Lain[.]exe | Triage™

Resubmissions

04/11/2026, 19:59

261104-yqglasc14v5

04/11/2026, 19:56

261104-yn7dyaft8q5

Sharing

Copy URL Twitter E-mail

General

Target
Lain.exe
Size 2.0MB
Sample261104-yn7dyaft8q
SHA256 04d9234304472cf8396bdccea396a3231029429a72b90f214bc39c37c9728023
MD5 5c3ab1094a53e235f21033300c7ef529
SHA1 cb03a7321722e27cd7e4884dc9e878d1baf9a984
SHA512 1a13fd23301838d091a5435a8240957e756fe65799ed36f5ef27b82671f2ed940f5fff33e259323545634d7918f561a18c2dd809cdae5931f13eb06340ea9418
SSDEEP 49152:hY7xH8jKhbs8D5Vb7W4MJwhMgb0Br8sm893lbcKO:hY7xH8jKlsg5Fy7ab0Br8sRn4KO
TLSH
T1EFA533137AA8632ED07D5871C46C55B28532BF586B03CC0F37AAF23B7D61A849B6539C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Lain.exe

File Explorer

Lain.exe

.exe 2.0MB

Lain.exe

IMPHASH 3d593af6c8c97fda57d0f886341bfa97
SHA256 04d9234304472cf8396bdccea396a3231029429a72b90f214bc39c37c9728023
MD5 5c3ab1094a53e235f21033300c7ef529
SHA1 cb03a7321722e27cd7e4884dc9e878d1baf9a984
SHA512 1a13fd23301838d091a5435a8240957e756fe65799ed36f5ef27b82671f2ed940f5fff33e259323545634d7918f561a18c2dd809cdae5931f13eb06340ea9418
SSDEEP 49152:hY7xH8jKhbs8D5Vb7W4MJwhMgb0Br8sm893lbcKO:hY7xH8jKlsg5Fy7ab0Br8sRn4KO
TLSH
T1EFA533137AA8632ED07D5871C46C55B28532BF586B03CC0F37AAF23B7D61A849B6539C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempFileNameA GetTempPathA GetModuleFileNameA CreateDirectoryA LoadLibraryA FreeLibrary DeleteFileA GetStartupInfoA LeaveCriticalSection DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsA GetVersionExA InitializeCriticalSection lstrcpyA FindFirstFileA FindNextFileA LockResource FreeResource FindClose GetProcAddress LoadResource GetSystemDirectoryA GetModuleHandleA GetWindowsDirectoryA FindResourceA lstrlenA InterlockedIncrement lstrcmpA InterlockedDecrement GetCurrentThreadId

user32

GetSystemMetrics GetAsyncKeyState GetCapture MapDialogRect GetWindowRect GetWindowPlacement SystemParametersInfoA GetLastActivePopup GetNextDlgTabItem IsIconic CheckMenuItem ModifyMenuA GetMenuState IsWindow MapWindowPoints DefWindowProcA GetFocus CreateWindowExA CreateDialogIndirectParamA ScreenToClient ClientToScreen CallWindowProcA DestroyWindow EnableMenuItem GetClientRect SetWindowLongA PostQuitMessage GetTopWindow IsDialogMessageA MessageBoxA DrawTextA GetWindow InvalidateRect IsWindowEnabled GetWindowLongA GetActiveWindow SetActiveWindow EndPaint BeginPaint ReleaseDC GetDesktopWindow GetWindowDC CopyRect LoadImageA DestroyCursor LoadStringA WinHelpA UpdateWindow PeekMessageA GetMessageA TranslateMessage DispatchMessageA LoadCursorA SetCursor UnhookWindowsHookEx SetWindowsHookExA CallNextHookEx EndDialog GetWindowTextA GetWindowTextLengthA EnableWindow ShowWindow IsWindowVisible SetFocus GetSysColor PostMessageA GetDlgItem SetWindowTextA GetParent LoadIconA SendMessageA SetWindowPos

gdi32

AddFontResourceA SetBkColor ExtTextOutA CreateSolidBrush DeleteObject CreatePen Rectangle MoveToEx LineTo SetPixelV BitBlt SetBkMode GetObjectA SetTextColor CreateCompatibleDC SelectObject DeleteDC CreateFontIndirectA CreateCompatibleBitmap

comctl32

ord17 PropertySheetA

advapi32

RegSetValueExA RegOpenKeyExA RegSetValueA RegCloseKey RegCreateKeyA RegQueryValueExA

shell32

SHGetPathFromIDListA SHGetMalloc SHBrowseForFolderA ShellExecuteA

msvcrt

__p__fmode __setusermatherr _controlfp __p__commode _adjust_fdiv _acmdln _initterm __getmainargs _exit exit _XcptFilter calloc _onexit __dllonexit malloc _fullpath fwrite fseek ftell fread fopen _ftol fclose _getmbcp strrchr _ismbcdigit atoi __set_app_type _except_handler3 _mbsnbcmp sprintf __CxxFrameHandler ??3@YAXPAX@Z memset _stricmp memcpy strlen strncmp strcat _splitpath ??2@YAPAXI@Z _strdup free __p___argv __p___argc _mbclen wcslen _mbsinc memmove _mbsstr vsprintf

msvcp60

??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ