payload_2026-04-17_10-15-57-336736[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
payload_2026-04-17_10-15-57-336736.exe
Size 3.0MB
Sample260418-yr9cpsew2w
SHA256 180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393
MD5 893a4400d0ac1a50fcbb5eb2c18382b8
SHA1 8176000428800beb055f12ed690fb6e45a187ab8
SHA512 7283199446e7f7e95d4bac71e23a810b03d192eb0709ae2d189ce7ce1f0738847cfb05338d104ad531503eb7b31ff93d39aece8a241014edd241fe466f5accf8
SSDEEP 49152:U/5vgQsBZrRf8tGJ2wM9Hlne9tZBR2ooR99f7d5NatnXjueXQpkpnWkKoXT3:UsRfd2fne91K7co
TLSH
T14BE5BE5AD19360EECC2AC170634B6132FE3474599D387E6B7694CB393EB0D603A59F28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
payload_2026-04-17_10-15-57-336736.exe

File Explorer

payload_2026-04-17_10-15-57-336736.exe

.exe 3.0MB

payload_2026-04-17_10-15-57-336736.exe

IMPHASH ed13896c19768acfdb259814af1436d6
SHA256 180f0fef99f3081fec78d07524052a07a975525f04c7b780687b763e2bacd393
MD5 893a4400d0ac1a50fcbb5eb2c18382b8
SHA1 8176000428800beb055f12ed690fb6e45a187ab8
SHA512 7283199446e7f7e95d4bac71e23a810b03d192eb0709ae2d189ce7ce1f0738847cfb05338d104ad531503eb7b31ff93d39aece8a241014edd241fe466f5accf8
SSDEEP 49152:U/5vgQsBZrRf8tGJ2wM9Hlne9tZBR2ooR99f7d5NatnXjueXQpkpnWkKoXT3:UsRfd2fne91K7co
TLSH
T14BE5BE5AD19360EECC2AC170634B6132FE3474599D387E6B7694CB393EB0D603A59F28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext CryptSetKeyParam GetCurrentHwProfileA GetTokenInformation GetUserNameA OpenProcessToken RegCloseKey RegEnumKeyExA RegEnumValueA RegGetValueW RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegQueryValueExW SystemFunction036

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptStringToBinaryA CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject SelectObject SetStretchBltMode StretchBlt

kernel32

AddVectoredExceptionHandler AreFileApisANSI CancelIo CancelIoEx CloseHandle ConnectNamedPipe CopyFileA CopyFileW CreateDirectoryA CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreateNamedPipeW CreateProcessA CreateProcessW CreateRemoteThread CreateThread CreateTimerQueue CreateTimerQueueTimer CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeleteTimerQueue DeleteTimerQueueTimer DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection ExitThread ExpandEnvironmentStringsA FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsA FreeLibrary GetComputerNameA GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDiskFreeSpaceW GetEnvironmentStrings GetEnvironmentVariableA GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetGeoInfoW GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessHeap GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimes GetTempFileNameA GetTempPathA GetTempPathW GetTickCount GetTimeZoneInformation GetUserGeoID GetUserPreferredUILanguages GetVersionExA GetVersionExW GetVolumeInformationA GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDBCSLeadByteEx IsProcessorFeaturePresent IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryW LocalAlloc LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32First Process32Next QueryDosDeviceW QueryFullProcessImageNameA QueryPerformanceCounter ReadFile ReadProcessMemory RemoveDirectoryA ResetEvent SetEndOfFile SetFilePointer SetFilePointerEx SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TerminateThread TlsGetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualLock VirtualProtect VirtualProtectEx VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteProcessMemory __C_specific_handler lstrcmpiA lstrlenA lstrlenW

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _access _amsg_exit _assert _atoi64 _beginthreadex _cexit _commode _errno _fmode _initterm _localtime64 _lock _setjmp _stat64 _strdup _strdup _stricmp _strlwr _strtoui64 _strtoi64 _time64 _unlock _vsnprintf _vsnwprintf _wcsicmp _write abort atexit atoi calloc exit fclose fgets fgetwc fopen fopen_s fprintf fputc fputs free fread fseek ftell fwrite getc getenv isdigit isleadbyte isspace isxdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset qsort raise rand realloc remove signal srand strcat strcat_s strchr strcmp strcpy strcpy_s strcspn strerror strftime strlen strncat strncat_s strncmp strncpy strncpy_s strtoul strrchr strspn strstr strtok strtol swprintf_s tolower toupper towlower ungetc vfprintf wcscat_s wcscmp wcscpy_s wcslen wcsncmp wcsncpy_s wcsstr

rstrtmgr

RmEndSession RmGetList RmRegisterResources RmStartSession

shell32

SHGetFolderPathA

shlwapi

PathRemoveFileSpecA StrChrA StrCmpNIA StrCmpNIW StrStrA StrStrIA

user32

CloseClipboard EnumDisplayDevicesA GetClipboardData GetDC GetForegroundWindow GetKeyboardLayoutList GetSystemMetrics GetWindowTextA IsClipboardFormatAvailable MessageBoxA MessageBoxW OpenClipboard ReleaseDC SystemParametersInfoA

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWriteData

ws2_32

freeaddrinfo getaddrinfo inet_ntop

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25.6MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

payload_2026-04-17_10-15-57-336736.exe

advapi32

bcrypt

crypt32

gdi32

kernel32

msvcrt

rstrtmgr

shell32

shlwapi

user32

winhttp

ws2_32

generic