z7troll[.]exe | Triage™

Resubmissions

28/04/2026, 18:55

260428-xk1ljsdv5t3

17/03/2026, 22:11

260317-138xesfy7x10

Sharing

Copy URL Twitter E-mail

General

Target
z7troll.exe
Size 3.1MB
Sample260317-138xesfy7x
SHA256 e5b3c4e5f21b7297b2f9e4ac2f0be0d9548ea9e8c729cf3624003cd8dd08f34f
MD5 5a269353710e9487f3731bf973412598
SHA1 67ea643b84b2c52e954418040c4e6a5d70680996
SHA512 3d10b9b057062faf5336c8f83c87b7ff2aa5152983ab519e7aaa62ac3f67ccabe05a73e5cf3e258c5335362ccae02cf67bcb7703acba6e5ae126b370a6719462
SSDEEP 49152:zxWRi7FAbN8a1h68S+QmfMWByT8+HE90IFTaaplWMZhSHW:ciKbZ1LHFbplTZhSHW
TLSH
T1BFE5BF67A3A141E8C166D47CC6479713EE71780B072096DB6BE04F5A2FA3BE06A7F341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
z7troll.exe

File Explorer

z7troll.exe

.exe 3.1MB

z7troll.exe

IMPHASH ba216ebc8380af597481e718898bf8c0
SHA256 e5b3c4e5f21b7297b2f9e4ac2f0be0d9548ea9e8c729cf3624003cd8dd08f34f
MD5 5a269353710e9487f3731bf973412598
SHA1 67ea643b84b2c52e954418040c4e6a5d70680996
SHA512 3d10b9b057062faf5336c8f83c87b7ff2aa5152983ab519e7aaa62ac3f67ccabe05a73e5cf3e258c5335362ccae02cf67bcb7703acba6e5ae126b370a6719462
SSDEEP 49152:zxWRi7FAbN8a1h68S+QmfMWByT8+HE90IFTaaplWMZhSHW:ciKbZ1LHFbplTZhSHW
TLSH
T1BFE5BF67A3A141E8C166D47CC6479713EE71780B072096DB6BE04F5A2FA3BE06A7F341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1563908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\haha latei btw\Desktop\fullmetal\lateia-ac fix\x64\Release\Wexize Revamp.pdb

d3dx9_43

D3DXVec3Normalize D3DXMatrixTranspose D3DXVec3Transform

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

TerminateProcess GetProcessId DuplicateHandle GetTickCount64 K32GetModuleFileNameExA CreateThread GetCurrentProcessId K32EnumProcessModules OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent SetPriorityClass FormatMessageA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry VirtualProtect PeekNamedPipe RtlVirtualUnwind WriteProcessMemory SetUnhandledExceptionFilter GetConsoleWindow GetFileType GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime InitializeSListHead GetEnvironmentVariableA QueryPerformanceCounter WaitForSingleObjectEx MoveFileExA FreeLibrary VerSetConditionMask GetProcAddress VerifyVersionInfoA QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalFree GetSystemDirectoryA MultiByteToWideChar ExitProcess SleepEx DeleteCriticalSection InitializeCriticalSectionEx GetModuleHandleW SetProcessPreferredUILanguages SetConsoleTitleA SetConsoleCtrlHandler CreateRemoteThreadEx UnhandledExceptionFilter LeaveCriticalSection EnterCriticalSection CreateFileMappingA UnmapViewOfFile MapViewOfFile Process32FirstW Process32NextW VirtualAlloc IsProcessorFeaturePresent VirtualFree GetLastError GetModuleHandleA GetCurrentProcess GlobalUnlock GetTickCount CreateRemoteThread GlobalLock Beep GlobalAlloc Sleep WideCharToMultiByte ReadProcessMemory VirtualProtectEx CloseHandle Process32Next CreateToolhelp32Snapshot OpenProcess Module32First Module32Next Process32First HeapFree VirtualFreeEx VirtualAllocEx HeapAlloc ReadFile GetFileSizeEx CreateFileA WaitForMultipleObjects SetLastError

user32

GetClipboardData SetWindowDisplayAffinity EmptyClipboard CloseClipboard SetWindowLongA OpenClipboard UpdateWindow FindWindowA PostQuitMessage GetWindowLongPtrA SetClipboardData GetForegroundWindow mouse_event PeekMessageA TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW DestroyWindow GetWindowRect DispatchMessageA GetAsyncKeyState GetCursorPos GetWindowThreadProcessId SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware GetClientRect SetCursor SetCapture GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA GetMessageExtraInfo GetKeyState GetWindowLongA GetWindowTextLengthA IsWindowVisible GetWindowTextA EnumWindows FindWindowW SetWindowsHookA

advapi32

CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt GetTokenInformation OpenProcessToken AdjustTokenPrivileges QueryServiceStatus CloseServiceHandle OpenSCManagerA ControlService OpenServiceA CryptAcquireContextA RegGetValueA

msvcp140

?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Random_device@std@@YAIXZ _Mtx_unlock _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Query_perf_frequency ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

ws2_32

getsockname closesocket recv send WSAGetLastError bind connect getpeername getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup

normaliz

IdnToAscii

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateChain CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChainEngine CertOpenStore

wldap32

ord26 ord27 ord32 ord33 ord41 ord79 ord30 ord200 ord301 ord22 ord35 ord50 ord143 ord60 ord211 ord46 ord217 ord45

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp memchr memset memmove memcpy longjmp __std_exception_destroy __std_exception_copy __std_terminate strstr strchr wcsstr strrchr

api-ms-win-crt-heap-l1-1-0

calloc free malloc _set_new_mode realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _exit terminate _c_exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _beginthreadex exit _cexit strerror _errno _getpid __sys_nerr _crt_atexit _invoke_watson _configure_narrow_argv _get_narrow_winmain_command_line _initialize_narrow_environment _register_onexit_function _initialize_onexit_table

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s _wcsicmp _strdup _stricmp strcmp strpbrk strcspn strspn isupper toupper tolower strncpy

api-ms-win-crt-convert-l1-1-0

atoi strtod strtoull atof strtoul strtoll strtol

api-ms-win-crt-math-l1-1-0

logf pow powf log sinf sqrt fmodf cosf sqrtf atan2f acosf _hypotf _dclass _dsign ceilf __setusermatherr

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf _set_fmode __stdio_common_vsscanf fputc _open fflush fclose _close _lseeki64 _write fgets fgetc _read feof fputs fopen fwrite fgetpos setvbuf ungetc fsetpos fread __stdio_common_vsprintf_s _wfopen _fseeki64 __p__commode __stdio_common_vfprintf fseek __acrt_iob_func ftell _get_stream_buffer_pointers

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _stat64 _unlock_file _lock_file _unlink _access

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64