main3[.]exe | Triage™

Resubmissions

27/04/2026, 11:33

260427-nn5v1acx4m9

27/04/2026, 11:24

260427-nhr2yscv9j9

27/04/2026, 11:18

260427-nec4macv4k9

Sharing

Copy URL Twitter E-mail

General

Target
main3.exe
Size 51.9MB
Sample260427-nhr2yscv9j
SHA256 406e80fc0a2d13eda8c21a4585e2eee91482ada9ce7bbf35d3f6c050f70bc27c
MD5 134f36017a71db319fd4a1fe4846a508
SHA1 441acaf87391993d7631f678d42e07be12eeb3a9
SHA512 f5ab4d43ab27db3877154822934a07a31a6b3d9a6e057589458ae136032e1d512e2c56f44d592f8f5031828ab500e8fffcb4a6529f9fb97090f25c02038a92f0
SSDEEP 393216:UPiPBmzWjK72kb7zWjK72yPA8EwXtrs2NuDYV0LP1CPwDvt3uFhC4Sx8Fe9Xbpho:UuYzWjK72kXzWjK72yPhbVSLkbeOh
TLSH
T124C79D0276644055FA38D0788593B552DB39BCA727E092DB329CB2782FB3BE11F7E644
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
main3.exe

File Explorer

main3.exe

.exe 51.9MB

main3.exe

IMPHASH 2bc8ad2a2d939416e86d7fe15bb05c4c
SHA256 406e80fc0a2d13eda8c21a4585e2eee91482ada9ce7bbf35d3f6c050f70bc27c
MD5 134f36017a71db319fd4a1fe4846a508
SHA1 441acaf87391993d7631f678d42e07be12eeb3a9
SHA512 f5ab4d43ab27db3877154822934a07a31a6b3d9a6e057589458ae136032e1d512e2c56f44d592f8f5031828ab500e8fffcb4a6529f9fb97090f25c02038a92f0
SSDEEP 393216:UPiPBmzWjK72kb7zWjK72yPA8EwXtrs2NuDYV0LP1CPwDvt3uFhC4Sx8Fe9Xbpho:UuYzWjK72kXzWjK72yPhbVSLkbeOh
TLSH
T124C79D0276644055FA38D0788593B552DB39BCA727E092DB329CB2782FB3BE11F7E644
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Password

Test0101!

Minor OS version

Major OS version

Entry point

17040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-crt-convert-l1-1-0

mbstowcs wcstoul

api-ms-win-crt-filesystem-l1-1-0

_wrename

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc

api-ms-win-crt-private-l1-1-0

__C_specific_handler wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf fwrite puts

api-ms-win-crt-string-l1-1-0

_wcsdup _wcsicmp iswctype strcat strcpy strncpy wcscmp wcslen wcsncmp

kernel32

AddDllDirectory CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceA FormatMessageA GetCommandLineW GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetProcAddress GetShortPathNameW GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryExW LoadResource LockResource MapViewOfFile OpenProcess ReadFile SetConsoleCtrlHandler SetDllDirectoryW SetEnvironmentVariableW SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron

Name

.text

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

972B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

51.8MB

Virtual Size

51.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

main3.exe

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

shell32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic