ClaudeV4[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ClaudeV4.exe
Size 989KB
Sample260913-x8rnjsseqh
SHA256 49774aa73634158f3a99ccd694a154066d5e4221693c0bad4ab31e5ec840745f
MD5 0b7ea22c64f3ea7010bdcb3c2cbe2fe3
SHA1 1fa18f6786fd522bba06780438789b38121892fe
SHA512 e2e902cc646e108575de82e02aebf459a49a38c4907c97d60ee111e2e0724d0ad886556a40823a41bc9f9aed399df0d9a41c2aa5c2f6ed48ef49e41720ba701c
SSDEEP 24576:vMWrsC/hsVISNYIW1VJ80uz7sIf3J9yRyMwFt7zdiXnHPV:0WrXhsWSiJXn9
TLSH
T1D625AF49F1E940EDE03FB57499A6A50BEA313809173099DB13D059992FB37F09BBB702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ClaudeV4.exe

File Explorer

ClaudeV4.exe

.exe 989KB

ClaudeV4.exe

IMPHASH 46d5163b5529e533b2e4544c698440a6
SHA256 49774aa73634158f3a99ccd694a154066d5e4221693c0bad4ab31e5ec840745f
MD5 0b7ea22c64f3ea7010bdcb3c2cbe2fe3
SHA1 1fa18f6786fd522bba06780438789b38121892fe
SHA512 e2e902cc646e108575de82e02aebf459a49a38c4907c97d60ee111e2e0724d0ad886556a40823a41bc9f9aed399df0d9a41c2aa5c2f6ed48ef49e41720ba701c
SSDEEP 24576:vMWrsC/hsVISNYIW1VJ80uz7sIf3J9yRyMwFt7zdiXnHPV:0WrXhsWSiJXn9
TLSH
T1D625AF49F1E940EDE03FB57499A6A50BEA313809173099DB13D059992FB37F09BBB702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

hgw5g34g4535g4

Minor OS version

Major OS version

Entry point

573704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Bruger\source\repos\Test\x64\Release\Test.pdb

kernel32

QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter SetPriorityClass GetCurrentProcess Module32Next OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 Process32Next CloseHandle ReadProcessMemory SetEndOfFile WriteConsoleW HeapSize CreateFileW HeapReAlloc SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LoadLibraryA GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GetModuleFileNameW TerminateProcess ExitProcess GetModuleHandleExW FreeLibraryAndExitThread GlobalFree GlobalAlloc MultiByteToWideChar GetFileSizeEx OutputDebugStringA ExitThread CreateThread ReadFile FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive GetLastError WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimePreciseAsFileTime GetStringTypeW GetCPInfo RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException RtlUnwind

user32

EmptyClipboard CloseClipboard OpenClipboard SetClipboardData SetCursorPos ReleaseCapture IsWindowUnicode GetClipboardData GetCursorPos GetClientRect GetWindowThreadProcessId DispatchMessageA IsWindowVisible SetWindowPos ShowWindow GetAsyncKeyState SetWindowLongA GetWindowTextA GetWindowLongA EnumDisplaySettingsA EnumWindows DefWindowProcA CreateWindowExA SetLayeredWindowAttributes BringWindowToTop TranslateMessage PeekMessageA PostQuitMessage RegisterClassExA UpdateWindow SetForegroundWindow SendInput DefWindowProcW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor

gdi32

CreateSolidBrush

shell32

ShellExecuteW

ole32

CoUninitialize CoInitializeEx

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

winmm

timeEndPeriod timeBeginPeriod

Name

.text

Size

759KB

Virtual Size

759KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ClaudeV4.exe

kernel32

user32

gdi32

shell32

ole32

imm32

dwmapi

d3d9

winmm

generic