idk[.]exe | Triage™

Resubmissions

26/06/2026, 14:42

260626-r21d8acs6y

26/06/2026, 12:43

260626-pyc4eact3l3

26/06/2026, 12:43

260626-px2qdact2p3

Sharing

Copy URL Twitter E-mail

General

Target
idk.exe
Size 172KB
Sample260626-px2qdact2p
SHA256 2082603358d16c0c77fd942069cbe05a8de3c1ed6124dd2405b1e8a1d5b5962c
MD5 3303cd5f2692021684b107a39a6dad04
SHA1 916b5963414b356b804d67c198456921326c3bb3
SHA512 b565716423a119f3476ff2fb2fb086ee4525e3827aa552faba292f0bf6eb837535be22331572b3164937d48a966e8396fb48d4958fb49d921f74667ed932dfb3
SSDEEP 1536:JgfQdwOJgBIYvH5MAwdUeeZifnG6mLttPBHi0GBXpJsD9H:+fgwOcIYvZMrUee+G6mLttPBspypH
TLSH
T18304B72A32690CB2C9A6C07AAC428367CDB03455133D95FF9181C9D9AF327ECBA7CD55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
idk.exe

File Explorer

idk.exe

.exe 172KB

idk.exe

IMPHASH 6369c3601f252fa1d99224db84f49008
SHA256 2082603358d16c0c77fd942069cbe05a8de3c1ed6124dd2405b1e8a1d5b5962c
MD5 3303cd5f2692021684b107a39a6dad04
SHA1 916b5963414b356b804d67c198456921326c3bb3
SHA512 b565716423a119f3476ff2fb2fb086ee4525e3827aa552faba292f0bf6eb837535be22331572b3164937d48a966e8396fb48d4958fb49d921f74667ed932dfb3
SSDEEP 1536:JgfQdwOJgBIYvH5MAwdUeeZifnG6mLttPBHi0GBXpJsD9H:+fgwOcIYvZMrUee+G6mLttPBspypH
TLSH
T18304B72A32690CB2C9A6C07AAC428367CDB03455133D95FF9181C9D9AF327ECBA7CD55
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71267

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\yassin\source\repos\idk\x64\Debug\idk.pdb

kernel32

QueueUserAPC GetCurrentProcessId CreateThread OpenThread SuspendThread ResumeThread OpenProcess GlobalMemoryStatusEx GetTickCount GetTickCount64 VirtualProtect VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetModuleHandleA GetProcAddress lstrcmpiW Sleep MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead CloseHandle IsDebuggerPresent SetFileAttributesA GetDiskFreeSpaceExA GetSystemTimeAsFileTime QueryPerformanceCounter WideCharToMultiByte RaiseException GetCurrentThreadId CopyFileA CreateDirectoryA FreeLibrary

user32

TranslateMessage CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA MessageBoxA DispatchMessageW GetMessageW

advapi32

RegOpenKeyExA RegSetValueExA RegCloseKey

shell32

SHGetFolderPathA

msvcp140d

?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ ?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Xout_of_range@std@@YAXPEBD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

iphlpapi

GetAdaptersInfo

vcruntime140d

__current_exception_context __current_exception __vcrt_GetModuleHandleW __std_type_info_destroy_list __C_specific_handler_noexcept __C_specific_handler memset __vcrt_LoadLibraryExW _CxxThrowException __std_exception_destroy memcmp memcpy memmove __vcrt_GetModuleFileNameW __std_exception_copy

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

ungetc _lock_file _unlock_file __stdio_common_vfprintf _calloc_dbg _CrtDbgReport _free_dbg _malloc_dbg _callnewh malloc _CrtDbgReportW _seh_filter_exe _set_app_type __setusermatherr fsetpos _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_fmode __p___argc __p___argv _cexit _c_exit fwrite _configthreadlocale _set_new_mode __p__commode _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit strcpy_s strcat_s __stdio_common_vsprintf_s terminate _wmakepath_s _wsplitpath_s wcscpy_s fread fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers __acrt_iob_func system strlen setvbuf _register_thread_local_exe_atexit_callback _fseeki64 _configure_narrow_argv wcslen

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

idk.exe

kernel32

user32

advapi32

shell32

msvcp140d

iphlpapi

vcruntime140d

vcruntime140_1d

ucrtbased

generic