RezX (1)[.]exe | Triage™

Resubmissions

14/07/2026, 04:39

260714-e97gaaev3j9

14/07/2026, 04:38

260714-e9plgagw9t9

Sharing

Copy URL Twitter E-mail

General

Target
RezX (1).exe
Size 957KB
Sample260714-e97gaaev3j
SHA256 2e274775a98b7ce4a4aa7d5edc74e5e443ea63797f4e83ffecafbc95bb2a2ba1
MD5 2dfe9a8a4e9cb84c5571ca841e41bba6
SHA1 73da6735937850b011cbb16f1186a60aca1d1d28
SHA512 8eddba7122df6c31f14e89963718c53af9ce6d7ecc81658bf7d32b0d66a9678e87180506a9237d96a8b169ac06d6a38950f9a7c2ec80ea4c50ac8c0319996d98
SSDEEP 24576:A7rKp9g0rCFuhhO1nGriN4+arlW//flegDGiTWiWnQ1:A7rKpaN+hO1nMi9arlW//flegDGiT/WQ
TLSH
T18B259D4AA2B811ECD47BD178C146921BEB727495132087DB27E4DAA92F63BF1773B301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RezX (1).exe

File Explorer

RezX (1).exe

.exe 957KB

RezX (1).exe

IMPHASH 934ca37b930bbbf04e31335110524ed2
SHA256 2e274775a98b7ce4a4aa7d5edc74e5e443ea63797f4e83ffecafbc95bb2a2ba1
MD5 2dfe9a8a4e9cb84c5571ca841e41bba6
SHA1 73da6735937850b011cbb16f1186a60aca1d1d28
SHA512 8eddba7122df6c31f14e89963718c53af9ce6d7ecc81658bf7d32b0d66a9678e87180506a9237d96a8b169ac06d6a38950f9a7c2ec80ea4c50ac8c0319996d98
SSDEEP 24576:A7rKp9g0rCFuhhO1nGriN4+arlW//flegDGiTWiWnQ1:A7rKpaN+hO1nMi9arlW//flegDGiT/WQ
TLSH
T18B259D4AA2B811ECD47BD178C146921BEB727495132087DB27E4DAA92F63BF1773B301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

748848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\uae12\Downloads\src private\src private\new src\new src\dwqa\x64\Release\RezX.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx GetTickCount GetFullPathNameW GetLastError SetLastError MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA VerifyVersionInfoW FormatMessageW CreateFileW CreateThread UnhandledExceptionFilter IsProcessorFeaturePresent WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead InitOnceComplete InitOnceBeginInitialize GetSystemInfo SetUnhandledExceptionFilter CheckRemoteDebuggerPresent LocalFree GetCurrentThread MultiByteToWideChar GlobalAlloc GetFileSizeEx ReadFile IsDebuggerPresent K32EnumProcessModules GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetModuleHandleW GetCurrentProcessId ExitProcess FreeConsole K32GetModuleBaseNameA CloseHandle Process32FirstW Process32NextW Sleep CreateToolhelp32Snapshot OpenProcess TerminateProcess GetModuleFileNameA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GetCurrentProcess

user32

GetCursorPos SetClipboardData SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture CloseClipboard GetMessageExtraInfo GetKeyState SendInput GetAsyncKeyState PostQuitMessage SetWindowLongW TranslateMessage SetLayeredWindowAttributes MessageBoxA PeekMessageW DispatchMessageW ShowWindow GetClipboardData EmptyClipboard RegisterClassExW GetWindowLongPtrW UnregisterClassW OpenClipboard ScreenToClient UpdateWindow GetSystemMetrics GetWindowLongW DefWindowProcW SetWindowLongPtrW CreateWindowExW

advapi32

RegOpenKeyExA CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptVerifySignatureW CryptGenRandom CryptAcquireContextW CryptDestroyKey RegCloseKey

shell32

ShellExecuteW ShellExecuteA

ole32

CreateStreamOnHGlobal

crypt32

CertEnumCertificatesInStore CertCloseStore CryptStringToBinaryW CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CryptImportPublicKeyInfo CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CryptStringToBinaryA CertGetCertificateChain CryptDecodeObjectEx CertFreeCertificateChain CertOpenStore

ws2_32

WSACleanup accept WSAStartup WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSASetLastError freeaddrinfo getaddrinfo WSACloseEvent ntohs socket htons ioctlsocket WSAGetLastError closesocket send getsockopt listen htonl WSAWaitForMultipleEvents WSACreateEvent bind select connect getpeername getsockname recv setsockopt WSAIoctl __WSAFDIsSet

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z _Mtx_lock ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Mtx_unlock ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z _Thrd_detach ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

wininet

InternetSetOptionA InternetOpenUrlA InternetCloseHandle InternetReadFile InternetOpenA InternetGetConnectedState

gdiplus

GdipCloneImage GdipGetImageHeight GdipAlloc GdipDisposeImage GdipFree GdipCreateBitmapFromStream GdipGetImageWidth GdiplusStartup GdiplusShutdown GdipBitmapGetPixel

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception wcschr memcmp memmove memchr memset memcpy __C_specific_handler __std_exception_copy __std_exception_destroy strrchr strchr strstr __std_terminate

api-ms-win-crt-stdio-l1-1-0

fputc _fseeki64 fflush __acrt_iob_func fgets __stdio_common_vsnprintf_s _wopen _set_fmode __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fsetpos ungetc __p__commode feof setvbuf fgetpos _fileno _close __stdio_common_vsprintf_s fclose fseek ftell _get_stream_buffer_pointers fputs fgetc __stdio_common_vfprintf fwrite

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

strncpy strncpy_s _strdup _stricmp strspn strpbrk strncmp wcsncpy wcsncmp strcspn strcmp strcpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc calloc free realloc

api-ms-win-crt-convert-l1-1-0

atoi strtol wcstombs

api-ms-win-crt-runtime-l1-1-0

_errno _invoke_watson _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit __sys_errlist __sys_nerr _initterm_e _initterm abort _beginthreadex terminate _get_initial_narrow_environment _set_app_type _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe

api-ms-win-crt-filesystem-l1-1-0

remove _unlink _fstat64 _wstat64 _unlock_file _fullpath _lock_file

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64 strftime

api-ms-win-crt-math-l1-1-0

acosf powf ceilf __setusermatherr sinf sqrtf logf fmodf _fdopen cosf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale