ETA[.]exe | Triage™

Resubmissions

07/07/2026, 12:36

260707-ps9kesh13x3

07/07/2026, 12:35

260707-psttzah12w3

Sharing

Copy URL Twitter E-mail

General

Target
ETA.exe
Size 1.5MB
Sample260707-ps9kesh13x
SHA256 2b3f6ec7ddd2834ba78499cb9bd9de3d8501b2b457b78f497cf6639d5de2a360
MD5 d9643f49f66991c56b661b9cc63eeb04
SHA1 a5dbec499d8f7cde32a0997a520c63dd2f370644
SHA512 50461d4bace9b95adeb7e67eb30dd47f052059230f1d24ca383358752c2d93457c4f5ff9e93777254d7afea7294c555a0d6abb10108faffa90a48fc80bacb106
SSDEEP 24576:Ua35/EHdnEyKN+9cMEZ+8vxRWlGDPpkFALMT4xNjkvisbTFNlZvdimnKAHyv:3p8ej+9cPZharFALM+jKisvfMmnov
TLSH
T14975AF49E2E440FCD067C134C696AA1BE73574090B249EEF13E44E9A7F63BE25B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ETA.exe

File Explorer

ETA.exe

.exe 1.5MB

ETA.exe

IMPHASH 9e9bb4c81af92c43e50fd9b82500bf56
SHA256 2b3f6ec7ddd2834ba78499cb9bd9de3d8501b2b457b78f497cf6639d5de2a360
MD5 d9643f49f66991c56b661b9cc63eeb04
SHA1 a5dbec499d8f7cde32a0997a520c63dd2f370644
SHA512 50461d4bace9b95adeb7e67eb30dd47f052059230f1d24ca383358752c2d93457c4f5ff9e93777254d7afea7294c555a0d6abb10108faffa90a48fc80bacb106
SSDEEP 24576:Ua35/EHdnEyKN+9cMEZ+8vxRWlGDPpkFALMT4xNjkvisbTFNlZvdimnKAHyv:3p8ej+9cPZharFALM+jKisvfMmnov
TLSH
T14975AF49E2E440FCD067C134C696AA1BE73574090B249EEF13E44E9A7F63BE25B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1038944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GetTickCount64 GetCurrentThread QueryPerformanceFrequency CloseHandle GetProcAddress QueryPerformanceCounter AllocConsole OpenProcess CreateToolhelp32Snapshot Process32NextW Module32FirstW ReadProcessMemory GetModuleHandleW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA FreeLibrary CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter Sleep RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA TerminateProcess ExitProcess GetCurrentProcess GetModuleFileNameW WriteFile GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RtlUnwind EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader GetModuleHandleA GetCurrentThreadId SetThreadPriority SetEnvironmentVariableW RtlUnwindEx RtlLookupFunctionEntry FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime FindFirstFileExW GetCurrentProcessId WakeAllConditionVariable SetStdHandle GetStringTypeW CreateFileW SetEndOfFile HeapSize IsDebuggerPresent WriteConsoleW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW GetLastError FindClose

user32

SetWindowsHookExW FindWindowW TranslateMessage SendInput PeekMessageW DispatchMessageW GetAsyncKeyState MsgWaitForMultipleObjects CallNextHookEx GetCursorPos UnhookWindowsHookEx PostMessageW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow IsWindow GetForegroundWindow SetLayeredWindowAttributes LoadCursorW SetCursor SetWindowLongW PostQuitMessage UpdateWindow SetForegroundWindow

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoUninitialize

winmm

timeBeginPeriod timeEndPeriod

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle InternetReadFile

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

316KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ETA.exe

d3d11

dwmapi

kernel32

user32

shell32

ole32

winmm

wininet

winhttp

imm32

d3dcompiler_47

generic