wordexe[.]exe | Triage™

Resubmissions

07/09/2026, 19:11

260907-xv7slssscw3

07/09/2026, 19:08

260907-xtf89ser4y3

Sharing

Copy URL Twitter E-mail

General

Target
wordexe.exe
Size 2.1MB
Sample260907-xtf89ser4y
SHA256 da9ef04fb7522a1a8699da040e38c119c0d197d6202d671cde9113ea101d8256
MD5 42abe7ba125ca9f3c8ac67f6f9f23cb2
SHA1 1952bd7a9fd49f2a26893b0d5f7dc378e691aeee
SHA512 46442753e8ee2840613fda4e1dd8d33c8907c257419f931a72ab79c86cd61ef86c532a6143a5fe29bfd9877ab4d859c80c2a0fbdd08325922b7748486f0e3782
SSDEEP 49152:FgWRyZGn8W4PFGo7nghXwOub95Gx3mL5:YHrOhXx+7Gxc5
TLSH
T1D4A5E006F3A581EDD5A664348A92D70BF33178561B21CACB23ED1A955F973F00EFA384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wordexe.exe

File Explorer

wordexe.exe

.exe 2.1MB

wordexe.exe

IMPHASH 2968488b725fe9bf77d1560bb6b0a7f8
SHA256 da9ef04fb7522a1a8699da040e38c119c0d197d6202d671cde9113ea101d8256
MD5 42abe7ba125ca9f3c8ac67f6f9f23cb2
SHA1 1952bd7a9fd49f2a26893b0d5f7dc378e691aeee
SHA512 46442753e8ee2840613fda4e1dd8d33c8907c257419f931a72ab79c86cd61ef86c532a6143a5fe29bfd9877ab4d859c80c2a0fbdd08325922b7748486f0e3782
SSDEEP 49152:FgWRyZGn8W4PFGo7nghXwOub95Gx3mL5:YHrOhXx+7Gxc5
TLSH
T1D4A5E006F3A581EDD5A664348A92D70BF33178561B21CACB23ED1A955F973F00EFA384
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

572796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zentaxbabaprada\Desktop\zentaxmain\Build\Cheat\MWFree+_Cheat_x64.pdb

ntdll

RtlCaptureContext RtlPcToFileHeader RtlVirtualUnwind RtlUnwindEx RtlLookupFunctionEntry ZwReadVirtualMemory RtlUnwind

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Process32First WriteProcessMemory SetConsoleTextAttribute SetConsoleTitleA GetStdHandle Module32Next Module32First OpenProcess CreateToolhelp32Snapshot Sleep QueryFullProcessImageNameA Process32Next CloseHandle FreeConsole CreateThread Beep ReadProcessMemory AllocConsole GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GlobalLock FindFirstFileExW FindClose GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess GlobalFree GlobalAlloc MultiByteToWideChar ReadFile LoadLibraryExW SetStdHandle HeapReAlloc CreateFileW HeapSize SetEndOfFile FindNextFileW AcquireSRWLockExclusive TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetLastError RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW WriteConsoleW

user32

EmptyClipboard CloseClipboard SetClipboardData GetCursorPos SetCursorPos ReleaseCapture GetClipboardData OpenClipboard IsWindowUnicode DispatchMessageA DestroyWindow SetWindowPos GetSystemMetrics ShowWindow GetAsyncKeyState SetWindowLongA SetWindowDisplayAffinity DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage mouse_event PeekMessageA UnregisterClassA FindWindowA RegisterClassExA UpdateWindow GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect

shell32

ShellExecuteW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

776KB

Virtual Size

775KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

407KB

Virtual Size

406KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

956KB

Virtual Size

963KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

wordexe.exe

ntdll

d3d11

d3dx11_43

kernel32

user32

shell32

imm32

d3dcompiler_43

dwmapi

generic