093421~1[.]EXE | Triage™

Resubmissions

16/02/2026, 12:01

260216-n62ajadv2b10

16/02/2026, 11:45

260216-nwt4gads2b10

Sharing

Copy URL Twitter E-mail

General

Target
093421~1.EXE
Size 3.9MB
Sample260216-nwt4gads2b
SHA256 2e4f7da403833e22c25e38ebbfba41bd81f1e6a1281ade9c8e0118b56a1fe3e2
MD5 1570da0ad8cdd03ac5da82f163d6f256
SHA1 870e9ee1adbf93a35395178cb0f6ae8842d1fcb9
SHA512 348a45eec36b8408c38908342dd27d00d802c67886ef34b22e73b70994f3f9ae120cf36a594a6feb77b913f1765abda07d444428cbf167e97ba848d6abf33066
SSDEEP 49152:RlOfSMm2cPA8p8ZaE4sUAh0kuzcxQqDZdaar8oWGGukhKljxY1za5OT4D:HcS/2cPb8yJAhNM0paW
TLSH
T101169E236601C51BD7120930C9649BB95D6CEC234B12F0CBB29C7ADDAAF61E31A375F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
093421~1.EXE

File Explorer

093421~1.EXE

.exe 3.9MB

093421~1.EXE

IMPHASH d6badfd1f43527d9845dfb400673058c
SHA256 2e4f7da403833e22c25e38ebbfba41bd81f1e6a1281ade9c8e0118b56a1fe3e2
MD5 1570da0ad8cdd03ac5da82f163d6f256
SHA1 870e9ee1adbf93a35395178cb0f6ae8842d1fcb9
SHA512 348a45eec36b8408c38908342dd27d00d802c67886ef34b22e73b70994f3f9ae120cf36a594a6feb77b913f1765abda07d444428cbf167e97ba848d6abf33066
SSDEEP 49152:RlOfSMm2cPA8p8ZaE4sUAh0kuzcxQqDZdaar8oWGGukhKljxY1za5OT4D:HcS/2cPb8yJAhNM0paW
TLSH
T101169E236601C51BD7120930C9649BB95D6CEC234B12F0CBB29C7ADDAAF61E31A375F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

971632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SophosInstall.pdb

kernel32

ExpandEnvironmentStringsW SetLastError FindResourceExW LockResource WideCharToMultiByte FreeResource GlobalAlloc GlobalUnlock GlobalLock DeleteFileW FindFirstChangeNotificationW FindFirstFileW FindNextChangeNotification FindNextFileW MoveFileW MoveFileExW SetEvent CreateEventW GetFileAttributesW SetFileAttributesW GetProcessTimes TerminateProcess OpenProcess GetModuleHandleExA CreateProcessW WaitForMultipleObjects IsWow64Process LoadLibraryExA OutputDebugStringA FlsSetValue FlsFree Sleep GetCurrentThreadId GetStdHandle GetFileType GetConsoleMode WriteConsoleW FlushFileBuffers GetFileInformationByHandle SetEndOfFile GetCurrentProcess DeviceIoControl ReplaceFileW GetModuleHandleExW FreeEnvironmentStringsW FormatMessageW TlsAlloc GetEnvironmentVariableW FileTimeToSystemTime GetSystemTimeAsFileTime GetVolumeInformationW CreateDirectoryW SetDllDirectoryW HeapSetInformation SetEnvironmentVariableW GetTempPathW LocalFree FindCloseChangeNotification FindClose GlobalFree GetExitCodeProcess WaitForSingleObject CreatePipe SetHandleInformation ReadFile ReOpenFile WriteFile CreateFileW InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy CloseHandle MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentProcessId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetLastError RaiseException DecodePointer OutputDebugStringW GetCommandLineW TlsGetValue TlsSetValue TlsFree ExitProcess CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount RtlUnwind GetCPInfo EncodePointer QueryPerformanceFrequency CreateHardLinkW CopyFileW AreFileApisANSI GetFullPathNameW GetFileAttributesExW FindFirstFileExW GetExitCodeThread WaitForSingleObjectEx GetStringTypeW FormatMessageA InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualQuery VirtualProtect GetSystemInfo GetNativeSystemInfo IsValidCodePage GetACP GetOEMCP GetCommandLineA SetFilePointer

advapi32

RegGetKeySecurity RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW FreeSid RegDeleteKeyExW ConvertSidToStringSidA GetTokenInformation CreateProcessAsUserW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetKeySecurity RegCloseKey RegEnumValueW RegEnumKeyW GetAce SetSecurityDescriptorDacl MakeSelfRelativeSD MakeAbsoluteSD IsValidSid InitializeSid InitializeSecurityDescriptor InitializeAcl GetSidSubAuthority GetSidLengthRequired GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorLength GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorControl GetLengthSid GetAclInformation CopySid AddAce RegGetValueW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW GetNamedSecurityInfoW IsWellKnownSid CheckTokenMembership AllocateAndInitializeSid RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW

shell32

SHGetFolderPathW ShellExecuteW CommandLineToArgvW

ole32

CoTaskMemRealloc CoTaskMemFree IIDFromString CreateStreamOnHGlobal CoTaskMemAlloc CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateInstance

winhttp

WinHttpSetCredentials WinHttpGetProxyForUrl WinHttpGetDefaultProxyConfiguration WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpCloseHandle WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetOption WinHttpConnect WinHttpSetStatusCallback WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryOption

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipDeleteStringFormat GdipCreateStringFormat GdipSetPathGradientFocusScales GdipSetPathGradientGammaCorrection GdipGetPathGradientPointCount GdipSetPathGradientCenterPoint GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientFromPath GdipCreateLineBrush GdipAddPathRectangle GdipAddPathArc GdipClosePathFigures GdipStartPathFigure GdipDeletePath GdipCreatePath GdipPrivateAddMemoryFont GdipSetStringFormatMeasurableCharacterRanges GdipGetStringFormatFlags GdipCloneStringFormat GdipMeasureCharacterRanges GdipMeasureString GdipDrawString GdipGetRegionBounds GdipCreateFontFamilyFromName GdipCreateBitmapFromStream GdipGetImageHeight GdipGetImageWidth GdipFree GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipFillPath GdipDeletePrivateFontCollection GdiplusStartup GdiplusShutdown GdipAlloc GdipCreateRegionRect GdipDeleteRegion GdipCombineRegionRegion GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipSetSolidFillColor GdipCloneImage GdipDisposeImage GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipResetClip GdipSetClipRegion GdipDrawImageRectRect GdipFillRectangle GdipCreateRegion GdipGraphicsClear GdipTranslateWorldTransform GdipSetTextRenderingHint GdipSetSmoothingMode GdipSetCompositingQuality GdipGetCompositingMode GdipSetCompositingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCloneBitmapArea GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipNewPrivateFontCollection

gdi32

DeleteDC CreateDCW GetDeviceCaps DeleteObject

%*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A %*0953Thvm7C6UZ%J;Un>Bjo1A

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

372KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

093421~1.EXE

kernel32

advapi32

shell32

ole32

winhttp

version

gdiplus

gdi32

generic