General

  • Target
    playit.exe
  • Size 31.5MB
  • Sample260711-gymnvae141
  • SHA256 2d660eedac61814dfbae5f95c2d0a200a58e9769d6386ccc0e80a59f7d8c9470
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Revoked Certificate in Chain 2 IoCs

    One or more certificates in the signing chain have been revoked, indicating potential compromise.

  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 19 IoCs

    File was codesigned using an insecure algorithm.

  • Unsigned PE 24 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 2 IoCs

    Codesigned file was signed by an untrusted entity.

  • NSIS installer 4 IoCs

File Explorer

  • playit.exe
    .exe 31.5MB
  • $PLUGINSDIR/System.dll
    .dll 10KB
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • D3Dcompiler_47.dll
    .dll 3.3MB
  • PLAYit.exe
    .exe 174KB
  • Qt5Core.dll
    .dll 4.6MB
  • Qt5Gui.dll
    .dll 4.7MB
  • Qt5Network.dll
    .dll 944KB
  • Qt5Svg.dll
    .dll 264KB
  • Qt5Widgets.dll
    .dll 4.3MB
  • Uninstall.exe
    .exe 177KB
  • $PLUGINSDIR/System.dll
    .dll 10KB
  • $PLUGINSDIR/modern-wizard.bmp
    25KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • avcodec-57.dll
    .dll 10.0MB
  • avdevice-57.dll
    .dll 131KB
  • avfilter-6.dll
    .dll 243KB
  • avformat-57.dll
    .dll 1.4MB
  • avutil-55.dll
    .dll 357KB
  • bearer/qgenericbearer.dll
    .dll 43KB
  • ffspliter.exe
    .exe 106KB
  • fullscreen-24.png
    .png 147B
  • iconengines/qsvgicon.dll
    .dll 36KB
  • imageformats/qgif.dll
    .dll 31KB
  • imageformats/qicns.dll
    .dll 38KB
  • imageformats/qico.dll
    .dll 32KB
  • imageformats/qjpeg.dll
    .dll 243KB
  • imageformats/qsvg.dll
    .dll 26KB
  • imageformats/qtga.dll
    .dll 26KB
  • imageformats/qtiff.dll
    .dll 332KB
  • imageformats/qwbmp.dll
    .dll 25KB
  • imageformats/qwebp.dll
    .dll 411KB
  • libEGL.dll
    .dll 18KB
  • libGLESV2.dll
    .dll 1.9MB
  • libeay32.dll
    .dll 1.2MB
  • libgcc_s_dw2-1.dll
    .dll 119KB
  • libiconv-2.dll
    .dll 1.0MB
  • libssl32.dll
    .dll 266KB
  • libwinpthread-1.dll
    .dll 63KB
  • open-24.png
    .png 189B
  • platforms/qwindows.dll
    .dll 1.1MB
  • player.dll
    .dll 208KB
  • playit.ico
    124KB
  • sdl2.dll
    .dll 1.1MB
  • soundtouch.dll
    .dll 132KB
  • ssleay32.dll
    .dll 278KB
  • swresample-2.dll
    .dll 111KB
  • swscale-4.dll
    .dll 417KB
  • testplayer.exe
    .exe 2.0MB
  • vc_redist.x86.exe
    .exe 13.1MB
  • videowidget.exe
    .exe 174KB
  • zlib1.dll
    .dll 95KB

playit.exe

  • IMPHASH b76363e9cb88bf9390860da8e50999d2
  • SHA256 2d660eedac61814dfbae5f95c2d0a200a58e9769d6386ccc0e80a59f7d8c9470
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Unsigned PE

    Checks for missing Authenticode signature.

  • NSIS installer

Minor OS version
0
Major OS version
4
Entry point
12586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths