FadeSEC[.]exe | Triage™

Resubmissions

18/08/2026, 16:42

260818-t7syfaac5510

18/08/2026, 15:48

260818-s8texsvfqa10

Sharing

Copy URL Twitter E-mail

General

Target
FadeSEC.exe
Size 16.7MB
Sample260818-s8texsvfqa
SHA256 0844122b393e9f8abdd81296a0d8c891359277185193d238ab9131a0af079570
MD5 7f34fd0b6902512ef595a1c2b6014293
SHA1 c81990f27a064f630021b2d474e5807d295de078
SHA512 fa2d3050f4140282f6a0a6e4530f71993749f6a2a0fd70eb89132194af2aa782c2dfff53ed0970af37a4c7df8347b418662adbff37cce28a4d7b4dde17eb20a0
SSDEEP 196608:sHyM4cYhZOWAU7MK8KKCE8naMyZppdhEH/XV2iF:NM4cuMK8tZpDafVZ
TLSH
T1E1074C4777874DE6DCC62FB4A8AF233C5720FD216E290B2B968891341C533DD9D1ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FadeSEC.exe

File Explorer

FadeSEC.exe

.exe 16.7MB

FadeSEC.exe

IMPHASH 4da18733bcf5378afce121845adcba3c
SHA256 0844122b393e9f8abdd81296a0d8c891359277185193d238ab9131a0af079570
MD5 7f34fd0b6902512ef595a1c2b6014293
SHA1 c81990f27a064f630021b2d474e5807d295de078
SHA512 fa2d3050f4140282f6a0a6e4530f71993749f6a2a0fd70eb89132194af2aa782c2dfff53ed0970af37a4c7df8347b418662adbff37cce28a4d7b4dde17eb20a0
SSDEEP 196608:sHyM4cYhZOWAU7MK8KKCE8naMyZppdhEH/XV2iF:NM4cuMK8tZpDafVZ
TLSH
T1E1074C4777874DE6DCC62FB4A8AF233C5720FD216E290B2B968891341C533DD9D1ABA1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges ChangeServiceConfig2W CheckTokenMembership CloseServiceHandle ConvertStringSidToSidW CreateProcessAsUserW CreateProcessWithLogonW CreateServiceW CreateWellKnownSid CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext CryptSetKeyParam DeleteService DuplicateTokenEx EnumServicesStatusExW GetLengthSid GetTokenInformation GetUserNameA GetUserNameW ImpersonateLoggedOnUser IsWellKnownSid LogonUserExW LookupPrivilegeValueA LookupPrivilegeValueW LsaClose LsaLookupNames LsaOpenPolicy LsaQueryInformationPolicy OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyA RegQueryValueExW RegSetValueExA RegSetValueExW RevertToSelf SetTokenInformation StartServiceW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptExportKey BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty

cabinet

FDICopy FDICreate FDIDestroy

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreatePen CreateSolidBrush DeleteDC DeleteObject GetStockObject GetTextExtentPoint32A LineTo MoveToEx Rectangle SelectObject SetBkMode SetTextColor TextOutA

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileA CopyFileW CreateDirectoryA CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileW CreateHardLinkW CreatePipe CreateProcessA CreateProcessW CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindFirstStreamW FindNextFileW FindNextStreamW FindResourceW FlushInstructionCache FormatMessageA FreeLibrary GetComputerNameA GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeA GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFullPathNameW GetLastError GetLogicalDriveStringsA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetVolumeInformationA GetWindowsDirectoryA GlobalMemoryStatusEx HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByte IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LocalFree LockFileEx LockResource MoveFileExA MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA Process32First Process32FirstW Process32Next Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadDirectoryChangesW ReadFile ReleaseSemaphore RemoveDirectoryA RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesA SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile VirtualAlloc VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile lstrlenW

mpr

WNetUseConnectionW

api-ms-win-crt-convert-l1-1-0

_wtoi atoi mbrtowc mbsrtowcs strtol strtoll strtoul strtoull wcrtomb wcstoul

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _lock_file _unlock_file _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64 _fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__C_specific_handler longjmp memchr memcmp memcpy memmove strchr strrchr wcsrchr wcsstr __intrinsic_setjmp

api-ms-win-crt-runtime-l1-1-0

_set_app_type _assert __p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _initterm _initterm_e _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s _chsize_s _close _get_osfhandle _setmode _wfopen _wopen fclose fflush fopen_s fputc fputs fread fseek ftell fwrite getc setvbuf ungetc fopen _write _read _lseeki64 _fileno

api-ms-win-crt-string-l1-1-0

iswctype _strnicmp _wcsicmp isalnum isdigit isprint isspace isxdigit mbrlen memset strcmp strcoll strcpy strcpy_s strlen strncmp strnlen strxfrm tolower towlower towupper wcscat wcscat_s wcscmp wcscoll wcscpy wcscpy_s wcslen wcsnlen wcsxfrm wctype _stricmp _strdup

api-ms-win-crt-time-l1-1-0

_wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

netapi32

NetApiBufferFree NetServerEnum NetShareEnum

ntdll

NtClose NtCreateFile RtlInitUnicodeString RtlNtStatusToDosError

ole32

CLSIDFromProgID CoCreateGuid CoCreateInstance CoInitialize CoInitializeEx CoSetProxyBlanket CoUninitialize StringFromGUID2

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantClear

rpcrt4

NdrClientCall3 NdrServerCall2 NdrServerCallAll RpcBindingFromStringBindingW RpcStringBindingComposeW UuidCreate UuidToStringW

shell32

SHGetFolderPathW

shlwapi

PathFindFileNameW SHDeleteKeyW

user32

BeginPaint CallNextHookEx CreateWindowExA DefWindowProcA DispatchMessageA EndPaint FillRect FindWindowA FindWindowW GetAsyncKeyState GetClientRect GetMessageA GetSystemMetrics InvalidateRect LoadCursorA MessageBoxA PostMessageA PostQuitMessage RegisterClassA SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExA ShowWindow SystemParametersInfoW TranslateMessage UnhookWindowsHookEx wsprintfW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWriteData

wininet

HttpQueryInfoW InternetCloseHandle InternetOpenUrlW InternetOpenW InternetReadFile

ws2_32

WSACleanup WSAStartup closesocket connect gethostbyname gethostname htons inet_addr ioctlsocket recv select send socket

cldapi

CfConnectSyncRoot CfDisconnectSyncRoot CfExecute CfRegisterSyncRoot CfUnregisterSyncRoot

offreg

ORCloseHive ORCloseKey OREnumKey ORGetValue OROpenHive OROpenKey ORQueryInfoKey

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

7.7MB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

284KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

440KB

Virtual Size

439KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

FadeSEC.exe

advapi32

bcrypt

cabinet

gdi32

iphlpapi

kernel32

mpr

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

netapi32

ntdll

ole32

oleaut32

rpcrt4

shell32

shlwapi

user32

winhttp

wininet

ws2_32

cldapi

offreg

generic