gs-autopsy[.]exe | Triage™

Resubmissions

23/06/2026, 08:22

260623-j9363sbs8l

23/06/2026, 08:18

260623-j7bztabx3w3

Sharing

Copy URL Twitter E-mail

General

Target
gs-autopsy.exe
Size 2.5MB
Sample260623-j9363sbs8l
SHA256 620d9c21aaaab3913c88aca565def84770e394fc0db48a06a3fdacbf8cef8d2d
MD5 6dfb6d39e2661651fa0dde4fc73780e1
SHA1 6a46cc29842e40e81935209aaef09d60d4624515
SHA512 ccb9dbda8888c20ac79751e772d3274ffbda6fb21bab646fe25747c336b404b53d88b8367b1c418c4e085f3960896020b3ff2e89a8ce8a214a4935a483ee916a
SSDEEP 24576:XWJrxoUZQrlAT81tgGoLWz2yKQDKmsNiffzNfDqIMjPE9UShXNivnDZERa0H+Znn:gZ11tk2yCmskSjmUSOvngEW6lGG
TLSH
T18DC5B5B1F31101EEC917ADBE450F4FAB5AF236A30F2C49C7B1E4E5A4A5721908764DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gs-autopsy.exe

File Explorer

gs-autopsy.exe

.exe 2.5MB

gs-autopsy.exe

IMPHASH a23fcda206ac16965e3bdcf61196b629
SHA256 620d9c21aaaab3913c88aca565def84770e394fc0db48a06a3fdacbf8cef8d2d
MD5 6dfb6d39e2661651fa0dde4fc73780e1
SHA1 6a46cc29842e40e81935209aaef09d60d4624515
SHA512 ccb9dbda8888c20ac79751e772d3274ffbda6fb21bab646fe25747c336b404b53d88b8367b1c418c4e085f3960896020b3ff2e89a8ce8a214a4935a483ee916a
SSDEEP 24576:XWJrxoUZQrlAT81tgGoLWz2yKQDKmsNiffzNfDqIMjPE9UShXNivnDZERa0H+Znn:gZ11tk2yCmskSjmUSOvngEW6lGG
TLSH
T18DC5B5B1F31101EEC917ADBE450F4FAB5AF236A30F2C49C7B1E4E5A4A5721908764DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1084976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoCreateInstance CoInitializeEx

msvcp140

?_Xbad_alloc@std@@YAXXZ _Query_perf_counter _Query_perf_frequency _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?uncaught_exceptions@std@@YAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

gdi32

GetDeviceCaps

dwmapi

DwmExtendFrameIntoClientArea

user32

GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo MonitorFromPoint GetWindowThreadProcessId SetWindowLongA MessageBoxA GetWindowRect SetForegroundWindow UpdateWindow GetSystemMetrics BringWindowToTop IsIconic SetWindowDisplayAffinity SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA PostQuitMessage DefWindowProcA AttachThreadInput PeekMessageA DispatchMessageA TranslateMessage MapVirtualKeyA IsWindow FindWindowA SendInput GetAsyncKeyState EmptyClipboard GetClipboardData SetClipboardData GetKeyState OpenClipboard LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture CloseClipboard

kernel32

GetModuleHandleW GetLastError AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFileMappingA GetFileInformationByHandleEx MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetModuleFileNameA CreateProcessA Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot VirtualAllocEx OpenProcess GetProcessId CloseHandle WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetLocalTime GetCurrentThreadId ExitProcess GetFileAttributesA GetEnvironmentVariableA SetThreadPriority GetCurrentThread GetTickCount64 Sleep SetConsoleMode GetConsoleMode GetStdHandle WideCharToMultiByte GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetLocaleInfoA MultiByteToWideChar LoadLibraryA GetProcAddress WakeAllConditionVariable UnmapViewOfFile GetConsoleWindow GetModuleHandleA FreeLibrary QueryPerformanceFrequency InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter VerSetConditionMask GetCurrentProcessId SetUnhandledExceptionFilter

shell32

ShellExecuteW

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

winmm

timeBeginPeriod

vcruntime140

__std_terminate memset __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler longjmp strrchr memcmp strchr memchr strstr __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strcmp strncpy _stricmp strlen wcslen strncpy_s strcpy_s isdigit tolower strncmp

api-ms-win-crt-math-l1-1-0

fmodf roundf nearbyint __setusermatherr pow logf log atan2f sqrtf ceilf acosf expf sinf cosf floorf powf

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-stdio-l1-1-0

fgetpos fputc fsetpos _fseeki64 setvbuf ungetc _set_fmode __stdio_common_vfprintf __stdio_common_vsprintf_s fgetc __stdio_common_vsscanf __stdio_common_vsprintf fwrite ftell fseek fread fflush fclose _wfopen __acrt_iob_func __p__commode _get_stream_buffer_pointers

api-ms-win-crt-convert-l1-1-0

strtol strtof atof

api-ms-win-crt-runtime-l1-1-0

_c_exit _set_app_type _seh_filter_exe _cexit abort _crt_atexit _configure_narrow_argv terminate __p___argv __p___argc _beginthreadex _initialize_narrow_environment _initialize_onexit_table _exit exit _register_onexit_function _errno _initterm_e _initterm _register_thread_local_exe_atexit_callback _get_initial_narrow_environment

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale