A-R[.]exe | Triage™

Resubmissions

22/08/2026, 01:11

260822-bj8d4st1ds

22/08/2026, 01:08

260822-bhck2szepa5

Sharing

Copy URL Twitter E-mail

General

Target
A-R.exe
Size 57.2MB
Sample260822-bj8d4st1ds
SHA256 1b8b68aea578b6ceb8c86718064cb65c978790e23accff265ca453f71c5325da
MD5 3a60b3cc2fb40ff32ba47d469771865c
SHA1 0c9ecfb991885a531245d058463fd240a6fe3fbd
SHA512 64e8afa9ec41310c63e5390659327a15a686907b31cea3b6bb94800fa2587d92a03d663d2523c464bec6e9ddda1146b4180b1db09122ab65432353ad288537e7
SSDEEP 1572864:NOGxF30ekU0e5U5ERGB4TwY4a/XA+MoAJ6SiGU7P9WPOj5qhsPx:NOGrmUBTTwY4beA6449WPOPx
TLSH
T10FD733A663442F7CF05FC8345222EC14F22A983D8FD94696B2DDABC03766C9492F674D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
A-R.exe

File Explorer

A-R.exe

.exe 57.2MB

A-R.exe

IMPHASH 35e4f6cf53ebfd4c9dd98916d414a505
SHA256 1b8b68aea578b6ceb8c86718064cb65c978790e23accff265ca453f71c5325da
MD5 3a60b3cc2fb40ff32ba47d469771865c
SHA1 0c9ecfb991885a531245d058463fd240a6fe3fbd
SHA512 64e8afa9ec41310c63e5390659327a15a686907b31cea3b6bb94800fa2587d92a03d663d2523c464bec6e9ddda1146b4180b1db09122ab65432353ad288537e7
SSDEEP 1572864:NOGxF30ekU0e5U5ERGB4TwY4a/XA+MoAJ6SiGU7P9WPOj5qhsPx:NOGrmUBTTwY4beA6449WPOPx
TLSH
T10FD733A663442F7CF05FC8345222EC14F22A983D8FD94696B2DDABC03766C9492F674D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118567482

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetExitCodeThread WaitForSingleObject SetCurrentDirectoryA GetModuleFileNameA UnmapViewOfFile ReleaseMutex CreateMutexA MapViewOfFile CreateFileMappingA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetFileSize CreateFileA GetCurrentDirectoryA ReadFile CreateEventA SetThreadPriority GetCurrentThread SetEvent Sleep GetVersionExA WriteFile SetStdHandle SetFilePointer CreateProcessA DuplicateHandle CreatePipe GetStdHandle GetExitCodeProcess OpenProcess WaitForMultipleObjects PulseEvent GetCommandLineA HeapFree HeapAlloc GetProcessHeap HeapReAlloc RtlUnwindEx MultiByteToWideChar WideCharToMultiByte SetConsoleCtrlHandler ExitThread CreateThread ExitProcess FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FindNextFileA GetModuleHandleA GetFileType FreeEnvironmentStringsA lstrlenA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStartupInfoA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue HeapSetInformation HeapCreate LCMapStringA LCMapStringW RaiseException HeapSize GetCPInfo GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA GetStringTypeW GetACP GetOEMCP VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlPcToFileHeader IsBadReadPtr IsBadWritePtr IsBadCodePtr FlushFileBuffers CompareStringA CompareStringW SetEnvironmentVariableA GetTimeZoneInformation GetLocaleInfoW SetEnvironmentVariableW SystemTimeToFileTime LocalFileTimeToFileTime SetFileTime MoveFileA DeleteFileA SetVolumeLabelA GetDriveTypeA GetDiskFreeSpaceA GetFileAttributesA SetFileAttributesA GetFullPathNameA GetProcAddress FindResourceA SizeofResource LoadResource LockResource LeaveCriticalSection SetErrorMode LoadLibraryA GetLastError FormatMessageA LocalFree GetEnvironmentStrings FreeLibrary EnterCriticalSection DeleteCriticalSection ResumeThread InitializeCriticalSection SetEndOfFile GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle HeapReAlloc FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer HeapAlloc RtlUnwindEx LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation GetVersion HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetMessageA TranslateMessage DispatchMessageA KillTimer SetTimer GetClassInfoA LoadCursorA RegisterClassA GetSystemMetrics CreateWindowExA ShowWindow UpdateWindow DefWindowProcA GetClientRect BeginPaint EndPaint PostQuitMessage PostMessageA LoadBitmapA MessageBoxA CharUpperBuffW

gdi32

SelectObject BitBlt DeleteDC CreateCompatibleDC GetObjectA DeleteObject

advapi32

RegSetValueExA RegCreateKeyExA RegCloseKey RegQueryValueExA GetTokenInformation OpenProcessToken RegOpenKeyExA

comctl32

InitCommonControlsEx

{.�T`��*(+�9^Vr�-(SL�$ >捩�PVQ��ᑈ��\x͉D�g��yj�2�&�(�1��Kq8�I�f?��Q�{�[��q��h"$�� ƢQ��}R0��)󟦙p�`�~I�r��u/4�[��^�-ADZ[ٵ��>�=�Y�'��!��icSÄZq��]�w�1��CC�'4�9�� S�Q��2 �l�� d�8)C��7�g(lO�Ɏ��@1�U똔�/��X�x�Ē��:h�;U�a��{�$��,�g�ܼ<s��.%�8B�'��dG�N�g�ny� �\&�P��2�_�O�y>��@u�T\ϚC�F�9%��rT&��%�e"{1�3��o�W��f��}��*sW#�v��K�O~4��ʆ �ZЫ=1l� [e=IC�*�YF�S+_ʁ.;t9d��E��<��ʠ�-�4=^�6��D�r*��t��.a��[ڴ`��r��r|b�ll��u��˧�Ks��VJ8]��hv�3��M\1)ec��nU��4y*±V*��z�?}T݄Od�QYꗕ�K\��6� r��+��ۮu�X�� %64=b`�.�I٘�(�w+;��-�'��4�� uF��52�b�2��"�Gv l��~��V��KQ��& Uf� ^7?ê�;�2˛�F��@}�j!��tu)y�xG��mYA��];M�Ԫ�c�#�z2_!��ovZ�Z�E�ƺ/�B,��s��w]\�01�i\�2k>��q�a��J��5� wak��[�'b�2�SN鉹�O`��ƹsCk��|�Yd}�P��J��V'/�C�p�݁~�&Z�j��{�6fHS�Drk�4�.��V}�Q��E�n�p�0m��.��L�i��%Y�VyOS��p��}�5,I D"��`��Nľ��%�gC�e�9��B��}%-�� #��%��R�؂!�yԠ�U��^�^�k��+-4h[հ8-nJ��U��&lCuUD>a\�r�g�o7�@��c�)�e�FFa|�̈́�gAX��C�H@� g�W� ��q�Vqt�ۤx΀�_�P�0��Lb��N��|a =��zC�bM�$��C`]�d|�1rZZ��#ʇ4��ە��`5�� "�_�)խtͺ65�b��,��%��qq ��LN`��A��:�ɴ�8cº/��mk��t��|oۛ�8��;k��A��tTr�ܽ��L�9&�c��y��HA ʢ��׵�/ӁxX�XmF 䭖;��V*͞��2��kil|�_��мY�>��b�݌!�B��g� ��ݡ)l�Q��]9��s��#�Ψ��0 BI��T��2��d��$O��4}� ��>=��vԹ{O�� w4��LŭH� J��H%��{�'iG��֋� wԒ�@9��L R��=�u�<�g,��;Ǚ7Y��}-Qxn�l+b��#wq��2�p� ��Bd��T-��9��`��Z=^O;h=��j�5�'��j��>^9�Jjŉ��k��h��dY2�pH\c��3��u�=@i�B�<�(��'�\:��n��Qߣӧâ�H�J�!��ɦ�ס�� l��:�c�N��2_�:��ch_x�U$Ī!U��c��G3��X,Ǌ� �f�`Kg�p�@�Ƽ��h~��2�(��q��XD��K7T�`,�9d�R��]��%� ��F\1o��|�r��L��$��θ�JȾ�/y�t�y]�Vf�~�B}�Q0v�F��{��F��~��V;�? ��I&�w$LM(�D�92�Dx��&763�#�6M��腶�ܚ��ǎa̓0C��:=+!�mZ�i�*T�b�:�L�6T�aQF�C��V��bd�U"@n>%��H8��\�/`�a�u��7i6s?N�J��.%jP��Y�&8A2�+�FE�H_�E��~�r��no��᫧19��\ɨ~1.+�,^��U�JY�<K��fC��v��ơ��ij�X��.�`@�=S��rG��NW��!R*l�yr�R��vz��m�s��L��=��Ql��<.�C��̤�v��0�H��-ڶ�C�/ph��I?_�6�;vP�X6QZ��.ܖ��G74O�-�zt�ژcV08b��@�&։HD�Q6�P�o��Y�%��σ�")��[��(��B��w�Q�-y��|w��<=^�G�p��~��~JH�4aC�_]�I�}F��]SU&��~3^<��G{�o��O4Ў��If?��UipSVޓ�ֶ�� o��̱��)\��E1��D��R��{Em1�WU$�W�|��}��[H��Ob�|}a!�t��|��9��x�'Ie�"�K��b�n��a�+�|Dg�X��]m� &��^�1l��C�f�-7)�>�6��xze@��è�o��B��-�<=k�q+F#��)�@��F"J��MT�x��=��;,2�J|>�V h��N��++�L�]��}�^4��,R�I�۵RC�RR�y��e�ݩ��N'jw@vA|�7`�H��L�#(v��ӭ4� m�t� y��d�@�ev��o��%<��SJ׈��j��I�́��.�!<y��B�uj-��W ��E�%�۪Յť�z{��iv�{��2��K��J�0!��$xe�0��N�j8W��y}�ꍅ��Zt��A/�mG�?�W��r��`5m��QZZ<5��`fm( �}-��u�89i� @"Į� 6��0�6`��ܯ��1��8Hq�z�U��f�Ӥ��s��}G�� Java_com_regexlab_j2e_Handler_loadResourceData Java_com_regexlab_j2e_Instances_flush Java_com_regexlab_j2e_Instances_getCurrentInstance Java_com_regexlab_j2e_Instances_getFirstInstance Java_com_regexlab_j2e_Instances_getInstances Java_com_regexlab_j2e_Instances_sendObject Java_com_regexlab_j2e_Instances_setReceiver Java_com_regexlab_j2e_Jar2ExeClassLoader_defineClass Java_com_regexlab_j2e_Jar2ExeClassLoader_findClass Java_com_regexlab_j2e_Jar2ExeClassLoader_findResource Java_com_regexlab_j2e_Jar2ExeClassLoader_findResource0 Java_com_regexlab_j2e_Jar2ExeClassLoader_findResources Java_com_regexlab_j2e_Jar2ExeClassLoader_getEmbeddedJars Java_com_regexlab_j2e_RedirOutputStream_write Java_com_regexlab_j2e_SplashScreen_nativeAutoClose Java_com_regexlab_j2e_SplashScreen_nativeClose Java_com_regexlab_j2e_SplashScreen_nativeGetSplashScreen

Name

.text

Size

Virtual Size

323KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SHMMESS

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.1JF0

Size

Virtual Size

57.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.1JF1

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.1JF2

Size

57.0MB

Virtual Size

57.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

A-R.exe

kernel32

user32

gdi32

advapi32

comctl32

generic