file[.]exe | Triage™

resource
file.exe

file.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 0213e39792ac0c5b66491f90c4b0fc4afdd84f40944922cab8a3bcdb1cf88cfc
MD5 12860c8f39570ea1a7256b7ed9dabccf
SHA1 b57be17b3b1797c933c3187829f6e24cf0fd9b83
SHA512 5945c0a71c12422d964b892944e234f6a04d7d30cc730dd4aa4c6607bd73232dad48d29c12256ed41d6dc2d9d19a7e55afc783ea5f6b88ca8168e962fc55074d
SSDEEP 24576:i9X3iqR+jmjhtHquFUn8dCHELjS6PhZsNrelZ5dwSzhR:itsmfVin8QWS6vUeD5dwCR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14489

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/Activation

SHA256 e3f4fbcfa7a3d8e44e82a4b28a38724eb86b46f5599be2a0f1fb9880d0a1eb47
MD5 8b0e5b5564040244b7fe987f12c957e7
SHA1 ea193a80e11c4608a9c72d9bb63022688e470862
SHA512 7b3328773c503992cb39c6e00583a6452dae33041f22f2964b028914783b28cc15cd87308cc385580dd1ea4c9f5a08258d7d8b6d37de6024133fcc0863ff20c9
SSDEEP 192:z0HAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlbN+G3c:YHAHhww+/2nlP3r1WAL3c
MD5 SHA1 SHA512 SSDEEP

$TEMP/Avoid

SHA256 02f710cb82f8d38f9e99e1be712d9c70552f6175f024e4a035c56a630b3ff066
MD5 f14eaeb195d643f4fc9971f78b828491
SHA1 d918494734a26061b7eef0bf8dbbdc3c7bca70bf
SHA512 fcb11f07118529e32d44653a6280b1a6fb95daf66025036766a247636e46049300be82c1d0441535ab043b22ec997fde0d04fea4983e671d5ee9862e8d068e4c
SSDEEP 96:zE0/ozUGE/I8QvE3DOUD/etfsptH+OS3rGvGXM67j3zNJ2tGCdJnduSK1nObBtzs:zdAwGEw3vE3DO7Z6txSavGXbXgGAFdnq
MD5 SHA1 SHA512 SSDEEP

$TEMP/Ceo

SHA256 695e778b876ea0312ad0014ea3ec8940139aa0033e4ec5e6e6da9c836fbc7086
MD5 81a3e6cbd7092474a997336697873d61
SHA1 c3332238a09567de8acb1f938f960ffd81e13215
SHA512 812cdf35a082a22a0b3157dd285fd1daa5a3f3ffe48aa79aed92f3fe62108a1bc646380ff60ebdd92600f78b58df59fe74c8956e2d6c5efafd715e092b1e989e
SSDEEP 192:Z8T60htZtU2V/fT9SITIZsg4A9dKvoMg4wdbkyMbBGl9HAmbk:ZTKtL/fJSI0Zt4A9dKvlgbjCB29I
MD5 SHA1 SHA512 SSDEEP

$TEMP/Ecology

SHA256 903f19bbcbc63f39726365060e05841b1f85746f78d7a0ae51392a824a97a7bb
MD5 6ae59a460e37c2486894b1ca8fa2dd87
SHA1 1954f743f6cf5953ff2ebdf0d51204a3e23bd6ec
SHA512 2c62e9551317d5a8d0e543a5ec760e8d6c7bdf89fc2262b9e21f5ba1b56c00d669b47b281857c2d0a4747f64abb4dc1cfdff1ac7e36cc646432f0c32f708b19c
SSDEEP 1536:xodGyT2UB4h1oepI+7stA1UmnhIiBtpi9NWkUmOaGnZV5fqyzm/dUV:+dGIZB45I+d1UmnmetpANEmO5nsfSV
MD5 SHA1 SHA512 SSDEEP

$TEMP/Encyclopedia

SHA256 94715e887f132abf53cdc3d33022aa22063e1887f56a38a27e48aa21364d195a
MD5 10131cf263fe9e86e86fe75276d0a918
SHA1 7dc521b107deaba391232335161fc5c5c2e69ccd
SHA512 b87613833fbc0fc1bc3a45266a0240aa7bf121771754f57baef839eb4279c5cf944a62163dda4ff5869ded4dfc939d1119a6552074b51cab5de345660b99c037
SSDEEP 1536:DAyRNKURVP7yWHv7rinGcFR3oHPEOz2CuivjgmmDPDT/4i9+DmqtgMZABKN:DAyNHyuv7riNOMkv8mmDbaDmqtgMZAY
MD5 SHA1 SHA512 SSDEEP

$TEMP/Klein

SHA256 b92acf55b4f00ae18fb10765fd1bd0115529d0e492b1bf163f7a5ab2e0d367bc
MD5 726700550ac2d42e80a6d3a7405b8c22
SHA1 7d4f9b127505d70c675882485545503d18b4c9b9
SHA512 2ac52f2c7a186ae3856ef5620f9976504981712622ceb5c07ac128b1fbc02dad056f1296fd512acf4e71262ac2869f6a13e8b7a448f002f6c5031648ed6e8a18
SSDEEP 1536:kjPnjSCFXR0pdXI4nOpT9k0L7LjsuWGs9ljDpb4fcCe1lsPlehDtbb29/:vCgpd9OpT9k0fLjQnvpb4fcCefeatS9/
MD5 SHA1 SHA512 SSDEEP

$TEMP/Resolution

SHA256 b0fd86c3a4b267d8706d7ae36b4a19eddb8fdb81fcb363c18174be45e64d9cc7
MD5 b110bbafcf6cfb0a8ae2f122ddf20ede
SHA1 a62d46e158a5ac193b6d2631510e67c35d448a15
SHA512 3327f6f5fe655f0693694e8ce58e2e4d6e1fedd3f1f93203b359aec3dcc3478757bf1ed178721e519938af73b13d6c380aca6e90a59df60eaabff103e0455459
SSDEEP 1536:bdBj5yYeJQHINrZ5HhuAMQlzGLr+LseO60ZJ4QON8:j5yBT3M2zGLr+LseeZJtON8
MD5 SHA1 SHA512 SSDEEP

$TEMP/Rings

SHA256 e4a175bd91a15df2f47e2e65c2ad7ab8cd350425c8dafb072e479c1a4d6c4be8
MD5 25055baf9907ffe607bd6cfc3f6d30ff
SHA1 3c77f48211fb315980d89ecafab8a74c5025aaa6
SHA512 926d4a1af7a71ceb9b0752cadd17831059917db7bcf2d67c82e6b2b3b034f2d50219c5351bc4a5bcf610386778b24257c68797bf581a7c57e695a1607a68974e
SSDEEP 12288:hV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:7xz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

$TEMP/Sequences

SHA256 fdcfb94acca7a22919f6e2cb66e7290a336bdddb87525dc15f84e9ccfc048feb
MD5 42d99c39171ea35a6ecf889749965fd4
SHA1 1021a1ad9ecf4549d71b83cb0ee7bacc4469517d
SHA512 ede4aef51c613348b9c7310a844ee1135b4c7bb6794a4026ed02ad29d476502bd7682e650aba5af15637a466ffdf781768d29e9bd544e56587e09858bc94d15a
SSDEEP 1536:rvTk08Py25oSz1P+zYkOcszL/H16rEfdV:rvTk0ZLSz1m55szL/kYf3
MD5 SHA1 SHA512 SSDEEP

$TEMP/Telephony

SHA256 3f15bffc2b8590d4e959cebd7c30ecc4fedcbb0907f0f7860b5bef19433aaf40
MD5 3405b6274e73d544802fffdcd585b905
SHA1 1d03437ae18c199cc66cab1b716031952e096068
SHA512 aaa25bb57ad965044a8c188bfb3aca20b1ee8986c823c672f7dd36eaac31a32b0036beb9ea64fa13b8dbeeb5960c583c51d1f4f75ed662de34bcf1ceea5a561d
SSDEEP 1536:o4934weOuvhrg/dgdFh/zMC6gKyf3ALh2w7cwQEQei7GYJ7tuANbEgiZzO:ocoweOqhEFyp3f3ALhVRQZ7GI1bEgiY
MD5 SHA1 SHA512 SSDEEP

MaeInspiration/Sp

SHA256 4a22f73997cba0fe3b1ecf506bef6f26ca0a84d964a5450396854502f6983fb5
MD5 b217e014693974adfe42c627953b8263
SHA1 4f2b8d085c5f0b9e80ee650d7016f4f423570989
SHA512 25e1726ee322adb04f7f3adc911525ff88632d48d9fb516a3047747e45346f02a463761ec8abb2da2a6696aebc29e48efe69d0e08e07d02db35f02a195ee79f6
SSDEEP 1536:Zv+kQ1rJYfPWJ6PvIk4b+4IGjqU99orH8GCstCK7X+pmwfcVjQEJrfm:Zv7ZPWJ9+4IM9e8GCvmwEV0Epm
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

file.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$TEMP/Activation

$TEMP/Avoid

$TEMP/Ceo

$TEMP/Ecology

$TEMP/Encyclopedia

$TEMP/Klein

$TEMP/Resolution

$TEMP/Rings

$TEMP/Sequences

$TEMP/Telephony

MaeInspiration/Sp