file[.]exe | Triage™

General

Target
file.exe
Size 4.2MB
Sample240214-jldlhsdb2s
SHA256 04fa155376790acfdf519d9dffa4027af4f0e6702ccc30ef012623f3e950a599
MD5 a4a6e7fd67c483d2ea78f53d71ebcd8a
SHA1 ef90ebfd9c51c8b9aeab044a37577dce7b2de480
SHA512 9c8c52a34be73ba9c1205b0d42738795104b6124f8f8e41880b67ccc762cd77587ad1a88e9d8085e49c1c8e986c2ba99f61ab28aecf9b4ce7a8432141f350520
SSDEEP 98304:aEjjkXZnkh+JGMdCSzVA+LaH2pMf+XGtEwdJc:3Wkh+JG9axXeiGHq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

file.exe

.exe 4.2MB

file.exe

IMPHASH 7b013929d49f752f683cc55db1700a48
SHA256 04fa155376790acfdf519d9dffa4027af4f0e6702ccc30ef012623f3e950a599
MD5 a4a6e7fd67c483d2ea78f53d71ebcd8a
SHA1 ef90ebfd9c51c8b9aeab044a37577dce7b2de480
SHA512 9c8c52a34be73ba9c1205b0d42738795104b6124f8f8e41880b67ccc762cd77587ad1a88e9d8085e49c1c8e986c2ba99f61ab28aecf9b4ce7a8432141f350520
SSDEEP 98304:aEjjkXZnkh+JGMdCSzVA+LaH2pMf+XGtEwdJc:3Wkh+JG9axXeiGHq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

f2:7e:da:b1:3e:71:d6:81:72:59:5a:5f:1f:38:a8:6f:e5:49:bd:e8:46:e5:1a:98:99:f6:f0:f4:3f:d3:5b:5d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=522036264b3c07530c0910253d36220330152b1b14292e1a512d092b0b3746071333,POSTALCODE=10815,ST=0b1c1115005f5c4e010b00161801040700070818064b0c1a02+ST=0b1c1115494a5c031c0b02081a1750475310151f070b57051217441d47031d1512195d501615110b570d0a17550b1209150a45131d1315075a001044160a055b0c0b0a070b

Chains

Feb 12, 2024

Minor OS version

1

Major OS version

5

Entry point

5244

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetLocaleInfoA WriteConsoleOutputCharacterA SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetComputerNameW FreeEnvironmentStringsA GetTickCount GetConsoleAliasesA WriteFile LoadLibraryW WriteConsoleOutputA HeapDestroy GetTimeZoneInformation ReplaceFileA FlushFileBuffers CreateDirectoryA SetCurrentDirectoryA GetLastError GetCurrentDirectoryW GetProcAddress CreateNamedPipeA ResetEvent LoadLibraryA LocalAlloc AddAtomW SetProcessWorkingSetSize OpenJobObjectW GetModuleHandleA FreeEnvironmentStringsW VirtualProtect EnumDateFormatsW CompareStringA FatalAppExitA IsValidLocale EnumSystemLocalesA GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc EnterCriticalSection LeaveCriticalSection DecodePointer EncodePointer GetModuleHandleW ExitProcess GetStdHandle GetModuleFileNameW GetModuleFileNameA WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime Sleep HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind SetConsoleCtrlHandler FreeLibrary InterlockedExchange GetLocaleInfoW HeapReAlloc GetConsoleCP GetConsoleMode LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer IsProcessorFeaturePresent HeapSize CloseHandle WriteConsoleW SetStdHandle CreateFileW GetUserDefaultLCID GetLocaleInfoA RaiseException

user32

GetClassLongA

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

39.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jufaki

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cocog

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cenete

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

PE Signature issue

kernel32

user32

generic