Synthesia[.]exe | Triage™

Resubmissions

14/07/2026, 21:53

260714-1r5evset7q

14/07/2026, 21:50

260714-1pz3cset3r8

Sharing

Copy URL Twitter E-mail

General

Target
Synthesia.exe
Size 19.2MB
Sample260714-1r5evset7q
SHA256 7fbfa73d43dce29e9a4f0322a94500ce9110a711c3cd29bdcdff3ddc634a361f
MD5 5bc2df177a685e66e19e40bb7dc6306a
SHA1 75a297f372c8921ec61fa1ccabe521fa25de05bf
SHA512 b31788d391db6820263f600519020c120165cc01aedc35636c26082c33f4136b7c750425063a1b56f02fa995167ef018994d0623f5ca3df6f212d06c271581f5
SSDEEP 393216:v1MUoI1SFXN4Re7Aa/PAfMwT77No6R/af5wNVMWigOnrarw:dMP6SFXN77Aa/PwMwH7m0Urarw
TLSH
T14617D005367580B2C1AAD138DB87C61AE3307C4697115AEB30D8B6263F73BD68DBF265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
Synthesia.exe

File Explorer

Synthesia.exe

.exe 19.2MB

Synthesia.exe

IMPHASH bac51608266f5e4b03a2750626ed0fd5
SHA256 7fbfa73d43dce29e9a4f0322a94500ce9110a711c3cd29bdcdff3ddc634a361f
MD5 5bc2df177a685e66e19e40bb7dc6306a
SHA1 75a297f372c8921ec61fa1ccabe521fa25de05bf
SHA512 b31788d391db6820263f600519020c120165cc01aedc35636c26082c33f4136b7c750425063a1b56f02fa995167ef018994d0623f5ca3df6f212d06c271581f5
SSDEEP 393216:v1MUoI1SFXN4Re7Aa/PAfMwT77No6R/af5wNVMWigOnrarw:dMP6SFXN77Aa/PwMwH7m0Urarw
TLSH
T14617D005367580B2C1AAD138DB87C61AE3307C4697115AEB30D8B6263F73BD68DBF265
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

0f:25:c2:eb:51:fb:62:c5:e9:74:ae:d8:a9:ba:58:1b:38:89:d6:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Synthesia LLC,O=Synthesia LLC,POSTALCODE=48116,STREET=8830 Amboy Dr,L=Brighton,ST=Michigan,C=US

Chains

Feb 27, 2023

CN=Synthesia LLC,O=Synthesia LLC,POSTALCODE=48116,STREET=8830 Amboy Dr,L=Brighton,ST=Michigan,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Synthesia LLC,O=Synthesia LLC,POSTALCODE=48116,STREET=8830 Amboy Dr,L=Brighton,ST=Michigan,C=US

Serial Number

31:e4:e6:2a:03:84:f9:8c:87:b3:6b:d1:e3:07:d0:6a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2020 - Jun 29, 2023

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Minor OS version

Major OS version

Entry point

3749168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\TeamCityAgent\work\f71b18c76256d81b\build\win\x64\Release\Synthesia.pdb

winmm

midiInClose midiOutOpen midiOutReset midiInAddBuffer midiOutPrepareHeader midiOutLongMsg midiOutUnprepareHeader timeEndPeriod midiOutShortMsg midiInGetNumDevs midiOutGetNumDevs midiInGetDevCapsW midiOutGetDevCapsW midiInOpen midiInPrepareHeader midiInStart midiInStop midiInReset midiOutClose timeBeginPeriod midiInUnprepareHeader

kernel32

GetLocaleInfoEx GlobalAlloc FindFirstFileExW GetCurrentDirectoryW FindClose GetCommandLineW GlobalUnlock GlobalLock DeleteFileA WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW SleepConditionVariableSRW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ReadConsoleW GetFileSizeEx SetFilePointerEx GetConsoleMode GetConsoleOutputCP GetStdHandle FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType FreeLibraryAndExitThread ExitThread CreateThread ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsDebuggerPresent GetExitCodeThread QueryPerformanceFrequency GetOverlappedResult TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead InitializeCriticalSectionAndSpinCount GetCPInfo LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent RtlPcToFileHeader GetStringTypeW GetFileInformationByHandleEx SetFileInformationByHandle GetFinalPathNameByHandleW FindFirstFileW SetFileAttributesW FindNextFileW GetDiskFreeSpaceExW MultiByteToWideChar WideCharToMultiByte SetLastError GetLastError CreateFileW GetFileTime CloseHandle RaiseException GetProcessAffinityMask GetCurrentProcess SetThreadAffinityMask GetCurrentThread SetThreadPriority SetPriorityClass CreateToolhelp32Snapshot GetCurrentProcessId Process32FirstW Process32NextW GetLongPathNameW CreateMutexW GetVersion GetSystemDirectoryW GetModuleFileNameW GetTempPathW GetTempFileNameW GetUserDefaultUILanguage GetLogicalDrives GetCurrentThreadId FlushFileBuffers SetUnhandledExceptionFilter GetSystemInfo QueryPerformanceCounter VirtualQueryEx FindResourceW SizeofResource LoadResource LockResource FreeResource GetFileSize ReadFile LocalFree OpenProcess VirtualAllocEx WriteProcessMemory GetTickCount64 VirtualFreeEx GetModuleHandleW GetProcAddress Sleep AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx WaitForSingleObject GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileW HeapReAlloc LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile GetTickCount SetEvent CreateEventW ResetEvent GetModuleHandleA CancelIo GetFileInformationByHandle

user32

GetWindowTextW SetForegroundWindow EmptyClipboard SendInput EnableWindow SetClipboardData DialogBoxParamW IsClipboardFormatAvailable GetDlgItem LoadIconW GetClipboardData CloseClipboard OpenClipboard ShowWindow GetWindowLongPtrW SetClassLongPtrW SetWindowTextW EndDialog SendMessageW SetWindowLongPtrW ShowCursor SetCursor SetWindowLongW DispatchMessageW TranslateMessage PeekMessageW UnregisterClassW DestroyWindow ReleaseDC GetClientRect UpdateWindow RegisterTouchWindow GetSystemMetrics CreateWindowExW RegisterClassW LoadCursorW GetMonitorInfoW MonitorFromRect SetProcessDPIAware ScreenToClient CloseTouchInputHandle GetTouchInputInfo GetWindowLongW IsZoomed IsIconic InvalidateRect GetDC ToUnicode SystemParametersInfoW EnumWindows GetWindowThreadProcessId MessageBoxW GetKeyState GetKeyboardState GetWindowRect MapVirtualKeyW PostQuitMessage DefWindowProcW SetWindowPos AdjustWindowRect

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW DragQueryFileW SHCreateDirectoryExW SHFileOperationW ShellExecuteW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

ws2_32

htonl htons ntohs ntohl

dbghelp

MiniDumpWriteDump

wininet

InternetGetConnectedState

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpQueryHeaders WinHttpCloseHandle WinHttpSetTimeouts WinHttpOpen

opengl32

wglMakeCurrent wglCreateContext wglGetProcAddress wglDeleteContext

gdiplus

GdipDeleteMatrix GdipScaleMatrix GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipDisposeImage GdipCreatePen1 GdipDeletePen GdipSetPenWidth GdipSetPenLineCap197819 GdipSetPenLineJoin GdipCloneStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipStringFormatGetGenericTypographic GdipCreatePath GdipDeletePath GdipAddPathString GdiplusShutdown GdipDeleteGraphics GdipGetDC GdipReleaseDC GdipCreateMatrix GdipSetSmoothingMode GdipSetWorldTransform GdipDrawPath GdipGraphicsClear GdipFillPath GdipDrawString GdipMeasureString GdipDeleteFontFamily GdipGetEmHeight GdipGetCellAscent GdipCreateFontFromLogfontW GdipBitmapUnlockBits GdiplusStartup GdipBitmapLockBits GdipCloneBitmapAreaI GdipCreateBitmapFromScan0 GdipCloneImage GdipGetFontSize GdipGetFontStyle GdipGetFamily GdipDeleteFont GdipAlloc GdipSetTextRenderingHint GdipFree GdipGetImageGraphicsContext

gdi32

ChoosePixelFormat SetPixelFormat SwapBuffers GetDeviceCaps GetStockObject

advapi32

RegGetValueW RegCreateKeyExW RegSetValueExW

ole32

CoGetObjectContext CoGetApartmentType OleUninitialize OleInitialize RevokeDragDrop RegisterDragDrop CoLockObjectExternal ReleaseStgMedium CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

890KB

Virtual Size

890KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

171KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14.0MB

Virtual Size

14.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Synthesia.exe

winmm

kernel32

user32

shell32

version

setupapi

ws2_32

dbghelp

wininet

winhttp

opengl32

gdiplus

gdi32

advapi32

ole32

bcrypt

generic