841aee0d[.]exe | Triage™

Resubmissions

01/10/2026, 12:00

261001-n6plqs1gre3

01/10/2026, 11:53

261001-n2aa9a1end3

Sharing

Copy URL Twitter E-mail

General

Target
841aee0d.exe
Size 1.3MB
Sample261001-n2aa9a1end
SHA256 4eba4157dc9e367027722677e878f061275e7992f770b1c302a99743f44947c9
MD5 df2f3828271fd1b99c9a3707655ce45d
SHA1 c699638abed20737a3cea05da13fef043f5dc699
SHA512 c225bf33b24e827dcadd71a81ef3d55c4f98e1fe0efa5690497ae2c2b6172c85c65ce9c5fd8f7c79252f00551925fba60ea781d30b4a1cbf887e5e8878f4c0fc
SSDEEP 24576:8rjXwIJ2kTWJfPc3FQ9NViPaqgYdE+Nd5AdgZZSiTnITE8os8nKvG1Z9:8rjXwIJ2kTQfPAQ9TiPazYrNPzPTnnsQ
TLSH
T13C55AF46F3B242ECC3678238C766931BEB75B41A13204BCB67D05A56AF53AE19F79310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
841aee0d.exe

File Explorer

841aee0d.exe

.exe 1.3MB

841aee0d.exe

IMPHASH f557a0243900d950b8bc7a06a9af6a03
SHA256 4eba4157dc9e367027722677e878f061275e7992f770b1c302a99743f44947c9
MD5 df2f3828271fd1b99c9a3707655ce45d
SHA1 c699638abed20737a3cea05da13fef043f5dc699
SHA512 c225bf33b24e827dcadd71a81ef3d55c4f98e1fe0efa5690497ae2c2b6172c85c65ce9c5fd8f7c79252f00551925fba60ea781d30b4a1cbf887e5e8878f4c0fc
SSDEEP 24576:8rjXwIJ2kTWJfPc3FQ9NViPaqgYdE+Nd5AdgZZSiTnITE8os8nKvG1Z9:8rjXwIJ2kTQfPAQ9TiPazYrNPzPTnnsQ
TLSH
T13C55AF46F3B242ECC3678238C766931BEB75B41A13204BCB67D05A56AF53AE19F79310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

819280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

shell32

ShellExecuteW

ws2_32

accept WSACleanup bind closesocket shutdown listen WSAStartup getsockname send socket ntohs recv htonl

kernel32

GetCurrentThreadId SetUnhandledExceptionFilter GetStartupInfoW Sleep CreateDirectoryW GetVolumeInformationW GetModuleFileNameW GetEnvironmentVariableW GetFileAttributesW CreateToolhelp32Snapshot GetLastError Process32NextW LoadLibraryA Process32FirstW CloseHandle Module32FirstW GetProcAddress WideCharToMultiByte GetCurrentProcessId SizeofResource LockResource LoadResource FindResourceW GetEnvironmentVariableA WaitForSingleObject UnmapViewOfFile CreateEventW GetExitCodeThread LoadLibraryW ReadProcessMemory GetModuleHandleW CreateFileMappingW MapViewOfFile MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree CreateFileMappingA GetSystemTimeAsFileTime InitializeSListHead Module32NextW

user32

ScreenToClient GetCapture GetMessageExtraInfo ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData GetKeyState GetWindowRect CreateWindowExW GetSystemMetrics RegisterClassExW MoveWindow SetLayeredWindowAttributes LoadIconW LoadCursorW DefWindowProcW DestroyWindow SetWindowLongPtrW GetWindowLongPtrW ShowWindow DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage UpdateWindow GetWindowThreadProcessId GetWindowTextLengthW PostMessageW IsWindowVisible EnumWindows SetClipboardData GetWindowTextW

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ _Cnd_broadcast ?_Xbad_alloc@std@@YAXXZ ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_join _Mtx_unlock ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __intrinsic_setjmp __C_specific_handler __std_exception_destroy memmove memcpy __std_exception_copy wcsstr memset __std_terminate strstr memcmp memchr strchr strrchr longjmp

api-ms-win-crt-stdio-l1-1-0

ftell fgetc fseek __stdio_common_vsprintf_s ungetwc __stdio_common_vswscanf __stdio_common_vsscanf fputwc __stdio_common_vsprintf _fseeki64 _wfopen fclose fflush __stdio_common_vfprintf _set_fmode __acrt_iob_func __stdio_common_vswprintf_s fsetpos fgetwc __p__commode fwrite fread ungetc fgetpos setvbuf

api-ms-win-crt-string-l1-1-0

_wcsicmp strncpy wcslen strcpy strlen strcmp strcpy_s strncmp

api-ms-win-crt-runtime-l1-1-0

_get_wide_winmain_command_line _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _beginthreadex _crt_atexit _register_onexit_function _initialize_onexit_table terminate

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-utility-l1-1-0

qsort _lrotl abs

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc free _set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi strtol strtoul

api-ms-win-crt-math-l1-1-0

__setusermatherr sinf acosf cosf sqrtf ldexp fmodf fabs roundf powf ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale