Login (1)[.]exe | Triage™

Resubmissions

23/10/2026, 10:24

261023-mfsp2aa12x8

23/10/2026, 10:20

261023-mc3e3ads8l8

Sharing

Copy URL Twitter E-mail

General

Target
Login (1).exe
Size 1.6MB
Sample261023-mfsp2aa12x
SHA256 98d74e17be4e48953c00a6f64bcd5d4b8fd71f306eea94988d0ea84199d84cb0
MD5 583c66f4d7d2c071a21150f872a79f87
SHA1 f8493717ffb3edb7ec2eefadbf5f8a4459302bfe
SHA512 941a7eeb62063483d4eb7c850cb0b12ec73edf5131034fec1e44668a88ece484366ff0425bd2c6393fff1e05d979abf9b0049c71feab80a25acd722efd4a1c74
SSDEEP 24576:+gd0jA9ONYIfDDxvr5/j5n23x0okGflNE0h1qCIJMaDLOt3ianEadA:+Tk9k7DARke20h1qUnbd
TLSH
T1AE75BF56B2E401E9E037917DC6ABAB47FA72780907209ACB03E446D92F677E5077F312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Login (1).exe

File Explorer

Login (1).exe

IMPHASH 1a0c82e61f4d9a0bb7b84c9fb64b46b5
SHA256 98d74e17be4e48953c00a6f64bcd5d4b8fd71f306eea94988d0ea84199d84cb0
MD5 583c66f4d7d2c071a21150f872a79f87
SHA1 f8493717ffb3edb7ec2eefadbf5f8a4459302bfe
SHA512 941a7eeb62063483d4eb7c850cb0b12ec73edf5131034fec1e44668a88ece484366ff0425bd2c6393fff1e05d979abf9b0049c71feab80a25acd722efd4a1c74
SSDEEP 24576:+gd0jA9ONYIfDDxvr5/j5n23x0okGflNE0h1qCIJMaDLOt3ianEadA:+Tk9k7DARke20h1qUnbd
TLSH
T1AE75BF56B2E401E9E037917DC6ABAB47FA72780907209ACB03E446D92F677E5077F312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

783936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\projects\rig8\Release\Login.pdb

d3d9

Direct3DCreate9

crypt32

CryptUnprotectData CryptProtectData

bcrypt

BCryptDestroyKey BCryptDestroySecret BCryptVerifySignature BCryptSecretAgreement BCryptDeriveKey BCryptFinalizeKeyPair BCryptImportKeyPair BCryptExportKey BCryptDecrypt BCryptEncrypt BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptHash BCryptDestroyHash BCryptCreateHash

winhttp

WinHttpOpen WinHttpConnect WinHttpReadData WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCloseHandle

kernel32

GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetConsoleCtrlHandler GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW CreateDirectoryW CreateFileA CreateFileW DeleteFileA DeleteFileW GetFileAttributesW GetFileSize ReadFile WriteFile CloseHandle GetLastError WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId CreateThread CreateRemoteThread GetExitCodeThread CreateProcessW OpenProcess GetTickCount GetTickCount64 VirtualAllocEx WriteProcessMemory CreateFileMappingW MapViewOfFile VirtualFreeEx UnmapViewOfFile IsWow64Process GetSystemWow64DirectoryW GetModuleFileNameA GetModuleFileNameW LocalFree GetEnvironmentStringsW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW OutputDebugStringW K32EnumProcessModulesEx K32GetModuleBaseNameW GlobalAlloc GlobalUnlock GlobalLock GlobalFree VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA VerifyVersionInfoW IsProcessorFeaturePresent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry ExitProcess RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetLocaleInfoEx FormatMessageA GetSystemTimePreciseAsFileTime GetCurrentThreadId TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive TerminateProcess GetModuleHandleExW GetStdHandle GetCurrentThread GetCommandLineW FreeEnvironmentStringsW SetEnvironmentVariableW MoveFileExW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType GetTempPathW IsThreadAFiber VirtualProtect LoadLibraryExW GetDateFormatW SetStdHandle GetStringTypeW HeapSize HeapReAlloc SetEndOfFile GetProcessHeap GetTimeFormatW WriteConsoleW Process32NextW RtlUnwind

user32

SetWindowLongW SetWindowLongA MonitorFromWindow GetMonitorInfoA EnumDisplayMonitors GetWindowLongW WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect SetWindowTextW ReleaseDC GetDC GetForegroundWindow SetCapture GetCapture GetKeyState SetFocus BringWindowToTop SetLayeredWindowAttributes IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorA GetWindow GetWindowThreadProcessId EnumWindows FindWindowA MessageBoxA GetWindowRect GetWindowTextW SetForegroundWindow UpdateWindow GetSystemMetrics IsIconic IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA PostQuitMessage DefWindowProcA SendMessageA PeekMessageA DispatchMessageA TranslateMessage SetProcessDPIAware ReleaseCapture

gdi32

GetDeviceCaps CreateRectRgn DeleteObject

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteA

ncrypt

NCryptFinalizeKey NCryptImportKey NCryptSetProperty NCryptSignHash NCryptDeleteKey NCryptFreeObject NCryptOpenKey NCryptFreeBuffer NCryptEnumKeys NCryptExportKey NCryptOpenStorageProvider

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Login (1).exe

d3d9

crypt32

bcrypt

winhttp

kernel32

user32

gdi32

advapi32

shell32

ncrypt

imm32

dwmapi

generic