FPilot[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FPilot.exe
Size 2.5MB
Sample260722-c7pscacm4t
SHA256 4234cabddbf7c9e66815119d1e51424e1ef6ddac1e5ce444aea3445a26e0761f
MD5 2a8963bcd3b595838965f2bc1762a39e
SHA1 80478b86c60da7ba49d62ee3956a4377af0d6c79
SHA512 fb22242d54eda30ac51d3a72a934202d8b05d272614936205a6b9a069156ac8c128af57234c722b95facc37b7defaf1bf835e5c0bb7d80a83a81d73593e18bfa
SSDEEP 49152:XV5NM9TmUlBLahuS0z1eMvduURTDUrOnU7A9Q2HtV:FCdsdmH
TLSH
T1F6C53B0632544094E72DC1BCD57622B7E373388E9E2369774AE01A897F52BACF239735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

FPilot.exe

.exe 2.5MB

FPilot.exe

IMPHASH ef458a57c237ba27dba737b15c3cae61
SHA256 4234cabddbf7c9e66815119d1e51424e1ef6ddac1e5ce444aea3445a26e0761f
MD5 2a8963bcd3b595838965f2bc1762a39e
SHA1 80478b86c60da7ba49d62ee3956a4377af0d6c79
SHA512 fb22242d54eda30ac51d3a72a934202d8b05d272614936205a6b9a069156ac8c128af57234c722b95facc37b7defaf1bf835e5c0bb7d80a83a81d73593e18bfa
SSDEEP 49152:XV5NM9TmUlBLahuS0z1eMvduURTDUrOnU7A9Q2HtV:FCdsdmH
TLSH
T1F6C53B0632544094E72DC1BCD57622B7E373388E9E2369774AE01A897F52BACF239735
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

6a:07:20:68:d2:46:69:6f:21:92:b8:fa:80:40:0b:47:27:cb:82:91:c0:74:61:f5:9d:66:bb:ed:e6:1a:e6:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=081646872,CN=VOIDSTAR d.o.o.,O=VOIDSTAR d.o.o.,STREET=Zagrebacka ulica 37,L=Samobor,ST=Zagrebačka,C=HR,1.2.840.113549.1.9.1=#0c1a766a656b6f736c617640766f6964737461722e6469676974616c,1.3.6.1.4.1.311.60.2.1.3=#13024852,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 15, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

15:2d:f8:99:be:23:90:d5:61:9d:ea:b1

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 11, 2025 - Dec 12, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

1955936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vjekoslav\Projects\Voidstar\File Pilot\Bin\FPilot.pdb

kernel32

CreateEventW CreateSemaphoreExW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess GetCurrentThread GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue CreateProcessW OpenProcess GetSystemInfo GetLocalTime VirtualAlloc VirtualFree SetProcessWorkingSetSize CreateThreadpool SetThreadpoolThreadMinimum CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress WaitForMultipleObjectsEx LockResource FindResourceW LoadLibraryA LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock GlobalFree LocalAlloc LocalFree FormatMessageA QueryFullProcessImageNameW MoveFileExW SetVolumeLabelW ReadDirectoryChangesW GetComputerNameW VerifyVersionInfoW SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetTimeFormatW GetDateFormatEx WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore SetEvent CancelIoEx GetOverlappedResult DeviceIoControl QueryPerformanceFrequency QueryPerformanceCounter GetLastError SetUnhandledExceptionFilter CloseHandle OutputDebugStringW OutputDebugStringA GetVolumePathNamesForVolumeNameW GetTempPathW CreateMutexW WriteFile ReadFile GetVolumeInformationW GetLogicalDriveStringsW GetFullPathNameW GetFinalPathNameByHandleW GetFileSizeEx GetFileSize GetFileAttributesExW GetFileAttributesW GetDriveTypeW GetDiskFreeSpaceExW FlushFileBuffers FindVolumeClose FindNextVolumeW FindNextFileW FindFirstVolumeW FindFirstFileExW FindFirstFileW FindClose DeleteFileW CreateFileW ExpandEnvironmentStringsW GetCommandLineW LoadResource VerSetConditionMask

user32

GetSubMenu DestroyMenu CreatePopupMenu GetMenuStringW GetSystemMetrics MsgWaitForMultipleObjectsEx ReleaseCapture SetCapture ToUnicode GetMenuItemInfoW GetFocus AddClipboardFormatListener IsClipboardFormatAvailable EmptyClipboard RegisterClipboardFormatW GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed IsIconic GetWindowPlacement SetWindowPos ShowWindow GetMonitorInfoW MonitorFromWindow MonitorFromRect SystemParametersInfoW EnumDisplaySettingsW GetIconInfo DestroyIcon LoadIconW LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowW InflateRect FillRect WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor MessageBoxW GetWindowRect GetClientRect SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetMenuItemCount DestroyWindow CreateWindowExW RegisterClassW GetDoubleClickTime PostQuitMessage DefWindowProcW DefWindowProcA PostMessageW UnregisterDeviceNotification RegisterDeviceNotificationW SendMessageTimeoutW SendMessageW GetDC GetForegroundWindow PeekMessageW DispatchMessageW TranslateMessage RegisterWindowMessageW GetKeyState DrawTextW GetMenuDefaultItem

opengl32

glTexParameteri glPixelStorei glViewport glGetString glReadPixels glTexParameterf glGenTextures glEnable glDeleteTextures glClearColor glClear glBlendFunc glBindTexture wglMakeCurrent wglGetProcAddress wglDeleteContext wglCreateContext glScissor

gdi32

TextOutW SwapBuffers GetCurrentObject SetTextColor Rectangle SetDCBrushColor SetDCPenColor StretchBlt SetPixelFormat GetObjectW SelectObject GetDIBits GetDeviceCaps DescribePixelFormat DeleteObject DeleteDC CreateSolidBrush CreateFontW CreateCompatibleDC SetBkMode CreateDIBSection CreateCompatibleBitmap ChoosePixelFormat GetStockObject BitBlt

shell32

ShellExecuteW DragQueryFileW CommandLineToArgvW ord727 SHGetIDListFromObject SHGetPropertyStoreFromParsingName ord155 SHEmptyRecycleBinW SHGetSpecialFolderLocation SHGetKnownFolderPath SHGetKnownFolderItem SHGetDesktopFolder ord88 SHBindToParent SHParseDisplayName SHAppBarMessage SHCreateShellItem SHGetFileInfoW SHCreateItemFromParsingName

ole32

OleInitialize RegisterDragDrop PropVariantClear CoCreateInstance CoUninitialize RevokeDragDrop ReleaseStgMedium CoTaskMemFree

advapi32

RegQueryValueExW CheckTokenMembership FreeSid RegCloseKey RegGetValueW RegDeleteTreeW RegSetValueExW AllocateAndInitializeSid RegOpenKeyExW RegDeleteValueW RegCreateKeyExW

dwmapi

DwmSetWindowAttribute

dwrite

DWriteCreateFactory

comctl32

ord345

shlwapi

PathRemoveFileSpecW PathFindFileNameW AssocGetPerceivedType PathFileExistsW

propsys

PSFormatPropertyValue PSGetPropertyDescription

netapi32

NetApiBufferFree NetShareEnum

mpr

WNetGetConnectionW

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

Sharing

General

Malware Config

Signatures

File Explorer

FPilot.exe

kernel32

user32

opengl32

gdi32

shell32

ole32

advapi32

dwmapi

dwrite

comctl32

shlwapi

propsys

netapi32

mpr

d3d11

d3dcompiler_47

generic