OG[.]exe | Triage™

Resubmissions

13/08/2026, 22:56

260813-2wpewadh65

13/08/2026, 22:54

260813-2vnryshj818

Sharing

Copy URL Twitter E-mail

General

Target
OG.exe
Size 2.2MB
Sample260813-2wpewadh65
SHA256 19f648b361a48de71ee04feb1d473f9e422bf8a3622142ad9932a8281ac5b147
MD5 4fa47ac932aadc5715149d134dc0e8ba
SHA1 2637b199ebab0dba6c0b785e6f5b4fd44677c846
SHA512 5004b1b14c83f6738901421818f7f23ee45fe8ace5c1accf3b8fb34268da11afdaf16b4f66476de77a664d579c144cabe469c85e6bcfd9446db52f2ed0e1d6db
SSDEEP 49152:Ld/qGfG6vKYQ2B/KliL36MTnlrEQvvYRUceI:LVqGfG6vKYQ2wcEKcZ
TLSH
T17BB5CF07F36292ADD426683896A2E313F3717C005F25D2CB76D91A598FA71F00EF6AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OG.exe

File Explorer

OG.exe

.exe 2.2MB

OG.exe

IMPHASH 28de0d86ffc8596888229a9034e21ab3
SHA256 19f648b361a48de71ee04feb1d473f9e422bf8a3622142ad9932a8281ac5b147
MD5 4fa47ac932aadc5715149d134dc0e8ba
SHA1 2637b199ebab0dba6c0b785e6f5b4fd44677c846
SHA512 5004b1b14c83f6738901421818f7f23ee45fe8ace5c1accf3b8fb34268da11afdaf16b4f66476de77a664d579c144cabe469c85e6bcfd9446db52f2ed0e1d6db
SSDEEP 49152:Ld/qGfG6vKYQ2B/KliL36MTnlrEQvvYRUceI:LVqGfG6vKYQ2wcEKcZ
TLSH
T17BB5CF07F36292ADD426683896A2E313F3717C005F25D2CB76D91A598FA71F00EF6AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

673640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmGetWindowAttribute DwmExtendFrameIntoClientArea

ole32

CoUninitialize CoCreateInstance CoInitializeEx

kernel32

MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW Process32Next Process32FirstW CloseHandle GetWindowsDirectoryA GetProcAddress GetStartupInfoA ExitProcess CreateProcessW GetModuleHandleW FlushInstructionCache CreateFileMappingW MapViewOfFile SetUnhandledExceptionFilter GetExitCodeProcess GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency VerSetConditionMask GetModuleFileNameW QueryPerformanceCounter GetCommandLineA GetFileAttributesExW GetFileInformationByHandle GetSystemDirectoryW SetFileInformationByHandle AreFileApisANSI GetTempPathW CopyFileW GetFileInformationByHandleEx ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead CreateToolhelp32Snapshot OpenProcess GetModuleHandleA TerminateProcess UnmapViewOfFile VirtualAlloc DeviceIoControl GetStdHandle GetCurrentProcess VirtualFree VirtualProtect Process32First SetConsoleCtrlHandler GetModuleFileNameA ReadFile FindNextFileW GetCurrentThreadId CreateFileW WaitForSingleObject FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA CreatePipe LocalFree FreeLibrary

user32

GetCursorPos GetMessageExtraInfo LoadCursorA GetCapture TrackMouseEvent GetKeyboardLayout SetCapture SetCursor SetProcessDPIAware IsWindowUnicode DefWindowProcW IsIconic ShowCursor ReleaseCapture SetCursorPos OpenClipboard CloseClipboard PostQuitMessage PeekMessageA GetClientRect ToUnicode FindWindowW TranslateMessage SetLayeredWindowAttributes GetForegroundWindow MapVirtualKeyA ClientToScreen GetAsyncKeyState GetKeyNameTextA IsWindow ShowWindow RegisterClassExW GetWindowLongPtrW ScreenToClient CreateWindowExW SetWindowLongPtrW IsWindowVisible DispatchMessageA MapVirtualKeyW GetKeyState SetWindowPos GetWindowRect GetWindowTextW SetClipboardData GetClipboardData EmptyClipboard

advapi32

ControlService RegSetValueExW OpenProcessToken FreeSid SetThreadToken StartServiceW CheckTokenMembership RegOpenKeyExW OpenServiceW DuplicateTokenEx RegQueryValueExW GetTokenInformation DeleteService RegCreateKeyExW LookupPrivilegeValueA AllocateAndInitializeSid SetTokenInformation OpenSCManagerW CloseServiceHandle QueryServiceStatus PrivilegeCheck RegCloseKey CreateProcessAsUserA CreateServiceW RevertToSelf

msvcp140

??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

winmm

timeBeginPeriod

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove _CxxThrowException memcmp memcpy memset __C_specific_handler __std_exception_destroy __current_exception __std_exception_copy __current_exception_context __std_terminate memchr strstr strrchr

api-ms-win-crt-stdio-l1-1-0

_wfopen fseek ftell fflush fclose _get_stream_buffer_pointers _fseeki64 __stdio_common_vsscanf fopen fread fsetpos ungetc _popen __stdio_common_vfscanf setvbuf fgetpos __stdio_common_vsprintf fputc fwrite __p__commode fgets _set_fmode _pclose __acrt_iob_func __stdio_common_vfprintf fgetc

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc _callnewh malloc free

api-ms-win-crt-convert-l1-1-0

strtol strtof strtoll atof strtoull strtod

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-math-l1-1-0

roundf fminf _dclass ceilf _dsign cosf floorf fmodf powf sinf sqrtf atan2f _fdclass __setusermatherr _hypotf acosf asinf tanf

api-ms-win-crt-runtime-l1-1-0

__p___argv _c_exit _register_thread_local_exe_atexit_callback exit __p___argc _beginthreadex _errno _initterm _get_initial_narrow_environment terminate _initterm_e _invoke_watson abort _set_app_type _seh_filter_exe _exit _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv system

api-ms-win-crt-string-l1-1-0

strncpy wcscat_s tolower strncmp wcsncpy_s _wcsicmp strcmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp