prestige_20260426_161749_1d1738eb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
prestige_20260426_161749_1d1738eb.exe
Size 3.7MB
Sample260706-r3rtgact2j
SHA256 1e7f8b2243489e17ee1049467a014db24987cfdc9acc20fdb5ec4633c8e798a3
MD5 8c029236e95ffb38cbe66f21e71e0e2e
SHA1 b82e32864d64e6014cc48c074199cc61dccb5e2c
SHA512 451604e111c06f540448d7ceef3ae644af0f6784e94a084faff6d3481ae8969093f8549674097ddec568120237cb0526f5812627dcd093c133e2e763bc020b58
SSDEEP 49152:llk1cJnhVlLLZ9iYuFKMG+q6GSk/03SyCrM6s7ijCpywC364Pk08RA8Sc8Z0asqh:MsnbRuS1DhVnked8SfZErpM
TLSH
T117068C03F29880E8D0AEC178C35B9637EB72B88A4634B69F17D55B112F67F615B2D348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
prestige_20260426_161749_1d1738eb.exe

File Explorer

prestige_20260426_161749_1d1738eb.exe

.dll 3.7MB

prestige_20260426_161749_1d1738eb.exe

IMPHASH c961ef517cfb7a550949130c7b0cb0e7
SHA256 1e7f8b2243489e17ee1049467a014db24987cfdc9acc20fdb5ec4633c8e798a3
MD5 8c029236e95ffb38cbe66f21e71e0e2e
SHA1 b82e32864d64e6014cc48c074199cc61dccb5e2c
SHA512 451604e111c06f540448d7ceef3ae644af0f6784e94a084faff6d3481ae8969093f8549674097ddec568120237cb0526f5812627dcd093c133e2e763bc020b58
SSDEEP 49152:llk1cJnhVlLLZ9iYuFKMG+q6GSk/03SyCrM6s7ijCpywC364Pk08RA8Sc8Z0asqh:MsnbRuS1DhVnked8SfZErpM
TLSH
T117068C03F29880E8D0AEC178C35B9637EB72B88A4634B69F17D55B112F67F615B2D348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

1234

Minor OS version

Major OS version

Entry point

2598548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

CreateMutexW CreateProcessW ExitProcess TerminateProcess InitializeProcThreadAttributeList GetDiskFreeSpaceExW OpenThread SetNamedPipeHandleState CompareStringW InitializeCriticalSectionEx GetTimeZoneInformation RtlPcToFileHeader VirtualProtect GlobalUnlock GlobalMemoryStatusEx GetModuleHandleA VirtualFree LCMapStringW InitializeCriticalSectionAndSpinCount GetDriveTypeW GetLogicalDriveStringsW GetCurrentThread GetCurrentProcessId EncodePointer InterlockedFlushSList GetCurrentProcess DeleteProcThreadAttributeList UpdateProcThreadAttribute GetProcAddress ResumeThread SuspendThread GetLogicalDrives LocalFree GetVolumeInformationW VirtualAlloc GetModuleHandleW Sleep DeleteFileW WriteFile FindClose FindNextFileW FindFirstFileW CreateFileW GetTempPathW GetModuleFileNameW GetComputerNameExW GetSystemInfo GlobalLock RtlUnwindEx DuplicateHandle InitializeSListHead SetUnhandledExceptionFilter SetHandleInformation UnhandledExceptionFilter SetStdHandle FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStartupInfoW IsProcessorFeaturePresent OpenProcess RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ReadFile GetOverlappedResult CancelIoEx PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetExitCodeProcess GetSystemTimePreciseAsFileTime WriteFileEx GetWindowsDirectoryW CreateIoCompletionPort SetFileCompletionNotificationModes GetSystemDirectoryW FormatMessageW CompareStringOrdinal LoadLibraryExA FreeEnvironmentStringsW SleepEx ReadFileEx GetLastError IsValidCodePage GetACP GetOEMCP GetCPInfo WaitForMultipleObjects CreateThread SetWaitableTimer CreateWaitableTimerExW GetCommandLineA CloseHandle HeapFree GetConsoleOutputCP HeapAlloc GetProcessHeap GetStringTypeW GetTimeZoneInformationForYear IsDebuggerPresent GetStdHandle WriteConsoleW WaitForDebugEvent DebugActiveProcessStop Thread32First Thread32Next ReadProcessMemory CancelIo QueryPerformanceFrequency GetThreadContext SetThreadContext ContinueDebugEvent Process32Next Process32First CreateToolhelp32Snapshot SetEnvironmentVariableW GetFileType FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW HeapReAlloc DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW WaitForSingleObject UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetConsoleMode FindFirstFileExW GetFileInformationByHandle CreateEventW SwitchToThread GetFileInformationByHandleEx GetFinalPathNameByHandleW CreateDirectoryW CopyFileExW GetCommandLineW GetEnvironmentVariableW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError SetThreadStackGuarantee SetFileTime SetFileInformationByHandle SetFilePointerEx ReleaseMutex lstrlenW CreateMutexA

bcryptprimitives

ProcessPrng

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW RegQueryValueExW RegCloseKey RegDeleteValueW ImpersonateLoggedOnUser RegCreateKeyExW RegCreateKeyTransactedW RegOpenKeyTransactedW RegEnumKeyExW RegEnumValueW DuplicateTokenEx CredEnumerateW RegSetValueExW OpenProcessToken CredFree OpenEventLogW CloseEventLog SystemFunction036 ClearEventLogW

oleaut32

SysStringLen SysFreeString

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSASend WSAIoctl ioctlsocket send recv bind getsockopt WSASocketW shutdown WSAStartup getsockname WSACleanup connect setsockopt closesocket getpeername freeaddrinfo getaddrinfo WSAGetLastError

crypt32

CertAddCertificateContextToStore CertOpenStore CertEnumCertificatesInStore CertDuplicateStore CertVerifyCertificateChainPolicy CertGetCertificateChain CryptUnprotectData CertCloseStore CertFreeCertificateChain CertFreeCertificateContext CertDuplicateCertificateChain CertDuplicateCertificateContext

secur32

FreeCredentialsHandle ApplyControlToken EncryptMessage DecryptMessage DeleteSecurityContext QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext AcquireCredentialsHandleA

ntdll

NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx RtlNtStatusToDosError

bcrypt

BCryptGenRandom

user32

OpenClipboard ShowWindow GetWindowThreadProcessId ReleaseDC GetDC CloseClipboard GetSystemMetrics GetClipboardSequenceNumber EnumWindows GetClipboardData

gdi32

CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject BitBlt GetDIBits DeleteObject

Name

.xp5gi2n

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.78o5yvb

Size

951KB

Virtual Size

950KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.7o5wqmd

Size

35KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ouahnrz

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dnsnapr

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.hlssecv

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

prestige_20260426_161749_1d1738eb.exe

kernel32

bcryptprimitives

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

ws2_32

crypt32

secur32

ntdll

bcrypt

user32

gdi32

generic