Root2Fixed[.]exe | Triage™

Resubmissions

03/05/2026, 00:59

260503-bb7slsas3w

03/05/2026, 00:51

260503-a7p21ah18x7

Sharing

Copy URL Twitter E-mail

General

Target
Root2Fixed.exe
Size 22.5MB
Sample260503-bb7slsas3w
SHA256 7d52fd43bafaad77967449978410cd20a38546001fe8e74c16edd68f04d90d5b
MD5 32d0191deece503a1d7e7567af7f7c12
SHA1 53eb47f549b0b16c6081bc5d9d1879060acdf5d0
SHA512 e426965d03e21768fb44da06b6992646d988b8cb3ebbae3d31e013c02c661d789ae7aa682a4ff885802d0bf23e885cacd51408d2c03c490c715e6ede40750b47
SSDEEP 393216:Vu624cIupiQknCz6xPmb5LBku5Qrr/cdNceE+uaTD0HEak5dupxGf1:Vu6b5nCmxPmbgO0bcdbE+uaTVaMuXGf1
TLSH
T1E8371263FBE180B6C05224B1553BA72FB8FC6774473459C76BD02899AA713D1863A38F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Root2Fixed.exe

File Explorer

Root2Fixed.exe

.exe 22.5MB

Root2Fixed.exe

IMPHASH 701319ac01e0d6216090668cc4e97d4c
SHA256 7d52fd43bafaad77967449978410cd20a38546001fe8e74c16edd68f04d90d5b
MD5 32d0191deece503a1d7e7567af7f7c12
SHA1 53eb47f549b0b16c6081bc5d9d1879060acdf5d0
SHA512 e426965d03e21768fb44da06b6992646d988b8cb3ebbae3d31e013c02c661d789ae7aa682a4ff885802d0bf23e885cacd51408d2c03c490c715e6ede40750b47
SSDEEP 393216:Vu624cIupiQknCz6xPmb5LBku5Qrr/cdNceE+uaTD0HEak5dupxGf1:Vu6b5nCmxPmbgO0bcdbE+uaTVaMuXGf1
TLSH
T1E8371263FBE180B6C05224B1553BA72FB8FC6774473459C76BD02899AA713D1863A38F
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

69:64:35:cc:da:0b:76:7e:d2:20:04:5b:1e:72:f9:a8:88:4c:62:29

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

Chains

Oct 2, 2012

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

Serial Number

4d:4a:a1:fd:f2:6f:9f:33:53:d6:26:14:ed:a6:62:37

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 24, 2012 - Oct 1, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

6035515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

FlashPlayer.pdb

oleaut32

SysFreeString

kernel32

GetCommandLineA GetStartupInfoW GetFileAttributesA CreateFileA WriteFile DeleteFileW GetCommandLineW SetEnvironmentVariableA CompareStringA SetStdHandle WriteConsoleW GetConsoleOutputCP GetModuleFileNameA CreateFileW GetFileSize SetFilePointer ReadFile CloseHandle GetVersionExW GetModuleHandleA GetSystemInfo SwitchToThread TlsGetValue TlsSetValue GetCurrentThreadId LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedDecrement InterlockedIncrement InterlockedExchange WriteConsoleA GetStringTypeW GetStringTypeA GetLocaleInfoA InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc LCMapStringA IsValidCodePage GetOEMCP HeapCreate GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsDebuggerPresent TerminateProcess GetStdHandle GetSystemTimeAsFileTime UnhandledExceptionFilter ExitProcess RtlUnwind GetStartupInfoA IsProcessorFeaturePresent GetProcessAffinityMask HeapSize HeapFree GetProcessHeap HeapAlloc EnumSystemLocalesW GetUserDefaultLCID GetTimeFormatW GetDateFormatW CompareStringW GetCurrencyFormatW GetNumberFormatW TlsFree TlsAlloc VirtualProtect InterlockedCompareExchange Sleep VirtualFree ReleaseMutex GetCPInfo GetACP IsDBCSLeadByte CreateProcessA GetTempPathA FindNextFileW GetModuleFileNameW GetTempFileNameW GetSystemDirectoryW ExpandEnvironmentStringsA WideCharToMultiByte MultiByteToWideChar FindClose GetTempPathW CreateProcessW GetTempFileNameA CreateDirectoryA DeleteFileA GetVersionExA GetLastError CreateMutexA FindFirstFileW SetFilePointerEx GetFileSizeEx GetFileAttributesExW GetFileInformationByHandle GetVolumeInformationW MoveFileExW GetCurrentDirectoryW SetCurrentDirectoryW RemoveDirectoryW GetFullPathNameW ExpandEnvironmentStringsW OutputDebugStringA CreateDirectoryW LoadLibraryA GetProcAddress FreeLibrary GetModuleHandleW GetCurrentProcess LoadLibraryW GetFileAttributesW VirtualQuery ExitThread GetUserDefaultLangID GetUserDefaultUILanguage VerifyVersionInfoW VerSetConditionMask GlobalFree CreateThread LockResource LoadResource FindResourceExA FindResourceExW GlobalAlloc GlobalUnlock GlobalLock QueryPerformanceCounter QueryPerformanceFrequency GlobalSize QueueUserAPC OpenThread SleepEx SetUnhandledExceptionFilter GetCurrentProcessId GetProcessTimes RaiseException WaitForSingleObject FlushInstructionCache SetLastError TerminateThread CreateEventW SetEvent ResetEvent GetTickCount SetThreadPriority GetTimeZoneInformation GetSystemTime SystemTimeToFileTime GetLocaleInfoW LCMapStringW GetSystemDirectoryA lstrcpyA lstrlenA MapViewOfFile UnmapViewOfFile WaitForMultipleObjects CompareFileTime LocalFree GetEnvironmentVariableW VirtualAlloc CreateFileMappingA ReleaseSemaphore CreateSemaphoreW SetThreadAffinityMask GetCurrentThread CreateEventA CreateWaitableTimerA SetWaitableTimer CancelWaitableTimer InterlockedExchangeAdd lstrlenW GetVersion DeviceIoControl CreateSemaphoreA

user32

TranslateAcceleratorW TranslateMessage DispatchMessageW SetDlgItemTextW SetDlgItemTextA SetFocus GetWindowTextLengthW EnableWindow GetDlgItemTextW GetWindowTextLengthA GetDlgItemTextA ShowWindow UpdateWindow GetMenu GetMessageW RemoveMenu InsertMenuW InsertMenuA InvalidateRect LoadStringW DialogBoxParamW EndDialog GetDlgItem LoadStringA SetWindowTextA GetWindowTextA PostQuitMessage UnregisterClassA GetWindow GetWindowRect GetDC ReleaseDC SetWindowPos LoadAcceleratorsW GetMenuStringA EnableMenuItem DefWindowProcW DestroyWindow GetSubMenu GetMenuItemInfoW RegisterWindowMessageA PostMessageA GetDoubleClickTime WaitForInputIdle GetForegroundWindow InflateRect GetSystemMetrics SetRect PtInRect SystemParametersInfoW SendInput SetPropW GetPropW DestroyIcon GetCursor SetCursor SetWindowLongW SetRectEmpty GetKeyState PostMessageW GetMonitorInfoW MonitorFromWindow ClientToScreen FillRect CreateIconIndirect SendMessageW SendMessageTimeoutW GetParent SetWindowTextW LoadIconW GetDesktopWindow DialogBoxIndirectParamW RedrawWindow GetClientRect ScreenToClient MessageBoxA KillTimer SetTimer GetQueueStatus PeekMessageW GetWindowLongW CheckMenuItem GetFocus CopyRect GetWindowInfo LoadCursorW MessageBoxW GetCursorPos EnumWindows GetCapture CallWindowProcW SetCapture GetMessageTime ReleaseCapture TrackMouseEvent SetCursorPos RegisterClipboardFormatW CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable SetClipboardData EmptyClipboard MoveWindow MapWindowPoints GetActiveWindow FlashWindowEx SetMenu GetSystemMenu IsZoomed GetWindowPlacement SetWindowPlacement IsWindowVisible ShowWindowAsync GetClassInfoExW IsIconic IsWindow EnumDisplaySettingsW EndPaint BeginPaint GetWindowTextW RegisterClassExW CreateWindowExW DeleteMenu LoadMenuW RegisterClipboardFormatA GetClipboardFormatNameA InsertMenuItemW CreateMenu EnumDisplayDevicesW DrawMenuBar SetMenuItemInfoW SetMenuInfo DestroyMenu TrackPopupMenu CreatePopupMenu OffsetRect ShowCaret CreateCaret DestroyCaret SetCaretPos DdeUninitialize DdeFreeStringHandle DdeDisconnect DdeClientTransaction DdeConnect DdeCreateStringHandleA DdeInitializeW MapVirtualKeyW GetKeyboardLayout EnumDisplayDevicesA UpdateLayeredWindow GetWindowThreadProcessId GetMenuStringW

gdi32

SelectObject BitBlt CreateDCA GetICMProfileA DeleteDC CreatePalette DeleteObject CreateCompatibleDC EnumFontFamiliesExW GetFontData StretchDIBits FillPath ExtCreatePen StrokePath CreateSolidBrush GetObjectW StartDocW LPtoDP GetStretchBltMode SetStretchBltMode StretchBlt GetWorldTransform SetGraphicsMode SetWorldTransform GetTextCharacterExtra DPtoLP EnumFontFamiliesA GetCurrentObject GetTextExtentPoint32W GetDeviceCaps GetSystemPaletteEntries GetStockObject EndDoc SetPixel CreatePen SetTextCharacterExtra GetBkColor SetBkColor SelectClipRgn GetTextColor GetBkMode GetTextAlign SetBkMode SetTextAlign CreateRectRgn GetClipRgn IntersectClipRect CreateFontIndirectA SetTextColor ExtTextOutW ExtTextOutA EnumFontFamiliesW GetTextExtentPoint32A GetTextMetricsW GdiFlush RestoreDC SelectClipPath PolyBezierTo LineTo MoveToEx EndPath BeginPath EndPage StartPage SaveDC SetPolyFillMode GetClipBox SelectPalette RealizePalette CreateFontIndirectW CreateDIBSection CreateBitmap

comdlg32

GetSaveFileNameW CommDlgExtendedError GetOpenFileNameA GetOpenFileNameW PrintDlgW

shell32

SHAppBarMessage SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetSettings SHGetFolderPathA DragAcceptFiles DragQueryFileA DragQueryFileW SHGetDiskFreeSpaceExW SHGetFolderPathW SHBrowseForFolderW

ws2_32

WSACleanup WSAStartup select ioctlsocket closesocket WSAAsyncSelect WSAGetLastError WSAIoctl socket WSASocketW inet_addr gethostbyname inet_ntoa htonl getservbyname htons gethostbyaddr ntohs getservbyport WSASetLastError gethostname setsockopt recv send getsockname WSACloseEvent recvfrom sendto bind WSAAddressToStringA WSACreateEvent WSAEventSelect WSAEnumNetworkEvents connect ntohl

mscms

TranslateBitmapBits CloseColorProfile CreateColorTransformW OpenColorProfileW DeleteColorTransform

wininet

InternetConnectA HttpQueryInfoA InternetReadFile InternetCloseHandle HttpOpenRequestA HttpSendRequestA InternetOpenA

crypt32

CertCloseStore CertCompareCertificate CertNameToStrW CryptDecodeObjectEx CertFindRDNAttr CertRDNValueToStrW CryptFindOIDInfo CertCompareCertificateName CertAddCertificateContextToStore CertEnumCertificatesInStore CertVerifyTimeValidity CertVerifyRevocation CertFreeCertificateContext CertFindCertificateInStore CertVerifySubjectCertificateContext CertCreateCertificateContext CryptGetMessageCertificates CryptVerifyMessageSignature CertAddStoreToCollection CertOpenStore

urlmon

CopyStgMedium

version

VerQueryValueW VerQueryValueA GetFileVersionInfoSizeW GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps timeKillEvent timeSetEvent timeGetTime waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutGetDevCapsW waveInGetDevCapsW waveOutGetNumDevs waveInGetNumDevs waveOutReset waveOutClose waveInStart waveInAddBuffer waveInStop waveOutOpen waveInClose waveInUnprepareHeader waveInReset waveInPrepareHeader waveInOpen waveOutGetPosition mixerGetID waveInGetDevCapsA waveOutGetDevCapsA waveOutMessage waveInMessage mixerClose mixerGetLineControlsA mixerGetLineInfoA mixerGetDevCapsA mixerOpen mixerGetControlDetailsA waveOutRestart waveOutPause waveInGetPosition mixerSetControlDetails

dsound

ord2 ord1 ord8

advapi32

RegOpenKeyA CryptAcquireContextW CryptGenRandom CryptReleaseContext RegOpenKeyExA RegOpenKeyExW RegCloseKey RegQueryValueExA RegSetValueExA RegCreateKeyExW RegSetValueExW RegQueryValueExW

ole32

PropVariantClear CreateBindCtx CoCreateInstance CoTaskMemFree CoInitializeEx CoInitialize CoUninitialize ReleaseStgMedium OleUninitialize OleSetClipboard OleFlushClipboard OleIsCurrentClipboard OleGetClipboard OleInitialize CoTaskMemAlloc MkParseDisplayName

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

205KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

292KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

271KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Root2Fixed.exe

PE Signature issue

oleaut32

kernel32

user32

gdi32

comdlg32

shell32

ws2_32

mscms

wininet

crypt32

urlmon

version

winmm

dsound

advapi32

ole32

generic