prestige_usermode[.]exe

Resubmissions

30/07/2026, 20:09

260730-yxe12seh49

30/07/2026, 20:08

260730-ywmz9sfp3y3

30/07/2026, 20:06

260730-yvvnqaeh273

Sharing

Copy URL Twitter E-mail

General

Target
prestige_usermode.exe
Size 5.8MB
Sample260730-yxe12seh49
SHA256 fb9c849a562ddc7e076981d361edbcc3bed80fe33e6b6a921644bf36a71d5ab1
MD5 cadf85c7d7134fec4471dc4506e256db
SHA1 6ac34c8ec20078493e9c02aaade782e9a3344f5f
SHA512 27e27c76b1ab3c489a40953ff378e8348220703f1daae6c6888feddcf1d726bbed4c0ebd44e1d4f12fe4379b6a15281b2f28987f3b1976d25e486335f0d79577
SSDEEP 98304:HzKviuY/Z9Mpz4gahUtW4BGoyWN23YHnoG65x:Hevinu8gat4BGobNpno3
TLSH
T17C56D007F365429CD1679934C677E32BF330B8551B2153CB72942AA89FA36E01EBA3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
prestige_usermode.exe

File Explorer

prestige_usermode.exe

.exe 5.8MB

prestige_usermode.exe

IMPHASH 131332a9a4c856332dd669c3a5e1412f
SHA256 fb9c849a562ddc7e076981d361edbcc3bed80fe33e6b6a921644bf36a71d5ab1
MD5 cadf85c7d7134fec4471dc4506e256db
SHA1 6ac34c8ec20078493e9c02aaade782e9a3344f5f
SHA512 27e27c76b1ab3c489a40953ff378e8348220703f1daae6c6888feddcf1d726bbed4c0ebd44e1d4f12fe4379b6a15281b2f28987f3b1976d25e486335f0d79577
SSDEEP 98304:HzKviuY/Z9Mpz4gahUtW4BGoyWN23YHnoG65x:Hevinu8gat4BGobNpno3
TLSH
T17C56D007F365429CD1679934C677E32BF330B8551B2153CB72942AA89FA36E01EBA3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1693980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

ReadFile GetFileSizeEx WriteFile CreateFileA DeleteFileA CreateDirectoryA CreateToolhelp32Snapshot Module32FirstW GetProcAddress GetProcessId Process32NextW Process32FirstW VirtualProtectEx Module32NextW VirtualAllocEx FlushInstructionCache VirtualFreeEx DeleteFileW GetLocalTime WideCharToMultiByte GetTempPathW VirtualProtect ReadProcessMemory K32GetModuleInformation MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask FreeLibrary QueryPerformanceCounter HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetTickCount64 GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive VirtualQueryEx GetSystemInfo GetModuleHandleA OutputDebugStringA GetFileAttributesA WriteProcessMemory QueryFullProcessImageNameW Sleep GetFileAttributesW FindClose FindNextFileW FindFirstFileW CompareFileTime GetModuleHandleW CreateProcessW GetCurrentProcessId LocalFree GetCurrentProcess CloseHandle OpenProcess WaitForSingleObject GetModuleFileNameW TerminateProcess GetCommandLineW SetConsoleCtrlHandler InitializeSListHead SetProcessMitigationPolicy

user32

TranslateMessage SetFocus MessageBoxA ValidateRect GetClientRect SetCapture BeginPaint GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout SetProcessDPIAware IsWindowUnicode SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData EnumDisplayMonitors SetWindowTextW GetForegroundWindow ClientToScreen ScreenToClient GetAsyncKeyState FindWindowA SendInput GetWindowThreadProcessId IsWindowVisible SetWindowLongPtrW GetWindowLongPtrW IsWindow EnumWindows SetLayeredWindowAttributes IsIconic GetWindowRgn GetWindowTextW GetPhysicalCursorPos GetDC CopyIcon GetIconInfo CallNextHookEx GetSystemMetrics DestroyCursor GetCursorInfo SetWindowDisplayAffinity CreateCursor UnhookWindowsHookEx LoadCursorW SetWindowsHookExW SetCursor EndPaint DrawIconEx SystemParametersInfoW SetSystemCursor ShowCursor ReleaseDC DefWindowProcW GetWindowRect SendMessageTimeoutW DestroyWindow SetWindowPos SetWindowRgn CreateWindowExW SendMessageW UnregisterClassW RegisterClassExW UpdateLayeredWindow GetCursorPos SetForegroundWindow ReleaseCapture UpdateWindow PostQuitMessage PeekMessageW SetTimer DispatchMessageW GetCapture KillTimer ShowWindow

gdi32

CreateCompatibleDC GetDIBits SelectObject CreateDIBSection CreateRectRgn DeleteDC GetPixel DeleteObject

advapi32

RegSetValueExW RegOpenKeyExA RegQueryValueExW RegDeleteValueW RegEnumValueW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExA

shell32

ShellExecuteW SHGetFolderPathW SHGetFolderPathA ShellExecuteA CommandLineToArgvW

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

msvcp140

_Cnd_broadcast _Cnd_wait _Cnd_signal ??Bios_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xout_of_range@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Thrd_yield _Query_perf_frequency ?_Random_device@std@@YAIXZ _Mtx_lock _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpOpen WinHttpReceiveResponse

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException __intrinsic_setjmp __std_exception_destroy __std_exception_copy __std_terminate wcsrchr __C_specific_handler strstr strchr strrchr longjmp memcpy __current_exception memset memchr memcmp __current_exception_context

api-ms-win-crt-stdio-l1-1-0

fseek fopen_s __stdio_common_vsprintf fwrite fclose feof _set_fmode fopen __stdio_common_vswprintf_s ferror ftell __p__commode __stdio_common_vsprintf_s __stdio_common_vfprintf __stdio_common_vsscanf __acrt_iob_func _wfopen_s fread ungetc fgetc fflush _wfopen

api-ms-win-crt-convert-l1-1-0

strtol strtof wcstoul atof

api-ms-win-crt-string-l1-1-0

strncpy_s tolower strncmp strcmp strncpy isdigit isspace isalpha _wcsicmp strcpy_s wcslen strlen towlower

api-ms-win-crt-runtime-l1-1-0

_cexit _register_thread_local_exe_atexit_callback _wassert _beginthreadex terminate _c_exit _exit exit _initterm_e _initterm abort _get_narrow_winmain_command_line _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _set_app_type _seh_filter_exe

api-ms-win-crt-math-l1-1-0

floorf cosf sqrtf sinf fmodf ceilf logf powf atan2f __setusermatherr nearbyint ldexp roundf acosf _fdclass pow tanf log expf

api-ms-win-crt-heap-l1-1-0

realloc free _callnewh _set_new_mode malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale