32bitone[.]exe | Triage™

Resubmissions

09/07/2026, 09:45

260709-lq97dsf17k

09/07/2026, 09:43

260709-lqeqgsf16n3

Sharing

Copy URL Twitter E-mail

General

Target
32bitone.exe
Size 408KB
Sample260709-lq97dsf17k
SHA256 33351a7118a092de83d6343d5a55effd6503e712e0535aee15926ef793624d6c
MD5 72a94b33cd3b56ae011d359b3bf53685
SHA1 2b1bd21e19dd34d189a98788daae7b4689383c8b
SHA512 6dd6f39381a6a7751e825ef3beaf4eafcbddef13498e7f73bf58b04fb2a974c82313e9b75accddbea27768d856accd5c4b62a5c4432f9250627e6495d3fe2bff
SSDEEP 6144:t9685X7EXgWcg4kWDLbhxpiU4++Md5tskuDi41iWtj18OEt3tISDePV/L:H68iBWDLliUV5dBTK1ncCa8V/L
TLSH
T1CD943A31B3E95136D7A368B8CE7EA2B9D13EADF40B10A5C736549BDD54706C2CE32602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32bitone.exe

File Explorer

32bitone.exe

.exe 408KB

32bitone.exe

IMPHASH 64528cc5a04a26d5d5b9d9e5880bbb6c
SHA256 33351a7118a092de83d6343d5a55effd6503e712e0535aee15926ef793624d6c
MD5 72a94b33cd3b56ae011d359b3bf53685
SHA1 2b1bd21e19dd34d189a98788daae7b4689383c8b
SHA512 6dd6f39381a6a7751e825ef3beaf4eafcbddef13498e7f73bf58b04fb2a974c82313e9b75accddbea27768d856accd5c4b62a5c4432f9250627e6495d3fe2bff
SSDEEP 6144:t9685X7EXgWcg4kWDLbhxpiU4++Md5tskuDi41iWtj18OEt3tISDePV/L:H68iBWDLliUV5dBTK1ncCa8V/L
TLSH
T1CD943A31B3E95136D7A368B8CE7EA2B9D13EADF40B10A5C736549BDD54706C2CE32602
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

137616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

WmiPrvSE.pdb

msvcrt

_lock __dllonexit __set_app_type exit _XcptFilter _onexit _exit _controlfp _cexit _unlock ??1type_info@@UAE@XZ ?terminate@@YAXXZ _acmdln _initterm __p__commode __setusermatherr _ismbblead ??8type_info@@QBEHABV0@@Z ?what@exception@@UBEPBDXZ ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@ABQBDH@Z ??0exception@@QAE@ABQBD@Z memmove __getmainargs wcstok memcmp _amsg_exit __p__fmode memcpy _CxxThrowException wcschr __CxxFrameHandler3 _ui64tow_s _purecall _itow _vsnwprintf _except_handler4_common _ui64tow memset

ntdll

RtlCreateAcl RtlNtStatusToDosError RtlAddAccessAllowedAce NtQuerySystemInformation EtwGetTraceLoggerHandle RtlLengthSid EtwGetTraceEnableFlags EtwRegisterTraceGuidsW EtwUnregisterTraceGuids EtwGetTraceEnableLevel EtwTraceMessage

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx ReleaseSRWLockExclusive SetEvent ReleaseSRWLockShared AcquireSRWLockShared DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForSingleObject AcquireSRWLockExclusive CreateEventW

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-security-base-l1-1-0

GetTokenInformation ImpersonateLoggedOnUser MapGenericMask AccessCheck MakeAbsoluteSD RevertToSelf GetAclInformation AllocateAndInitializeSid FreeSid SetSecurityDescriptorOwner SetSecurityDescriptorGroup MakeSelfRelativeSD SetSecurityDescriptorDacl GetSecurityDescriptorLength AddAce InitializeAcl InitializeSecurityDescriptor CopySid GetLengthSid

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress GetModuleFileNameW LoadLibraryExW GetModuleHandleW GetModuleHandleExW

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-processthreads-l1-1-0

TlsFree GetStartupInfoW GetCurrentProcess OpenProcessToken TlsAlloc SwitchToThread SetThreadToken OpenThreadToken GetCurrentThreadId CreateThread GetCurrentProcessId TerminateProcess GetProcessTimes GetCurrentThread

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW

api-ms-win-core-string-l1-1-0

GetStringTypeExW CompareStringW WideCharToMultiByte

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapDestroy HeapCreate GetProcessHeap HeapFree HeapSetInformation

api-ms-win-core-processthreads-l1-1-3

SetProcessInformation

api-ms-win-core-registry-l1-1-0

RegGetValueW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegDeleteKeyExW RegOpenKeyExW RegCloseKey

api-ms-win-eventing-provider-l1-1-0

EventUnregister EventRegister EventWrite

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-perfcounters-l1-1-0

PerfDeleteInstance PerfSetULongCounterValue PerfSetULongLongCounterValue PerfCreateInstance PerfStopProvider PerfStartProviderEx PerfSetCounterSetInfo PerfQueryInstance

api-ms-win-core-memory-l1-1-0

OpenFileMappingW CreateFileMappingW MapViewOfFile UnmapViewOfFile

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-localization-l1-2-0

LCMapStringW

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

fastprox

?Release@CWbemCallSecurity@@UAGKXZ ?AddRef@CWbemCallSecurity@@UAGKXZ ?GetThreadSecurity@CWbemCallSecurity@@UAGJW4tag_WMI_THREAD_SECURITY_ORIGIN@@PAPAU_IWmiThreadSecHandle@@@Z ?SetThreadSecurity@CWbemCallSecurity@@UAGJPAU_IWmiThreadSecHandle@@@Z ?QueryInterface@CWbemCallSecurity@@UAGJABU_GUID@@PAPAX@Z ?New@CWbemCallSecurity@@SGPAV1@XZ

ncobjapi

WmiCreateObjectWithFormat WmiEventSourceConnect WmiDestroyObject WmiEventSourceDisconnect WmiSetAndCommitObject

wbemcomn

BreakOnDbgAndRenterLoop ?GetDWORD@Registry@@QAEHPBGPAK@Z ??1Registry@@QAE@XZ ??0Registry@@QAE@XZ GetMemLogObject ?Write@CMemoryLog@@QAEXJ@Z _ThrowMemoryException_ ?GetPreferredLanguages@CMUILocale@@SGJKPAPAGPAK@Z ?_Free@CMUILocale@@SGHPAX@Z ?SetPreferredLanguages@CMUILocale@@SGJKPBGPAK@Z ?PublishProviderStarted@CPublishWMIOperationEvent@@SGJPAGJ0K0@Z ?Init@CPublishWMIOperationEvent@@SGJXZ ??0Registry@@QAE@PBGK@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

309KB

Virtual Size

309KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

32bitone.exe

msvcrt

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-perfcounters-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-apiquery-l1-1-0

fastprox

ncobjapi

wbemcomn

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic