$R3ZLWM3[.]exe | Triage™

Resubmissions

21/07/2026, 02:36

260721-c3346set2y

21/07/2026, 02:33

260721-c2b93aes5w6

Sharing

Copy URL Twitter E-mail

General

Target
$R3ZLWM3.exe
Size 6.1MB
Sample260721-c3346set2y
SHA256 0eb76a0d9eb6cbf5384a01607197cf09cfbf827ca2dd33f4e660b5ba5f9e3fa8
MD5 30a55c056630a8b42129cba9483e9718
SHA1 8c9c4d88803202da14d599563ad6273daeb80f04
SHA512 da9e598a514b4c7906a312773b047f3253360d2e050de924977f126a369776e883af8c12bbbcafdcabd44eebf49ba09a634efa84ef0fb99921f11d03f6b1fe2f
SSDEEP 98304:nybznEPQtrzpBsfZ53Pr5uYnStrLeP1bDYfcPjip9DE:n+0iQPFua2fKDxg9
TLSH
T138566A03F35281DDC46AC075834AA232FA717C8947347AEF5BE44B212E69BD0AB3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
$R3ZLWM3.exe

File Explorer

$R3ZLWM3.exe

.exe 6.1MB

$R3ZLWM3.exe

IMPHASH 1469cdeb379ba2417745f9cf907ec711
SHA256 0eb76a0d9eb6cbf5384a01607197cf09cfbf827ca2dd33f4e660b5ba5f9e3fa8
MD5 30a55c056630a8b42129cba9483e9718
SHA1 8c9c4d88803202da14d599563ad6273daeb80f04
SHA512 da9e598a514b4c7906a312773b047f3253360d2e050de924977f126a369776e883af8c12bbbcafdcabd44eebf49ba09a634efa84ef0fb99921f11d03f6b1fe2f
SSDEEP 98304:nybznEPQtrzpBsfZ53Pr5uYnStrLeP1bDYfcPjip9DE:n+0iQPFua2fKDxg9
TLSH
T138566A03F35281DDC46AC075834AA232FA717C8947347AEF5BE44B212E69BD0AB3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

224577

Minor OS version

Major OS version

Entry point

3506448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fcm_26_v4_1.pdb

bcryptprimitives

ProcessPrng

advapi32

EventRegister RegCloseKey RegGetValueW EventUnregister RegOpenKeyExW RegQueryValueExW EventSetInformation EventWriteTransfer

ntdll

NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtWriteFile NtReadFile RtlGetVersion

kernel32

LoadLibraryW GetCurrentThreadId FlsGetValue GetFullPathNameW ReleaseSRWLockExclusive FlsAlloc RaiseException FlsSetValue RtlPcToFileHeader FlsFree EncodePointer InitializeSListHead GetTempPathW WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetConsoleMode WriteConsoleW MultiByteToWideChar SetEnvironmentVariableW DeleteFileW DeviceIoControl GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW CopyFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread LCIDToLocaleName GetSystemTimeAsFileTime GetUserDefaultUILanguage AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW SetUnhandledExceptionFilter GetStdHandle GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetModuleHandleW SleepConditionVariableSRW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess GetOverlappedResult ReadFile ReadFileEx GetCurrentProcessId GetFileAttributesW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW RtlUnwindEx FreeLibrary CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle MoveFileExW SetLastError SleepEx GetModuleHandleA AcquireSRWLockExclusive WriteFileEx WaitForSingleObject FreeEnvironmentStringsW LoadLibraryA lstrlenW SetThreadStackGuarantee CompareStringOrdinal DeleteCriticalSection GetEnvironmentVariableW HeapAlloc Sleep GetProcAddress CloseHandle CreateFileW LoadLibraryExA FormatMessageW InitializeCriticalSectionEx GetFileInformationByHandle WakeAllConditionVariable FindNextFileW

user32

SetMenu DrawMenuBar SetMenuItemInfoW AppendMenuW InsertMenuW RedrawWindow TrackPopupMenu PostMessageW PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable DrawTextW GetWindowDC OffsetRect GetMenuBarInfo GetMenuItemInfoW VkKeyScanW MapVirtualKeyW GetMessageW ToUnicodeEx TranslateMessage SetPropW SystemParametersInfoA SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput SetForegroundWindow GetKeyState CheckMenuItem DispatchMessageW GetAsyncKeyState GetKeyboardState MapVirtualKeyExW GetKeyboardLayout GetRawInputData ValidateRect SetWindowDisplayAffinity EnumDisplayMonitors MonitorFromPoint SetWindowLongW CreatePopupMenu GetSystemMenu GetMenu ShowCursor ClipCursor PostThreadMessageW GetClipCursor IsWindowVisible PeekMessageW CreateIcon SetWindowPlacement DestroyMenu DrawIconEx RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx RegisterWindowMessageA GetUpdateRect DispatchMessageA SetParent MapWindowPoints RegisterClassExW GetWindow SetFocus ShowWindow CreateWindowExW AdjustWindowRect SetWindowPos TranslateAcceleratorW DestroyWindow ReleaseDC IsProcessDPIAware GetDC CreateMenu GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn GetWindowPlacement EnableWindow IsWindowEnabled EnumChildWindows EnableMenuItem GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn RemoveMenu IsIconic GetMessageA RegisterTouchWindow IsWindow AdjustWindowRectEx TrackMouseEvent GetClientRect GetCursorPos SendMessageW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow CloseTouchInputHandle GetTouchInputInfo SystemParametersInfoW GetSystemMetrics ClientToScreen GetWindowLongW ScreenToClient SetCursor LoadCursorW DefWindowProcW FlashWindowEx ChangeDisplaySettingsExW DestroyIcon

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

comctl32

DefSubclassProc TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass

ole32

CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoInitialize OleInitialize CoTaskMemFree CoCreateInstance RevokeDragDrop RegisterDragDrop CoUninitialize CoInitializeEx

shlwapi

SHCreateMemStream

shell32

ILFree SHGetKnownFolderPath ShellExecuteW DragQueryFileW DragFinish SHOpenFolderAndSelectItems SHAppBarMessage ShellExecuteExW ILCreateFromPathW

gdi32

CreateSolidBrush CreateDIBSection CreateRectRgn SetTextColor SetBkMode DeleteObject SelectObject CombineRgn DeleteDC GetDeviceCaps CreateCompatibleDC BitBlt

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

api-ms-win-crt-math-l1-1-0

round floor roundf __setusermatherr pow trunc

api-ms-win-crt-string-l1-1-0

wcscmp strcpy_s _wcsicmp wcslen

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

_initterm_e __p___argv _get_initial_narrow_environment _cexit __p___argc exit _c_exit _initialize_narrow_environment _initterm _configure_narrow_argv _register_thread_local_exe_atexit_callback _initialize_onexit_table _set_app_type _seh_filter_exe _exit terminate _crt_atexit _register_onexit_function abort

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode calloc free