3[.]exe | Triage™

Resubmissions

07/08/2026, 16:17

260807-trljesgr3s10

31/07/2026, 12:58

260731-p7mdfagm8z10

Sharing

Copy URL Twitter E-mail

General

Target
3.exe
Size 10.9MB
Sample260807-trljesgr3s
SHA256 5ee86cbcd296e0998ca20ee65a7506fb3baecfb7ce98eede29bff1a6a6e0fc95
MD5 b8d28b59c891a75a318dee8dc16dbcdd
SHA1 745ec020a3fae9e24921579370010fd28f9bd25f
SHA512 7231590d6121d7ba1b10eefc1a232f4d363bdde257eb40a0a613cba13b4e0ba5d059d5b6c36c526c327278d98a8174ca58c62db4a6f49b85ab7a13e4f226bb49
SSDEEP 24576:F9fuOb193YKMT7iCtQ4bDfWbZkFSdU27PTCuOH/YIY9Ib8qkqKSPLftRNg+au1nj:F9fbb193O7zmZIavTNOrY9kFRNl1vfVN
TLSH
T1B5B68C1DA29801E8E6779A388AE37E32D7717846076DA98B0758F2053F33AD05B7F315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3.exe

File Explorer

3.exe

.exe 10.9MB

3.exe

IMPHASH ddd051506cfe33d151858512722b97b9
SHA256 5ee86cbcd296e0998ca20ee65a7506fb3baecfb7ce98eede29bff1a6a6e0fc95
MD5 b8d28b59c891a75a318dee8dc16dbcdd
SHA1 745ec020a3fae9e24921579370010fd28f9bd25f
SHA512 7231590d6121d7ba1b10eefc1a232f4d363bdde257eb40a0a613cba13b4e0ba5d059d5b6c36c526c327278d98a8174ca58c62db4a6f49b85ab7a13e4f226bb49
SSDEEP 24576:F9fuOb193YKMT7iCtQ4bDfWbZkFSdU27PTCuOH/YIY9Ib8qkqKSPLftRNg+au1nj:F9fbb193O7zmZIavTNOrY9kFRNl1vfVN
TLSH
T1B5B68C1DA29801E8E6779A388AE37E32D7717846076DA98B0758F2053F33AD05B7F315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

570428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

DeregisterEventSource RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

K32GetProcessMemoryInfo CancelThreadpoolIo CloseHandle CloseThreadpoolIo CreateDirectoryW CreateEventExW CreateFileW CreateProcessW CreateThread CreateThreadpoolIo DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FlushFileBuffers FormatMessageW FreeLibrary GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetOverlappedResult GetProcAddress GetStdHandle GetSystemDirectoryW GetThreadContext GetThreadPriority GetTickCount64 InitializeConditionVariable InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ReadProcessMemory ResetEvent ResumeThread SetEvent SetFileInformationByHandle SetLastError SetThreadContext SetThreadErrorMode SetThreadPriority Sleep SleepConditionVariableCS StartThreadpoolIo TerminateProcess VirtualAlloc VirtualAllocEx VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc GetConsoleMode SetFilePointerEx WriteConsoleW FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlRestoreContext VerSetConditionMask CreateEventW SwitchToThread SuspendThread FlushInstructionCache CreateMemoryResourceNotification QueryInformationJobObject GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery SleepEx DebugBreak GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity

ole32

CoTaskMemFree CoInitializeEx CoGetApartmentType CoUninitialize CoWaitForMultipleHandles

vcruntime140

_CxxThrowException __std_terminate __std_exception_destroy __std_exception_copy memcpy _purecall memmove memset __C_specific_handler __current_exception __current_exception_context __C_specific_handler_noexcept __CxxFrameHandler3 wcschr

vcruntime140_1

__CxxFrameHandler4

Name

.text

Size

978KB

Virtual Size

978KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

887KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

580B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

3.exe

advapi32

bcrypt

kernel32

ole32

vcruntime140

vcruntime140_1

generic