OpenIV[.]exe | Triage™

Resubmissions

02/07/2026, 19:55

260702-ym7cjsav6m

02/07/2026, 19:52

260702-yldnvadw8y3

Sharing

Copy URL Twitter E-mail

General

Target
OpenIV.exe
Size 2.0MB
Sample260702-ym7cjsav6m
SHA256 f989c4b78b3d310992e6a7808671e38ea007effe52f7c1bd8e23cab021c082e4
MD5 6ef4390d9ed9c9a48fb45549dc7c2547
SHA1 c0ea6ab9acc8f56c29646aeeba02439b3c5ee1ea
SHA512 8916120fe08ac6bdec0aee682f1379a07c1c2d8ecd1a7c83d58b47b071068f6aedee49413b85319fd860a5b0fb6fdf5fa856837e5608000ee1517464a826836a
SSDEEP 49152:GlIiTK+mpLcCwyhnVeQugq1NTxoPCdIA1sITLl3oKJ6mEO2ljI:GPXxoE
TLSH
T105A5C0B971583398C06BC9789923FD17F676350D07B186EF37C6B6802F9A1D09A79B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OpenIV.exe

File Explorer

OpenIV.exe

.exe 2.0MB

OpenIV.exe

IMPHASH e956393295db21e03a160a9fa96f2926
SHA256 f989c4b78b3d310992e6a7808671e38ea007effe52f7c1bd8e23cab021c082e4
MD5 6ef4390d9ed9c9a48fb45549dc7c2547
SHA1 c0ea6ab9acc8f56c29646aeeba02439b3c5ee1ea
SHA512 8916120fe08ac6bdec0aee682f1379a07c1c2d8ecd1a7c83d58b47b071068f6aedee49413b85319fd860a5b0fb6fdf5fa856837e5608000ee1517464a826836a
SSDEEP 49152:GlIiTK+mpLcCwyhnVeQugq1NTxoPCdIA1sITLl3oKJ6mEO2ljI:GPXxoE
TLSH
T105A5C0B971583398C06BC9789923FD17F676350D07B186EF37C6B6802F9A1D09A79B02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

495712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemory

kernel32

GetLastError Process32NextW SetFileInformationByHandle DeleteFileW Process32FirstW CloseHandle GetSystemInfo GetProcAddress LocalFree MoveFileExW GetFileSize ReadProcessMemory CreateProcessW GetModuleHandleW WideCharToMultiByte GetTempFileNameW GetTickCount MoveFileW VirtualQueryEx GetCurrentProcessId GetCurrentThreadId LoadLibraryA FreeLibrary CompareFileTime GetFileAttributesW Thread32Next Thread32First SuspendThread ResumeThread GetModuleHandleA GetTickCount64 GetThreadTimes OpenThread Sleep SetConsoleTextAttribute SetConsoleTitleA GetStdHandle ExitProcess AllocConsole SetConsoleTitleW GlobalAlloc GlobalFree GlobalLock GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter GetStartupInfoW GetCommandLineW WakeAllConditionVariable GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SetUnhandledExceptionFilter CreateFileW LocalAlloc WaitForSingleObject GetTempPathW SetEndOfFile SetFilePointer CreatePipe GetModuleFileNameW TerminateProcess WriteFile GetCurrentProcess WriteProcessMemory MultiByteToWideChar CreateToolhelp32Snapshot SetFileAttributesW AreFileApisANSI GetSystemTimeAsFileTime InitializeSListHead CreateFile2 GetFileAttributesExW FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW OpenProcess FindFirstFileExW K32GetMappedFileNameA FindNextFileW SleepConditionVariableSRW

user32

MapWindowPoints SetWindowDisplayAffinity MoveWindow DefWindowProcW GetSystemMetrics SetWindowLongW GetWindowRect SetForegroundWindow GetKeyState ScreenToClient GetCapture ClientToScreen IsChild GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetWindowLongW TranslateMessage GetDesktopWindow GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState DispatchMessageW PeekMessageW

advapi32

AdjustTokenPrivileges RevertToSelf RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW InitializeSecurityDescriptor FreeSid OpenProcessToken RegSetKeySecurity RegEnumKeyExW SetEntriesInAclW AllocateAndInitializeSid OpenSCManagerW CloseServiceHandle RegQueryInfoKeyW RegCloseKey RegGetKeySecurity DuplicateTokenEx SetSecurityDescriptorDacl LookupPrivilegeValueW PrivilegeCheck SetTokenInformation SetThreadToken GetTokenInformation RegQueryValueExW CreateProcessAsUserW

shell32

SHGetFolderPathW

ole32

CoInitializeEx

msvcp140

?_Random_device@std@@YAIXZ _Cnd_do_broadcast_at_thread_exit _Query_perf_counter ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Thrd_detach _Mtx_lock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z __crtLCMapStringA _Query_perf_frequency ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??_7_Facet_base@std@@6B@ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??_7facet@locale@std@@6B@ _Strcoll ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

shlwapi

PathStripPathW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memmove memchr memcpy __std_exception_destroy __std_exception_copy __std_type_info_compare strchr __RTtypeid strstr memcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vsscanf _wfopen fgetc freopen_s fseek __acrt_iob_func ftell _set_fmode fwrite fgetpos setvbuf ungetc __p__commode fsetpos fflush __stdio_common_vsprintf fclose fread _get_stream_buffer_pointers _fseeki64 fputc

api-ms-win-crt-heap-l1-1-0

_callnewh realloc free _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

tolower _wcsicmp towlower wcscpy_s strcmp strlen wcslen

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-runtime-l1-1-0

_exit _register_thread_local_exe_atexit_callback _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _c_exit _set_app_type _seh_filter_exe _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table _beginthreadex abort exit _initterm_e _wsystem

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

sqrtf sqrt ceilf atan2f asinf acosf floorf cosf logf powf __setusermatherr sinf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___lc_locale_name_func _configthreadlocale ___lc_collate_cp_func