8sZE9d6[.]exe | Triage™

Resubmissions

24/10/2026, 23:20

261024-3bwh5axwgs7

24/10/2026, 23:13

261024-27pvsaex3r7

Sharing

Copy URL Twitter E-mail

General

Target
8sZE9d6.exe
Size 3.8MB
Sample261024-27pvsaex3r
SHA256 2c89e06b5a3f79b03290678c0ee04828f2a8163d8d66868e5eecc7fb03048a54
MD5 de8f67e7ab23ab115bb59ea6e45c0964
SHA1 8d8d6ad15f3db748d378a4d35d5f1a87f6119d62
SHA512 e689284ec87fca8f251cfb1da3682be7842c476f214ac8bc57a393803a538e1c88280adbd2ff7a0d833ec143662f9681945d1394e77c8d8f67c70355a8b0e2ae
SSDEEP 49152:QOosOdbDE8Sn+27hvAOV1HPwfX92FhX/0Yfpvns9oo5aMWfu+PfD9piRBU405ym:AM85O/Pw/kfX/Hpvnsf5aMERPBk0n
TLSH
T164067C27F982535AC139E5B4C3394F59F63570CB9F20EAEB99A40D802CA6DC319353E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8sZE9d6.exe

File Explorer

8sZE9d6.exe

.exe 3.8MB

8sZE9d6.exe

IMPHASH 4dd427e90fbd26a2384b31d9a31f6970
SHA256 2c89e06b5a3f79b03290678c0ee04828f2a8163d8d66868e5eecc7fb03048a54
MD5 de8f67e7ab23ab115bb59ea6e45c0964
SHA1 8d8d6ad15f3db748d378a4d35d5f1a87f6119d62
SHA512 e689284ec87fca8f251cfb1da3682be7842c476f214ac8bc57a393803a538e1c88280adbd2ff7a0d833ec143662f9681945d1394e77c8d8f67c70355a8b0e2ae
SSDEEP 49152:QOosOdbDE8Sn+27hvAOV1HPwfX92FhX/0Yfpvns9oo5aMWfu+PfD9piRBU405ym:AM85O/Pw/kfX/Hpvnsf5aMERPBk0n
TLSH
T164067C27F982535AC139E5B4C3394F59F63570CB9F20EAEB99A40D802CA6DC319353E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

957952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

new_loader.pdb

kernel32

AddVectoredExceptionHandler Beep CloseHandle CreateDirectoryW CreateFileW CreateProcessA CreateRemoteThreadEx CreateToolhelp32Snapshot ExitProcess FindClose FindFirstFileExW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathA GetTimeZoneInformation HeapAlloc HeapFree HeapReAlloc InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryA Module32First Module32Next MultiByteToWideChar QueryPerformanceCounter ReadFile RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleMode SetFileInformationByHandle SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep UnhandledExceptionFilter VirtualAllocEx VirtualProtectEx WaitForSingleObject WriteConsoleW WriteProcessMemory

crypt32

CertAddCertificateContextToStore CertCloseStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

advapi32

CloseServiceHandle EnumServicesStatusA GetTokenInformation OpenProcessToken OpenSCManagerA OpenServiceA QueryServiceConfigA SystemFunction036

user32

GetAsyncKeyState

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

secur32

AcceptSecurityContext AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

ws2_32

WSACleanup WSAGetLastError WSARecv WSASend WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send setsockopt

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler __current_exception __current_exception_context memcmp memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-string-l1-1-0

strlen

Name

.text

Size

944KB

Virtual Size

944KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

287KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

129B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.txet

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

8sZE9d6.exe

kernel32

crypt32

advapi32

user32

version

secur32

ws2_32

api-ms-win-core-synch-l1-2-0

ntdll

bcryptprimitives

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic