tmp2b1sqg8m[.]exe | Triage™

General

Target
tmp2b1sqg8m.exe
Size 4.1MB
Sample260522-2na8aah171
SHA256 9aa0c49e7ea29a99f65ea9063fdea753f50f931498ef27bd6a60f8f479c22751
MD5 1c7a90b9ddf7e52a546e57fb8b15498c
SHA1 f613cc684cafaca2bb22af7c7e6ab59c743ec61f
SHA512 3ccf806bad37fe56e4d0b89b236dd63624893c01c02c7828cf597b10afc96ff999a954d75a534a1694374ae42c35b828f38b867e96fbc81788632b7d1ec48b58
SSDEEP 98304:VJPBU7H8b+jUc6exLZNw2lwPiQ3oHiifdTW06FvsQS6m+0:beb8b+jL6+L16iGqnd606jm+0
TLSH
T1B7163330BE85F5BAD51B5D358804EFD3693CC831A578CA177B2C6C499A132C98F6236B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
tmp2b1sqg8m.exe

File Explorer

tmp2b1sqg8m.exe

.exe 4.1MB

tmp2b1sqg8m.exe

IMPHASH 337347533a46cb2c3d906f08d6c719e5
SHA256 9aa0c49e7ea29a99f65ea9063fdea753f50f931498ef27bd6a60f8f479c22751
MD5 1c7a90b9ddf7e52a546e57fb8b15498c
SHA1 f613cc684cafaca2bb22af7c7e6ab59c743ec61f
SHA512 3ccf806bad37fe56e4d0b89b236dd63624893c01c02c7828cf597b10afc96ff999a954d75a534a1694374ae42c35b828f38b867e96fbc81788632b7d1ec48b58
SSDEEP 98304:VJPBU7H8b+jUc6exLZNw2lwPiQ3oHiifdTW06FvsQS6m+0:beb8b+jL6+L16iGqnd606jm+0
TLSH
T1B7163330BE85F5BAD51B5D358804EFD3693CC831A578CA177B2C6C499A132C98F6236B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

79:e1:dc:e6:29:52:bb:61:7e:13:cd:4e:5b:ec:5b:c3:e6:d5:38:4a:52:39:c7:b1:dc:21:d4:64:4a:97:1e:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

POSTALCODE=10305

Chains

May 20, 2026

POSTALCODE=10305

Minor OS version

0

Major OS version

5

Entry point

29488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\rojuhuxerep\98\bilocuxup90_pose\cupenofepoxesu-12 guh.pdb

kernel32

IsBadHugeReadPtr SetEndOfFile GetConsoleAliasExesLengthA GetConsoleAliasA HeapFree SetComputerNameW SetThreadExecutionState GetSystemDefaultLCID GetFileAttributesExA GetTickCount EnumCalendarInfoExW ConvertFiberToThread WaitNamedPipeW EnumResourceTypesA FindResourceExA GlobalAlloc ReadConsoleInputA SetVolumeMountPointA GetFileAttributesA WriteConsoleW GetGeoInfoA GetTimeZoneInformation GetBinaryTypeW GetVolumePathNameA IsBadStringPtrA WritePrivateProfileStringW GetCPInfoExW MoveFileExA GetProcAddress VirtualAlloc GlobalGetAtomNameA SetFileAttributesA LoadLibraryA WriteConsoleA InterlockedExchangeAdd LocalAlloc DnsHostnameToComputerNameA GetFileType CreateEventW AddAtomA FoldStringW FindNextFileA SetConsoleCursorInfo GetModuleHandleA FindFirstChangeNotificationA CreateMutexA FindNextFileW VirtualProtect SetFileShortNameA GetVersionExA SetFileValidData FindActCtxSectionStringW LCMapStringW GetLastError TlsGetValue TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RaiseException RtlUnwind HeapAlloc GetModuleHandleW TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle DeleteCriticalSection SetFilePointer Sleep ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc ReadFile CloseHandle CreateFileA InitializeCriticalSectionAndSpinCount SetStdHandle FlushFileBuffers HeapSize GetConsoleOutputCP MultiByteToWideChar LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetProcessHeap

user32

ClientToScreen

advapi32

DeregisterEventSource

Sharing