meditate[.]exe | Triage™

Resubmissions

15/04/2026, 22:41

260415-2mcdysdx3z3

15/04/2026, 22:35

260415-2hr9lsbt3l3

Sharing

Copy URL Twitter E-mail

General

Target
meditate.exe
Size 4.2MB
Sample260415-2hr9lsbt3l
SHA256 bfd6b3bb81b8da4b3eec719582e6253eb639f201cd4ee2991420d12a4eb892fb
MD5 d96fc53be609ea1b77bc07dbd2115012
SHA1 22c44b62bb7dbe28cdab27c5b65172c184ff667f
SHA512 59bb3e3b14ad46f3e3228024b85e924e267556820e30873bdd312726c22db3cc6e532b941ec6125a50b99eb49098d11f5b338e3a8d5c8d71834b0935044c788c
SSDEEP 49152:9Vl4P+jj3LbpThp/sz0sQTR/t6Wei0ErvdDCF9EklZqA9P0FRS7ICQvj9QAHOdT:9JNTk0sQTl29EklZqA9P0FRHNZbOdT
TLSH
T13716AE42B351C194D526E438CD52E6ABE2317C041F2297EB32A87F1B6F732E11EB6B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
meditate.exe

File Explorer

meditate.exe

.exe 4.2MB

meditate.exe

IMPHASH e3d8717214e015fffc815e30fd0ce558
SHA256 bfd6b3bb81b8da4b3eec719582e6253eb639f201cd4ee2991420d12a4eb892fb
MD5 d96fc53be609ea1b77bc07dbd2115012
SHA1 22c44b62bb7dbe28cdab27c5b65172c184ff667f
SHA512 59bb3e3b14ad46f3e3228024b85e924e267556820e30873bdd312726c22db3cc6e532b941ec6125a50b99eb49098d11f5b338e3a8d5c8d71834b0935044c788c
SSDEEP 49152:9Vl4P+jj3LbpThp/sz0sQTR/t6Wei0ErvdDCF9EklZqA9P0FRS7ICQvj9QAHOdT:9JNTk0sQTl29EklZqA9P0FRHNZbOdT
TLSH
T13716AE42B351C194D526E438CD52E6ABE2317C041F2297EB32A87F1B6F732E11EB6B51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1445576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\1223\Downloads\emsabkwasdwasdwas\inferno\x64\Release\inferno.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winmm

PlaySoundA

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpOpenRequest WinHttpReadData WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders

kernel32

SetConsoleTextAttribute GetStdHandle VirtualAlloc OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle K32GetModuleBaseNameA K32EnumProcessModules MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter VirtualProtect EnterCriticalSection GetCurrentProcess OutputDebugStringA TerminateProcess SetThreadPriority LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableA GetFileAttributesW Sleep Process32NextW GetCurrentThread Process32FirstW RaiseException CreateThread AddVectoredExceptionHandler GetThreadContext ExitProcess SleepConditionVariableSRW FlushInstructionCache GetLocaleInfoEx IsDebuggerPresent GetComputerNameA CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead FormatMessageA LocalFree VirtualQuery AcquireSRWLockExclusive GetCurrentThreadId ReleaseSRWLockExclusive GetCurrentProcessId

user32

DispatchMessageA GetWindowRect DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics UnregisterClassW SendInput RegisterClassExW ShowWindow SetWindowLongA SetWindowDisplayAffinity DefWindowProcW GetWindowTextW MoveWindow TranslateMessage PeekMessageA PostQuitMessage UpdateWindow OpenClipboard GetCursorPos GetAsyncKeyState ScreenToClient EnumWindows GetClipboardData SetCursorPos SetClipboardData EmptyClipboard GetMonitorInfoA ReleaseCapture IsWindowUnicode GetWindowThreadProcessId GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent CloseClipboard ClientToScreen GetCapture MonitorFromWindow GetWindow LoadCursorA GetMessageExtraInfo GetKeyState IsWindowVisible GetWindowTextA

advapi32

RegQueryValueExA GetUserNameA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteW

msvcp140

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

shlwapi

StrStrIA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

longjmp __std_exception_destroy __std_exception_copy __std_terminate strstr strchr _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception memcmp memchr memset memmove memcpy strrchr __C_specific_handler

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode malloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

__p___argv _c_exit _register_thread_local_exe_atexit_callback _errno _exit abort _initterm_e _invoke_watson _beginthreadex system __p___argc _initterm _get_initial_narrow_environment _set_app_type terminate _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit

api-ms-win-crt-utility-l1-1-0

rand qsort srand

api-ms-win-crt-string-l1-1-0

strncmp strncpy_s strncpy isalnum _wcsicmp toupper isdigit strcmp tolower

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf ftell __acrt_iob_func fflush __stdio_common_vsprintf_s __p__commode _fseeki64 fsetpos ungetc setvbuf fgetpos _set_fmode fgetc fclose fputc _get_stream_buffer_pointers fseek __stdio_common_vsscanf fread _wfopen fwrite __stdio_common_vfprintf

api-ms-win-crt-math-l1-1-0

ilogb _dsign nearbyint _dclass _fdclass acosf atan2f ceil ceilf cosf expf floorf fmodf log sinf logf ldexp __setusermatherr pow powf roundf sqrtf round

api-ms-win-crt-convert-l1-1-0

strtoll strtol atoi atof strtoull strtod

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

_time64