PathsParser[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PathsParser.exe
Size 2.6MB
Sample260705-gz5aaaes8m
SHA256 2ea132306a724cd5980e635c3b4a372cf066bb1b11ed70056950a4cf058fdf79
MD5 6b094ebdbec2be724c5451596dc48da9
SHA1 d0ce097b13f247a15396e58ebacb3a857ec6bfa8
SHA512 d3ab0115df278ff17ea95c7cec923e581b7023533b203448fce194a6ce87bda9b9e8de91031faf965501f978d9b8d730a0a08eec88bdd9329413780942857602
SSDEEP 49152:3OjPWvLTKuk2bYIU6i/X+QJWHMCr/BOCBTn4PapOh5PSsMpiPlZTfax:Jn+/OQQs2kCJlpiZC
TLSH
T1C7C57C1292DC2DEAD53A8378855F4207F2B1B05513B06BEB05AC4A650F93BD4EF3E786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
PathsParser.exe

File Explorer

PathsParser.exe

.exe 2.6MB

PathsParser.exe

IMPHASH 309236e950efcbd99096de7c5c580a66
SHA256 2ea132306a724cd5980e635c3b4a372cf066bb1b11ed70056950a4cf058fdf79
MD5 6b094ebdbec2be724c5451596dc48da9
SHA1 d0ce097b13f247a15396e58ebacb3a857ec6bfa8
SHA512 d3ab0115df278ff17ea95c7cec923e581b7023533b203448fce194a6ce87bda9b9e8de91031faf965501f978d9b8d730a0a08eec88bdd9329413780942857602
SSDEEP 49152:3OjPWvLTKuk2bYIU6i/X+QJWHMCr/BOCBTn4PapOh5PSsMpiPlZTfax:Jn+/OQQs2kCJlpiZC
TLSH
T1C7C57C1292DC2DEAD53A8378855F4207F2B1B05513B06BEB05AC4A650F93BD4EF3E786
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

97:9d:30:b9:22:10:50:0e:f4:ea:e0:a7:9e:64:36:80:60:ec:15:4f:aa:56:7f:dd:05:3f:e2:50:e7:02:c9:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=espouken

Chains

May 28, 2025

CN=espouken

Minor OS version

Major OS version

Entry point

1926608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\Desktop\disco C\tools\pathsparser\x64\Release\PathsParser.pdb

kernel32

CreateProcessA WideCharToMultiByte CloseHandle CreateFileA GetFileSizeEx GetFileAttributesA GetLastError GetFileAttributesW HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree GetCurrentThreadId TlsAlloc TlsGetValue CreateFileW WaitForSingleObject GetTempPathW GetModuleFileNameW GetCurrentProcess ReadFile CreateDirectoryW SetConsoleOutputCP SetConsoleCP WriteConsoleW MultiByteToWideChar GetStdHandle SetConsoleTitleA SetConsoleTextAttribute TlsSetValue TlsFree QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx FormatMessageA LocalFree ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode FindNextFileW FindFirstFileW FindClose LoadLibraryW LoadLibraryA FreeLibrary ConvertFiberToThread GetSystemTimeAsFileTime DeleteFiber RtlVirtualUnwind GetModuleHandleExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetModuleHandleA SwitchToThread GetCurrentProcessId SetLastError GetProcAddress GetModuleHandleW WriteFile GetFileType GetEnvironmentVariableW

advapi32

CryptAcquireContextW AdjustTokenPrivileges CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext LookupPrivilegeValueA ReportEventW RegisterEventSourceW DeregisterEventSource OpenProcessToken

crypt32

CertCloseStore CertFreeCertificateContext CertNameToStrA CertDuplicateCertificateContext CertGetCertificateContextProperty CertEnumCertificatesInStore CertOpenStore CertFindCertificateInStore

ws2_32

WSAGetLastError WSACleanup closesocket recv send WSASetLastError

msvcp140

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Syserror_map@std@@YAPEBDH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z _Mtx_unlock _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Xlength_error@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_hardware_concurrency ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

wintrust

WTHelperProvDataFromStateData CryptCATAdminReleaseCatalogContext WTHelperGetProvSignerFromChain WinVerifyTrust CryptCATAdminEnumCatalogFromHash WTHelperGetProvCertFromChain CryptCATAdminAcquireContext CryptCATCatalogInfoFromContext CryptCATAdminReleaseContext CryptCATAdminCalcHashFromFileHandle

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy __std_exception_destroy memcmp _CxxThrowException __std_exception_copy __current_exception_context memset strrchr strstr longjmp __C_specific_handler __current_exception __std_terminate memchr __intrinsic_setjmp wcsstr memmove strchr

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free malloc realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _invalid_parameter_noinfo_noreturn _wassert _errno abort _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv signal raise strerror_s system

api-ms-win-crt-stdio-l1-1-0

_wfopen fwrite fgetpos _setmode _fileno fgets feof setvbuf fflush fputs __stdio_common_vswprintf _set_fmode ungetc __p__commode fsetpos fread _fseeki64 _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vfprintf fclose _read fopen fseek ftell __stdio_common_vsscanf getc ferror clearerr __stdio_common_vsprintf _close fgetc _sopen_s _filelength fputc

api-ms-win-crt-string-l1-1-0

strnlen isprint strspn tolower strcmp isdigit _stricmp _strnicmp strncmp strncpy isxdigit strcspn _strdup isspace isalpha

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _unlock_file _lock_file

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-time-l1-1-0

_time64 _mkgmtime64 _gmtime64_s

api-ms-win-crt-convert-l1-1-0

atof strtoul strtod strtoll strtol _strtoi64 atoi

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr log2 pow _isnan ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-environment-l1-1-0

getenv

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW