payload[.]bin | Triage™

Resubmissions

19/04/2026, 09:47

260419-lsb3dacv6x

19/04/2026, 09:34

260419-ljvhcsfv6p5

Sharing

Copy URL Twitter E-mail

General

Target
payload.bin
Size 1.9MB
Sample260419-lsb3dacv6x
SHA256 5bad730cd211e678ee3123197390e9bcc60bd02f7ae4af8f6843cba2123d27e2
MD5 15546f9a26ef3db9301e3f7c420b12e5
SHA1 427d9550b8c51c856b1ea65bbb5264fe5ef8ba6b
SHA512 79cee9fda8a8d362fd26696d47d4525959ae4adeb75a880aa259d77feb186dfe6c370f8aca5ba198a5bd3979bf7673dc7154be49df59514c1df932b2ac9ae13b
SSDEEP 24576:RUfdezfrdY9AD0qvlUWiVBOnAsRqgDsxYfcrBsVUJ1sIJOi6FIjDAImfChldzzfk:auDqpMyBqbRqg4x6i3fJ5YazfxX+
TLSH
T124958DE722E2369DC11BD07E8242FC6FE69FF47D0716EAE38158A6225F17D403A24B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
payload.bin

File Explorer

payload.bin

.exe 1.9MB

payload.bin

IMPHASH 64e5db74235faffca35e1501af5d6941
SHA256 5bad730cd211e678ee3123197390e9bcc60bd02f7ae4af8f6843cba2123d27e2
MD5 15546f9a26ef3db9301e3f7c420b12e5
SHA1 427d9550b8c51c856b1ea65bbb5264fe5ef8ba6b
SHA512 79cee9fda8a8d362fd26696d47d4525959ae4adeb75a880aa259d77feb186dfe6c370f8aca5ba198a5bd3979bf7673dc7154be49df59514c1df932b2ac9ae13b
SSDEEP 24576:RUfdezfrdY9AD0qvlUWiVBOnAsRqgDsxYfcrBsVUJ1sIJOi6FIjDAImfChldzzfk:auDqpMyBqbRqg4x6i3fJ5YazfxX+
TLSH
T124958DE722E2369DC11BD07E8242FC6FE69FF47D0716EAE38158A6225F17D403A24B15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

355240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\RobloxPlayer\Documents\Project\RobloxExternal\x64\Release\Loader.pdb

kernel32

GetCurrentThread VerifyVersionInfoA QueryPerformanceCounter GetTickCount MoveFileExA WaitForSingleObjectEx MultiByteToWideChar GetEnvironmentVariableA GetFileType GetSystemDirectoryA PeekNamedPipe WaitForMultipleObjects SetLastError GetFileAttributesW CreateFileA GetFileSizeEx WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind Sleep GetModuleHandleA GetExitCodeProcess IsWow64Process VirtualFreeEx CreateRemoteThread ReadProcessMemory VirtualAllocEx GetProcAddress VirtualProtectEx LoadLibraryA GetLastError RtlAddFunctionTable WriteProcessMemory ReadFile CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW VirtualAlloc FreeLibrary GetStdHandle GetCurrentProcess SetConsoleTextAttribute InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FormatMessageA QueryPerformanceFrequency VerSetConditionMask SleepEx DeleteCriticalSection

advapi32

CryptEncrypt CryptDestroyHash CryptHashData CryptCreateHash CryptImportKey CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA CryptDestroyKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

msvcp140

?fail@ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ

normaliz

IdnToAscii

wldap32

ord22 ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord301 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertCloseStore CertOpenStore

ws2_32

ntohl closesocket recv send WSAGetLastError bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup accept htonl listen ioctlsocket __WSAFDIsSet select getaddrinfo freeaddrinfo recvfrom sendto gethostname

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __C_specific_handler memchr __std_exception_destroy __std_exception_copy __std_terminate memcpy memset strchr strrchr memmove strstr memcmp

api-ms-win-crt-stdio-l1-1-0

__p__commode fgets __stdio_common_vfprintf fgetc fclose fflush _open _close fwrite ftell __stdio_common_vsprintf _write fseek feof _read fgetpos setvbuf __stdio_common_vsscanf fputs ungetc __acrt_iob_func _set_fmode fopen fputc _get_stream_buffer_pointers _lseeki64 _fseeki64 fread fsetpos

api-ms-win-crt-runtime-l1-1-0

_getpid _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback terminate _c_exit _initialize_narrow_environment _configure_narrow_argv _errno _cexit strerror _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn __p___argv __p___argc _exit exit __sys_nerr _initterm_e _initterm _beginthreadex system

api-ms-win-crt-filesystem-l1-1-0

_lock_file _fstat64 _stat64 _access _unlink _unlock_file

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh realloc calloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strspn isupper strncpy tolower strpbrk _strdup strcmp strcspn strncmp

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi strtoll strtoul strtol

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

347KB

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

payload.bin

kernel32

advapi32

msvcp140

normaliz

wldap32

crypt32

ws2_32

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic