MorpheX[.]exe | Triage™

Resubmissions

05/09/2026, 04:43

260905-fckrpaxaje7

05/09/2026, 04:41

260905-fa9b9stvdy7

05/09/2026, 04:36

260905-e8rz7stvaz7

Sharing

Copy URL Twitter E-mail

General

Target
MorpheX.exe
Size 10.1MB
Sample260905-e8rz7stvaz
SHA256 3c8bbe3051648ab08945e2fa1671423491a59b24f3927e31e9fc7e753286cb28
MD5 4cb62348a446799f5f541d2c77d20d2f
SHA1 82c1ff11ea152b149e444344ccde5ec21a1cf422
SHA512 b782c62ff836bf36b8ee9f2fba4d9cb641bccd9e7b45dcc91c5dc041b6f8426f7704e3701561c3648121219bb1a809c2da7b7ba09d39dc372431e3aa611dacda
SSDEEP 196608:/B2h6WslE+pS58vJpwsnm3RvVrBk7QjKPj1mVpxP4HlZJVZsS/LP6L5FXogjP72Y:YJsEcTIKPj11lZJVZsS/LP6L5FXogr7J
TLSH
T127B6DE25EF56125BCDEB62F041C2BBCEF6A868594F780EC637AC5C051B66DDC82276C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MorpheX.exe

File Explorer

MorpheX.exe

.exe 10.1MB

MorpheX.exe

IMPHASH a14cff61db80b6306a36fa7935ede95e
SHA256 3c8bbe3051648ab08945e2fa1671423491a59b24f3927e31e9fc7e753286cb28
MD5 4cb62348a446799f5f541d2c77d20d2f
SHA1 82c1ff11ea152b149e444344ccde5ec21a1cf422
SHA512 b782c62ff836bf36b8ee9f2fba4d9cb641bccd9e7b45dcc91c5dc041b6f8426f7704e3701561c3648121219bb1a809c2da7b7ba09d39dc372431e3aa611dacda
SSDEEP 196608:/B2h6WslE+pS58vJpwsnm3RvVrBk7QjKPj1mVpxP4HlZJVZsS/LP6L5FXogjP72Y:YJsEcTIKPj11lZJVZsS/LP6L5FXogr7J
TLSH
T127B6DE25EF56125BCDEB62F041C2BBCEF6A868594F780EC637AC5C051B66DDC82276C0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

0303

Minor OS version

Major OS version

Entry point

726464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize

shlwapi

SHDeleteKeyW

wininet

InternetOpenUrlA InternetOpenA InternetCloseHandle HttpSendRequestA HttpOpenRequestA HttpQueryInfoA InternetConnectA InternetReadFile

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptHashData BCryptGetProperty BCryptCreateHash BCryptDestroyHash BCryptOpenAlgorithmProvider

kernel32

GetProcAddress FreeLibrary QueryPerformanceCounter MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleFileNameA SizeofResource GetCurrentProcess OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW OutputDebugStringW LockResource Process32FirstW CloseHandle GetNativeSystemInfo LoadResource FindResourceW IsWow64Process GetExitCodeProcess GetCurrentThread ExitProcess FindFirstFileA GetCommandLineW FindNextFileA FindClose GetCurrentDirectoryA GetFileAttributesA GetSystemDirectoryA DeleteFileA GetWindowsDirectoryA LocalFree GetModuleHandleW WinExec GetTickCount HeapFree GetEnvironmentVariableA GetVolumeInformationA HeapAlloc GetProcessHeap CreateDirectoryA VirtualProtect Thread32Next Thread32First GetThreadContext GetCurrentProcessId OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent TerminateProcess Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ResumeThread DeleteCriticalSection GetSystemInfo VirtualAllocEx VirtualFreeEx GetModuleFileNameW GetFileAttributesW CreateActCtxW WriteFile GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx QueryPerformanceFrequency Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW WaitForSingleObject DuplicateHandle ResetEvent DeviceIoControl GetCurrentThreadId ReadFile CreateNamedPipeW TerminateThread CreateThread GetExitCodeThread Sleep WriteProcessMemory VirtualProtectEx ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx SuspendThread GetThreadTimes InitializeCriticalSectionEx LoadLibraryW GetConsoleMode SetFilePointerEx GetCommandLineA GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue FlsAlloc TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo LCMapStringEx DecodePointer EncodePointer CompareStringW LoadLibraryA GetModuleHandleA LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx HeapReAlloc GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WaitForSingleObjectEx GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue SetStdHandle ReadConsoleW GetFileType HeapSize WriteConsoleW SetEndOfFile GetSystemWow64DirectoryW RtlUnwind FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW AreFileApisANSI GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW TryAcquireSRWLockExclusive

user32

PostMessageW SetActiveWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetFocus TranslateMessage PostQuitMessage UpdateWindow SetForegroundWindow IsIconic GetWindowThreadProcessId IsWindowVisible GetWindowTextA OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos wsprintfW DefWindowProcW EnumWindows GetForegroundWindow

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegEnumValueW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExA RegOpenKeyW RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW RegQueryValueExA

shell32

CommandLineToArgvW ShellExecuteA

oleaut32

SysFreeString

d3d9

Direct3DCreate9

imm32

ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmAssociateContextEx

iphlpapi

GetNetworkParams

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

933KB

Virtual Size

933KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

MorpheX.exe

ole32

shlwapi

wininet

bcrypt

kernel32

user32

advapi32

shell32

oleaut32

d3d9

imm32

iphlpapi

generic