Disco[.]exe | Triage™

Resubmissions

08/07/2026, 12:29

260708-pn1rqafw6z7

08/07/2026, 12:11

260708-pc2vmsgs5q7

Sharing

Copy URL Twitter E-mail

General

Target
Disco.exe
Size 17.1MB
Sample260708-pc2vmsgs5q
SHA256 4d4fd5c5e4b0e71e2e61a156e1aef4253f4e6193618aecb2f3217ed1c0bbe6bf
MD5 18e2b1f7368db5c04c2a8b08dfcd2af3
SHA1 f7cac5208c01f84e4768df872fbfd45ddb74b4ee
SHA512 17421fd95e67d5823e12e5a0319727f140cd435ad7ac956308e6bfff7cb10b640fba93420e61932feae1ad767b62ebd6d0a767f850ababb5f92d18b6f09018e4
SSDEEP 196608:bKUn5ditKJsp4/FSut292v0wFfvWopmKJ3B//TiA:bK45dtJsp4/F557z/5
TLSH
T104073C4767874DE6DCC63BB4B99B233C4730FD219E690B2BA54881285C533DCAD2EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Disco.exe

File Explorer

Disco.exe

.exe 17.1MB

Disco.exe

IMPHASH 1543cbc2c65e2dfc47da3de763847e8c
SHA256 4d4fd5c5e4b0e71e2e61a156e1aef4253f4e6193618aecb2f3217ed1c0bbe6bf
MD5 18e2b1f7368db5c04c2a8b08dfcd2af3
SHA1 f7cac5208c01f84e4768df872fbfd45ddb74b4ee
SHA512 17421fd95e67d5823e12e5a0319727f140cd435ad7ac956308e6bfff7cb10b640fba93420e61932feae1ad767b62ebd6d0a767f850ababb5f92d18b6f09018e4
SSDEEP 196608:bKUn5ditKJsp4/FSut292v0wFfvWopmKJ3B//TiA:bK45dtJsp4/F557z/5
TLSH
T104073C4767874DE6DCC63BB4B99B233C4730FD219E690B2BA54881285C533DCAD2EB91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextW CryptGenRandom CryptReleaseContext GetTokenInformation GetUserNameW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipSaveImageToStream GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CopyFileW CreateEventA CreateFileW CreateHardLinkW CreateMutexW CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FormatMessageA GetComputerNameExW GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameW GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersionExW GetVolumeInformationW GlobalLock GlobalSize GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEvent SetFilePointer SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func fwprintf __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _close _commode _endthreadex _errno _findclose _fmode _fstat64 _get_osfhandle _initterm _ismbblead _lock _lseeki64 _setjmp _telli64 _unlock _vscprintf _vsnprintf _wchdir _wchmod _wfindfirst64 _wfindnext64 _wfopen _wfullpath _wgetcwd _wmkdir _wopen _wstat64 _wutime64 abort atexit calloc exit fclose fflush fopen fprintf fputc fputs fputwc free fwrite getenv iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscat wcscmp wcscoll wcscpy wcsftime wcslen wcsxfrm _write _strdup _read _fileno _fdopen

ole32

CLSIDFromString CreateStreamOnHGlobal GetHGlobalFromStream

shell32

SHGetFolderPathW ShellExecuteW

user32

CallNextHookEx CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW ExitWindowsEx GetDC GetKeyboardState GetMessageW GetSystemMetrics MessageBoxW RegisterClassW ReleaseDC SetWindowsHookExW ShowWindow ToUnicode TranslateMessage UnhookWindowsHookEx

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWriteData

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanOpenHandle WlanSetInterface

ws2_32

WSAAddressToStringW freeaddrinfo getaddrinfo gethostname

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

260KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

281KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

421KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Disco.exe

advapi32

crypt32

gdi32

gdiplus

kernel32

msvcrt

ole32

shell32

user32

winhttp

wlanapi

ws2_32

generic