4a1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_vsnwprintf
towupper
wcschr
wcsstr
_wcsnicmp
memmove
wcsncmp
_strnicmp
towlower
__CxxFrameHandler3
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__getmainargs
_purecall
??3@YAXPEAX@Z
_stricmp
__C_specific_handler
memcpy
_wcsicmp
??2@YAPEAX_K@Z
memset

ntdll

RtlIpv6AddressToStringW
RtlIpv4AddressToStringW
NtClose
NtOpenThreadToken
NtSetInformationThread
NtOpenProcessToken
RtlReportException
EtwEventEnabled
TpAllocTimer
TpReleaseIoCompletion
TpAllocIoCompletion
TpAllocWork
TpReleaseTimer
TpSetPoolMinThreads
TpSetWait
TpSetPoolMaxThreads
TpWaitForIoCompletion
TpSimpleTryPost
TpReleaseAlpcCompletion
TpReleaseWork
TpCallbackMayRunLong
RtlNtStatusToDosError
TpReleaseWait
TpWaitForTimer
TpPostWork
TpSetTimer
TpWaitForAlpcCompletion
TpReleasePool
TpWaitForWait
TpStartAsyncIoOperation
TpAllocPool
TpAllocWait
TpWaitForWork
TpAllocAlpcCompletion
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlValidRelativeSecurityDescriptor
EtwEventWrite
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwTraceMessage
EtwEventUnregister
EtwEventRegister
WinSqmIsOptedIn
WinSqmAddToStreamEx
WinSqmSetDWORD
WinSqmIncrementDWORD

api-ms-win-core-localregistry-l1-1-0

RegSetValueExW
RegOpenCurrentUser
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegDeleteKeyExW
RegGetValueW
RegQueryInfoKeyW
RegGetKeySecurity
RegSetKeySecurity
RegEnumValueW
RegDeleteValueW

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW

rpcrt4

RpcImpersonateClient
RpcRevertToSelf
RpcServerInqBindingHandle
I_RpcBindingIsClientLocal
I_RpcSessionStrictContextHandle
RpcAsyncCompleteCall
RpcRevertToSelfEx
RpcRaiseException
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
NdrServerCall2
RpcServerInqDefaultPrincNameW
RpcServerRegisterAuthInfoW
RpcServerListen
RpcServerUseProtseqEpA
RpcServerUseProtseqW
RpcObjectSetType
RpcServerRegisterIf2
RpcServerRegisterIf
RpcServerInqBindings
RpcEpRegisterW
RpcBindingVectorFree
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcStringFreeW
RpcMgmtSetServerStackSize
RpcSsContextLockExclusive
RpcAsyncAbortCall
RpcServerSubscribeForNotification
RpcServerUnsubscribeForNotification
I_RpcExceptionFilter
RpcServerTestCancel
NdrClientCall3
Ndr64AsyncClientCall
I_RpcBindingInqTransportType
RpcSmDestroyClientContext
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW

kernel32

DuplicateHandle
InitializeCriticalSection
ReadFile
OutputDebugStringW
QueueUserWorkItem
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
SetConsoleCtrlHandler
InitializeSRWLock
GetSystemTime
CompareStringW
GetTempFileNameW
CreateFileW
TlsGetValue
HeapCreate
DisableThreadLibraryCalls
TlsFree
HeapDestroy
SetPriorityClass
SetErrorMode
LoadLibraryExW
lstrlenW
WideCharToMultiByte
GetComputerNameW
lstrcmpiW
DeleteFileW
MoveFileExW
GetCurrentThread
ReleaseSRWLockShared
QueryPerformanceCounter
AddVectoredExceptionHandler
IsDebuggerPresent
DebugBreak
LocalFree
DeleteCriticalSection
HeapFree
ExitThread
GetLastError
CloseHandle
WaitForSingleObject
GetModuleHandleW
CreateEventW
CreateThread
GetTickCount
ExitProcess
OpenEventW
Sleep
HeapSetInformation
GetProcessHeap
InitializeCriticalSectionAndSpinCount
TlsAlloc
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
SetEvent
SetLastError
TlsSetValue
OpenProcess
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryExA
SetUnhandledExceptionFilter
HeapAlloc
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetThreadpoolTimer
ResetEvent
LoadLibraryW

user32

UnregisterDeviceNotification
PeekMessageW
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjects
SendNotifyMessageW
RegisterDeviceNotificationW

powrprof

GetPwrCapabilities
PowerDeterminePlatformRole

dnsapi

DnsQuery_W
DnsFree

Exports

Exports

GetSpoolerTlsIndexes
PrvAbortPrinter
PrvAddFormW
PrvAddJobW
PrvAddMonitorW
PrvAddPerMachineConnectionW
PrvAddPortExW
PrvAddPortW
PrvAddPrintProcessorW
PrvAddPrintProvidorW
PrvAddPrinterConnectionW
PrvAddPrinterDriverExW
PrvAddPrinterDriverW
PrvAddPrinterExW
PrvAddPrinterW
PrvAdjustPointers
PrvAdjustPointersInStructuresArray
PrvAlignKMPtr
PrvAlignRpcPtr
PrvAllocSplStr
PrvAllowRemoteCalls
PrvAppendPrinterNotifyInfoData
PrvBuildOtherNamesFromMachineName
PrvCacheAddName
PrvCacheCreateAndAddNode
PrvCacheCreateAndAddNodeWithIPAddresses
PrvCacheDeleteNode
PrvCacheIsNameCluster
PrvCacheIsNameInNodeList
PrvCallDrvDevModeConversion
PrvCallRouterFindFirstPrinterChangeNotification
PrvCheckLocalCall
PrvClosePrinter
PrvClusterSplClose
PrvClusterSplIsAlive
PrvClusterSplOpen
PrvConfigurePortW
PrvCreatePrinterIC
PrvDeleteFormW
PrvDeleteMonitorW
PrvDeletePerMachineConnectionW
PrvDeletePortW
PrvDeletePrintProcessorW
PrvDeletePrintProvidorW
PrvDeletePrinter
PrvDeletePrinterConnectionW
PrvDeletePrinterDataExW
PrvDeletePrinterDataW
PrvDeletePrinterDriverExW
PrvDeletePrinterDriverW
PrvDeletePrinterIC
PrvDeletePrinterKeyW
PrvDllAllocSplMem
PrvDllAllocSplStr
PrvDllFreeSplMem
PrvDllFreeSplStr
PrvDllReallocSplMem
PrvDllReallocSplStr
PrvEndDocPrinter
PrvEndPagePrinter
PrvEnumFormsW
PrvEnumJobsW
PrvEnumMonitorsW
PrvEnumPerMachineConnectionsW
PrvEnumPortsW
PrvEnumPrintProcessorDatatypesW
PrvEnumPrintProcessorsW
PrvEnumPrinterDataExW
PrvEnumPrinterDataW
PrvEnumPrinterDriversW
PrvEnumPrinterKeyW
PrvEnumPrintersW
PrvFindClosePrinterChangeNotification
PrvFlushPrinter
PrvFormatPrinterForRegistryKey
PrvFormatRegistryKeyForPrinter
PrvFreeOtherNames
PrvGetFormW
PrvGetJobAttributes
PrvGetJobAttributesEx
PrvGetJobW
PrvGetNetworkId
PrvGetPrintProcessorDirectoryW
PrvGetPrinterDataExW
PrvGetPrinterDataW
PrvGetPrinterDriverDirectoryW
PrvGetPrinterDriverExW
PrvGetPrinterDriverW
PrvGetPrinterW
PrvGetServerPolicy
PrvGetShrinkedSize
PrvGetSpoolerTlsIndexes
PrvImpersonatePrinterClient
PrvInitializeRouter
PrvIsNameTheLocalMachineOrAClusterSpooler
PrvIsNamedPipeRpcCall
PrvMIDL_user_allocate
PrvMIDL_user_allocate1
PrvMIDL_user_free
PrvMIDL_user_free1
PrvMarshallDownStructure
PrvMarshallDownStructuresArray
PrvMarshallUpStructure
PrvMarshallUpStructuresArray
PrvOldGetPrinterDriverW
PrvOpenPrinter2W
PrvOpenPrinterExW
PrvOpenPrinterPort2W
PrvOpenPrinterW
PrvPackStrings
PrvPartialReplyPrinterChangeNotification
PrvPlayGdiScriptOnPrinterIC
PrvPrinterHandleRundown
PrvPrinterMessageBoxW
PrvProvidorFindClosePrinterChangeNotification
PrvProvidorFindFirstPrinterChangeNotification
PrvReadPrinter
PrvReallocSplMem
PrvReallocSplStr
PrvRemoteFindFirstPrinterChangeNotification
PrvReplyClosePrinter
PrvReplyOpenPrinter
PrvReplyPrinterChangeNotification
PrvReplyPrinterChangeNotificationEx
PrvReportJobProcessingProgress
PrvResetPrinterW
PrvRevertToPrinterSelf
PrvRouterAddPrinterConnection2
PrvRouterAllocBidiMem
PrvRouterAllocBidiResponseContainer
PrvRouterAllocPrinterNotifyInfo
PrvRouterBroadcastMessage
PrvRouterCorePrinterDriverInstalled
PrvRouterCreatePrintAsyncNotificationChannel
PrvRouterDeletePrinterDriverPackage
PrvRouterFindCompatibleDriver
PrvRouterFindFirstPrinterChangeNotification
PrvRouterFindNextPrinterChangeNotification
PrvRouterFreeBidiMem
PrvRouterFreeBidiResponseContainer
PrvRouterFreePrinterNotifyInfo
PrvRouterGetCorePrinterDrivers
PrvRouterGetPrintClassObject
PrvRouterGetPrinterDriverPackagePath
PrvRouterInstallPrinterDriverFromPackage
PrvRouterInternalGetPrinterDriver
PrvRouterRefreshPrinterChangeNotification
PrvRouterRegisterForPrintAsyncNotifications
PrvRouterReplyPrinter
PrvRouterSpoolerSetPolicy
PrvRouterUnregisterForPrintAsyncNotifications
PrvRouterUploadPrinterDriverPackage
PrvScheduleJob
PrvSeekPrinter
PrvSendRecvBidiData
PrvSetFormW
PrvSetJobW
PrvSetPortW
PrvSetPrinterDataExW
PrvSetPrinterDataW
PrvSetPrinterW
PrvSplCloseSpoolFileHandle
PrvSplCommitSpoolData
PrvSplDriverUnloadComplete
PrvSplGetClientUserHandle
PrvSplGetSpoolFileInfo
PrvSplGetUserSidStringFromToken
PrvSplInitializeWinSpoolDrv
PrvSplIsSessionZero
PrvSplIsUpgrade
PrvSplPowerEvent
PrvSplProcessPnPEvent
PrvSplProcessSessionEvent
PrvSplPromptUIInUsersSession
PrvSplQueryUserInfo
PrvSplReadPrinter
PrvSplRegisterForDeviceEvents
PrvSplRegisterForSessionEvents
PrvSplShutDownRouter
PrvSplUnregisterForDeviceEvents
PrvSplUnregisterForSessionEvents
PrvSpoolerFindClosePrinterChangeNotification
PrvSpoolerFindFirstPrinterChangeNotification
PrvSpoolerFindNextPrinterChangeNotification
PrvSpoolerFreePrinterNotifyInfo
PrvSpoolerHasInitialized
PrvSpoolerInit
PrvSpoolerRefreshPrinterChangeNotification
PrvStartDocPrinterW
PrvStartPagePrinter
PrvUndoAlignKMPtr
PrvUndoAlignRpcPtr
PrvUpdateBufferSize
PrvUpdatePrinterRegAll
PrvUpdatePrinterRegUser
PrvWaitForPrinterChange
PrvWaitForSpoolerInitialization
PrvWritePrinter
PrvXcvDataW
PrvbGetDevModePerUser
PrvbSetDevModePerUser
ServerGetPrintClassObject
YAbortPrinter
YAddJob
YDriverUnloadComplete
YEndDocPrinter
YEndPagePrinter
YFlushPrinter
YGetPrinter
YGetPrinterDriver2
YGetPrinterDriverDirectory
YReadPrinter
YSeekPrinter
YSetJob
YSetPort
YSetPrinter
YSplReadPrinter
YStartDocPrinter
YStartPagePrinter
YWritePrinter

Sections

.text
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

631fdb37f5587bb06fab5c930edc4a1f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

api-ms-win-core-localregistry-l1-1-0

api-ms-win-service-core-l1-1-0

rpcrt4

kernel32

user32

powrprof

dnsapi

Exports

Exports

Sections

.text Size: 300KB - Virtual size: 299KB

.rdata Size: 200KB - Virtual size: 200KB

.data Size: 7KB - Virtual size: 8KB

.pdata Size: 22KB - Virtual size: 21KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 300KB - Virtual size: 299KB

.rdata
Size: 200KB - Virtual size: 200KB

.data
Size: 7KB - Virtual size: 8KB

.pdata
Size: 22KB - Virtual size: 21KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 11KB - Virtual size: 11KB