scanner[.]exe | Triage™

Resubmissions

03/10/2026, 16:24

261003-twprmsts4p3

03/10/2026, 16:23

261003-twabyseb983

Sharing

Copy URL Twitter E-mail

General

Target
scanner.exe
Size 2.4MB
Sample261003-twprmsts4p
SHA256 d112f36788e26b897096be61316b9a9bb6be0729afae52c1cf40eab2ba4381f9
MD5 02a17bc8f0a534197a52f5db53196584
SHA1 5da432731e1b5b6ec2b3168d9c4ece769cd01c10
SHA512 447bf242ce2e975fafdb15019f7c92e8c00d6953d5dd9b22bb823d44e538236cdcdf4afe1baec4d7447b20984089bec73ceb94c00c6ddbdf42eefb23b5f8948a
SSDEEP 49152:orNgTFGFxqFSbZHDgMIdE2n8GpbdpXRrD:orCGFxqFSb+rdpXRrD
TLSH
T13BB51B4369DB0DEAC9D677B8A1D31335A734FD748B295E2E6A08C2315D636C4AE1FB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
scanner.exe

File Explorer

scanner.exe

.exe 2.4MB

scanner.exe

IMPHASH 3ea088d2659b7734f9258bc5c09a6a9b
SHA256 d112f36788e26b897096be61316b9a9bb6be0729afae52c1cf40eab2ba4381f9
MD5 02a17bc8f0a534197a52f5db53196584
SHA1 5da432731e1b5b6ec2b3168d9c4ece769cd01c10
SHA512 447bf242ce2e975fafdb15019f7c92e8c00d6953d5dd9b22bb823d44e538236cdcdf4afe1baec4d7447b20984089bec73ceb94c00c6ddbdf42eefb23b5f8948a
SSDEEP 49152:orNgTFGFxqFSbZHDgMIdE2n8GpbdpXRrD:orCGFxqFSb+rdpXRrD
TLSH
T13BB51B4369DB0DEAC9D677B8A1D31335A734FD748B295E2E6A08C2315D636C4AE1FB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

BuildTrusteeWithSidW ConvertStringSidToSidW GetSecurityInfo SetEntriesInAclW SetSecurityInfo

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

kernel32

CheckRemoteDebuggerPresent CloseHandle CreateFileW CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FormatMessageA GetCurrentProcess GetCurrentProcessId GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStdHandle GetSystemTimeAsFileTime GetThreadId GetTickCount InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent K32EnumProcessModules K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryFullProcessImageNameW RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _filelengthi64 _fileno fwprintf _fmode _fstat64 _initterm _lseeki64 _onexit _wfopen abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fputwc fread free fsetpos fwrite getc getenv getwc iswalnum iswctype localeconv malloc memchr memcmp memcpy memmove memset putc putwc realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm _write _read _fileno _fdopen

user32

EnumWindows GetClassNameW GetWindowTextW GetWindowThreadProcessId IsWindowVisible

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

wintrust

WinVerifyTrust

Name

.text

Size

771KB

Virtual Size

771KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

scanner.exe

advapi32

bcrypt

kernel32

msvcrt

user32

version

winhttp

wintrust

generic