OnceHumanNative[.]exe

Resubmissions

02/11/2026, 17:03

261102-vknkwady3k

02/11/2026, 16:57

261102-vgjshsdx8q3

Sharing

Copy URL Twitter E-mail

General

Target
OnceHumanNative.exe
Size 3.5MB
Sample261102-vknkwady3k
SHA256 c0c87f45b5830372efcfe50ab9dc7d66f6d81267b27ee4cc4c19478c0debce89
MD5 f5a9ea5aea54ed7bc263a3edec2adb15
SHA1 5bdb71194a289a34ad8c77104cc1f3cb17e24ef6
SHA512 566111a87bd5a439b3bcb3b525c9c4e8aabb9d5985f4525c9eb6d6d384f81913fc39ef903a69431cead1d4adf117c1f0a6568c8a2b1ecfef9c84bba68b65e584
SSDEEP 24576:3whkWUOsfBH7UK3ZEI+olmF8Vq1zUeS0fJ4dnaAw+6SulWCbutLnBsaqLeDkq0pn:kkPh7TES4FckY+SaASSru2BuLe4k
TLSH
T106F5F5017270C4E5C325813C8CDBCB99AB717C658F22479736E2736F5E366E52EBA602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OnceHumanNative.exe

File Explorer

OnceHumanNative.exe

.exe 3.5MB

OnceHumanNative.exe

IMPHASH 03c752bb2bfe0ec58a0f80a5573a83a9
SHA256 c0c87f45b5830372efcfe50ab9dc7d66f6d81267b27ee4cc4c19478c0debce89
MD5 f5a9ea5aea54ed7bc263a3edec2adb15
SHA1 5bdb71194a289a34ad8c77104cc1f3cb17e24ef6
SHA512 566111a87bd5a439b3bcb3b525c9c4e8aabb9d5985f4525c9eb6d6d384f81913fc39ef903a69431cead1d4adf117c1f0a6568c8a2b1ecfef9c84bba68b65e584
SSDEEP 24576:3whkWUOsfBH7UK3ZEI+olmF8Vq1zUeS0fJ4dnaAw+6SulWCbutLnBsaqLeDkq0pn:kkPh7TES4FckY+SaASSru2BuLe4k
TLSH
T106F5F5017270C4E5C325813C8CDBCB99AB717C658F22479736E2736F5E366E52EBA602
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1063744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage GetMessageW DispatchMessageW MessageBoxW PostMessageW GetAncestor CreateIconIndirect DestroyCursor LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetWindowThreadProcessId EnumWindows SetWindowLongPtrW GetWindowLongPtrW PtInRect FillRect ClipCursor ClientToScreen GetCursor GetCursorPos SetCursor SetCursorPos ShowCursor GetWindowRect GetClientRect GetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow SetActiveWindow ReleaseCapture SetCapture GetCapture SendInput GetAsyncKeyState GetKeyState SetFocus IsIconic IsWindowVisible SetWindowPos SetLayeredWindowAttributes UpdateLayeredWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostThreadMessageW UnregisterHotKey RegisterHotKey PeekMessageW TrackMouseEvent

gdi32

GdiFlush SetWindowExtEx SetViewportExtEx PolyBezierTo Polyline Polygon TextOutW MoveToEx FillPath EndPath CloseFigure BeginPath CreateDIBSection SetTextColor SetTextCharacterExtra SetMapMode SetBitmapBits SetBkMode SelectObject SaveDC RoundRect RestoreDC Rectangle LineTo IntersectClipRect GetTextExtentPoint32W GetStockObject Ellipse DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap CreateBitmap BitBlt

shell32

ShellExecuteW SHGetKnownFolderPath ord680 CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

kernel32

DuplicateHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind FlsFree ExitProcess FlsGetValue FlsAlloc SetLastError GetProcessHeap RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead SetEndOfFile SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode ReadConsoleW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileSizeEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc GetExitCodeProcess CreatePipe GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW FlsSetValue SetEnvironmentVariableW GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx DecodePointer HeapSize Sleep GetCommandLineW CompareFileTime GetFileAttributesExW ReadFile CloseHandle GetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetOverlappedResult CancelIoEx SetEvent ResetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects GetProcessTimes GetCurrentProcessId GetCurrentThreadId OpenProcess GetTickCount GetTickCount64 ReadProcessMemory CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW LocalFree MulDiv MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW GetStdHandle WriteFile ReleaseMutex CreateMutexW SetWaitableTimer CreateWaitableTimerExW WriteConsoleW CreateWaitableTimerW TerminateProcess CreateProcessW GetCurrentProcess CreateRemoteThread FlushInstructionCache VirtualAllocEx VirtualQueryEx WriteProcessMemory VirtualFreeEx WideCharToMultiByte Module32FirstW Module32NextW FreeLibrary GetProcAddress LoadLibraryExW Thread32First Thread32Next GetModuleFileNameA LoadLibraryExA FormatMessageA VerSetConditionMask VerifyVersionInfoW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileInformationByHandle GetFileType GetSystemInfo VirtualQuery MoveFileExW EncodePointer QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetLocaleInfoEx FindFirstFileExW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

OnceHumanNative.exe

user32

gdi32

shell32

ole32

advapi32

kernel32

generic