Lychee[.]exe | Triage™

Resubmissions

17/07/2026, 08:39

260717-kkpg3afy2l

17/07/2026, 08:36

260717-khvlasbs713

Sharing

Copy URL Twitter E-mail

General

Target
Lychee.exe
Size 5.4MB
Sample260717-kkpg3afy2l
SHA256 4025e2058abd2a8b07686ae523917d1f2b0691b73299701ba4077ff1d13a8c31
MD5 ffd86f86491eab51c41d44354caf2023
SHA1 c59874f2aaf5f9d553489d0b250a3767cda6d516
SHA512 932804714311135e96e6283b27ee0d123a0a3273844396aef3a6b3c1a597832ec9e39fd6785022f6730734aa22de0c61f9edcecf21128edc670726fc444bf5fc
SSDEEP 98304:7JkPUzOnkxF6cwAekYkPwJ08u7cg+PKd1ui1bhiMfZiMfBo/Y7mgTm05AwJHE6h:7JkRnkxF6cwAekd4JuOCh1Jtug7PAmk
TLSH
T1D746F10AF3E6869ED3A2A138CD5EA317D6B13448472143EB37C44D689F467E05E3DB92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Lychee.exe

File Explorer

Lychee.exe

.exe 5.4MB

Lychee.exe

IMPHASH 29b22b7a791d9d4a55ce8a406afb41e5
SHA256 4025e2058abd2a8b07686ae523917d1f2b0691b73299701ba4077ff1d13a8c31
MD5 ffd86f86491eab51c41d44354caf2023
SHA1 c59874f2aaf5f9d553489d0b250a3767cda6d516
SHA512 932804714311135e96e6283b27ee0d123a0a3273844396aef3a6b3c1a597832ec9e39fd6785022f6730734aa22de0c61f9edcecf21128edc670726fc444bf5fc
SSDEEP 98304:7JkPUzOnkxF6cwAekYkPwJ08u7cg+PKd1ui1bhiMfZiMfBo/Y7mgTm05AwJHE6h:7JkRnkxF6cwAekd4JuOCh1Jtug7PAmk
TLSH
T1D746F10AF3E6869ED3A2A138CD5EA317D6B13448472143EB37C44D689F467E05E3DB92
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1130144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\root\Downloads\Lyche\build\Lychee.pdb

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CertOpenStore CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptDecodeObjectEx

ws2_32

WSAEventSelect getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents gethostname ioctlsocket sendto closesocket WSAGetLastError recvfrom inet_pton ntohs freeaddrinfo getaddrinfo listen htonl WSASetLastError accept inet_ntop select __WSAFDIsSet WSAIoctl bind connect getpeername socket getsockname htons recv setsockopt

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW SetConsoleTitleA GetStdHandle SetConsoleMode GetSystemTimeAsFileTime GetConsoleWindow Process32First WriteProcessMemory OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle ReadProcessMemory lstrcmpiA K32EnumProcessModules SetThreadPriority GetCurrentThread Sleep GetModuleHandleA GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLastError SetConsoleScreenBufferSize SetCurrentConsoleFontEx SetConsoleWindowInfo GetCurrentConsoleFontEx CreateDirectoryA ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW GetModuleHandleW LoadLibraryW SleepEx GetTickCount MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerifyVersionInfoW CreateFileW GetFileSizeEx InitializeSListHead GetFileInformationByHandleEx WakeAllConditionVariable SetUnhandledExceptionFilter GetConsoleMode

user32

GetMonitorInfoA MoveWindow DefWindowProcA CreateWindowExA BringWindowToTop TranslateMessage LoadIconA PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow SetForegroundWindow OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetMessageExtraInfo SetWindowPos MonitorFromWindow GetCapture MessageBoxA TrackMouseEvent GetKeyboardLayout SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos IsWindowVisible ShowWindow ScreenToClient GetAsyncKeyState GetForegroundWindow GetCursorPos SendInput SetWindowLongA GetWindowLongA SetLayeredWindowAttributes FindWindowA GetSystemMetrics DestroyWindow GetWindowRect ClientToScreen DispatchMessageA LoadCursorA GetKeyState

gdi32

CreateSolidBrush

advapi32

CryptCreateHash CryptGetHashParam CryptHashData CryptDestroyHash CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptImportKey CryptEncrypt

shell32

SHGetFolderPathW SHGetFolderPathA

msvcp140

??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Random_device@std@@YAIXZ _Thrd_detach ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

winmm

timeBeginPeriod

wininet

InternetOpenUrlA InternetOpenA InternetReadFile InternetCloseHandle

d3dcompiler_47

D3DCompile

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context _CxxThrowException __C_specific_handler wcschr strchr __std_terminate memmove memchr memcmp strrchr memset memcpy __std_exception_copy __std_exception_destroy strstr

api-ms-win-crt-heap-l1-1-0

calloc malloc realloc free _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

wcstombs strtoul atoi strtod atof strtol strtoll strtoull

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _configure_narrow_argv _errno _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type system _get_initial_narrow_environment _initterm _initterm_e _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback abort __sys_errlist __sys_nerr _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_write __stdio_common_vsprintf_s _wopen _close _lseeki64 __stdio_common_vsprintf _fileno _read fputc fputs fflush fclose __p__commode fgets fgetc fwrite fgetpos setvbuf feof ungetc fsetpos fread _fseeki64 _wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell _set_fmode _get_stream_buffer_pointers __stdio_common_vsscanf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime _time64 _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_lock_file remove _wstat64 _unlink _unlock_file _fstat64

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-math-l1-1-0

_dsign cos atan2f acosf cosf roundf _fdopen fmodf log logf pow ceilf powf sin __setusermatherr sinf sqrt sqrtf floorf

api-ms-win-crt-string-l1-1-0

strpbrk tolower wcscpy_s wcsncmp strcspn strncmp strcpy_s wcspbrk wcslen strspn strcmp wcsncpy strlen strncpy _strdup