6f60879203b8d12816d87783a0ccb096d2119f93ca333db3dfe6551e645bf5e9

Sharing

Copy URL Twitter E-mail

General

Target
6f60879203b8d12816d87783a0ccb096d2119f93ca333db3dfe6551e645bf5e9
Size 388KB
Sample260808-e57aqattfw
SHA256 6f60879203b8d12816d87783a0ccb096d2119f93ca333db3dfe6551e645bf5e9
MD5 5c63de1beea741be28c170da084be656
SHA1 d70e8d71a16193383d66e1dff6d9a22e387cbe44
SHA512 665ff0797ce66be3e0a50fe83524fde74da21aa861d66f9ca148aafdc88e0c1403640564005620b4e56e0fd1f77a0bd905d692c86cc46b1651ff205bf75dc76b
SSDEEP 6144:tbL4QKIOkQVOVVFBxiwF4WUU+frsTQS6xpM6nwUe4u1LGPOuO3L8m:tAQKITQ0nPiwOLwTQpM6nwQZob
TLSH
T107849D22FBA484B6C38E1574BBA9BF5AA3FCD6D40BF2C9C7DF84094E1A369C25531114
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
6f60879203b8d12816d87783a0ccb096d2119f93ca333db3dfe6551e645bf5e9

File Explorer

6f60879203b8d12816d87783a0ccb096d2119f93ca333db3dfe6551e645bf5e9

.dll 388KB

6f60879203b8d12816d87783a0ccb096d2119f93ca333db3dfe6551e645bf5e9

IMPHASH 5f2ca43db0035eaf97846728b85e84a1
SHA256 6f60879203b8d12816d87783a0ccb096d2119f93ca333db3dfe6551e645bf5e9
MD5 5c63de1beea741be28c170da084be656
SHA1 d70e8d71a16193383d66e1dff6d9a22e387cbe44
SHA512 665ff0797ce66be3e0a50fe83524fde74da21aa861d66f9ca148aafdc88e0c1403640564005620b4e56e0fd1f77a0bd905d692c86cc46b1651ff205bf75dc76b
SSDEEP 6144:tbL4QKIOkQVOVVFBxiwF4WUU+frsTQS6xpM6nwUe4u1LGPOuO3L8m:tAQKITQ0nPiwOLwTQpM6nwQZob
TLSH
T107849D22FBA484B6C38E1574BBA9BF5AA3FCD6D40BF2C9C7DF84094E1A369C25531114
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

50:07:8a:3e:48:18:6e:42:47:6f:68:1e:a2:cd:13:32:16:f9:36:d4:51:e3:bc:9d:39:04:70:11:26:4a:43:0b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Chains

Jun 26, 2026

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Serial Number

33:00:02:74:4a:32:57:a4:44:af:c4:c8:80:00:00:00:02:74:4a

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2026 - Jun 28, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

254043

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Sources\foobar2000-2.25\foobar2000\Release\foo_fileops.pdb

kernel32

MultiByteToWideChar GetCurrentThread OutputDebugStringW GetVolumePathNameW CreateHardLinkW GetTickCount64 WaitForSingleObject CloseHandle GlobalSize CreateEventW SetEvent ResetEvent GlobalUnlock NormalizeString GlobalAlloc GlobalFree GetTickCount lstrlenW VerSetConditionMask VerifyVersionInfoW GetVersionExW GetThreadPriority SetThreadPriority ResumeThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime IsDebuggerPresent GetSystemTimeAsFileTime InitOnceBeginInitialize InitOnceComplete EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent GetCurrentProcess GetProcAddress GetModuleHandleW VirtualFree LoadLibraryExA InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId DisableThreadLibraryCalls TerminateProcess VirtualAlloc DecodePointer MoveFileExW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared RaiseException MulDiv LeaveCriticalSection EnterCriticalSection GetCurrentThreadId InitializeCriticalSectionEx DeleteCriticalSection GetLastError GetFileAttributesW GlobalLock SetLastError

user32

MonitorFromRect GetMenu SetScrollInfo SetRectEmpty GetSystemMetrics SetGestureConfig EnumThreadWindows IsWindowVisible CloseGestureInfoHandle GetGestureInfo GetWindowPlacement IsIconic GetClipboardData CloseClipboard OpenClipboard AdjustWindowRect DrawEdge AdjustWindowRectEx MapDialogRect IsZoomed MapWindowPoints ReleaseDC GetDC UpdateWindow CopyRect EndDeferWindowPos DeferWindowPos BeginDeferWindowPos FillRect DrawFrameControl InflateRect GetDlgCtrlID RegisterWindowMessageW GetWindowTextLengthW GetMessagePos GetWindowDC GetWindowTextW TrackMouseEvent CharLowerW SetActiveWindow SetScrollPos ScrollWindowEx SystemParametersInfoW NotifyWinEvent OffsetRect InvalidateRgn GetNextDlgTabItem CallNextHookEx WindowFromPoint DrawTextW IsRectEmpty RedrawWindow SetWindowsHookExW UnhookWindowsHookEx FrameRect GetSysColor DestroyMenu GetMonitorInfoW MonitorFromPoint RegisterClassW CreatePopupMenu TrackPopupMenuEx AppendMenuW GetFocus MessageBeep SetWindowTextW GetDlgItem GetActiveWindow GetKeyState PostMessageW GetParent CreateDialogParamW SetTimer SetCursor SetCapture KillTimer SetFocus GetCursorPos CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW PtInRect ClientToScreen IntersectRect ScreenToClient GetWindowRect EnableWindow ShowWindow SetWindowPos IsWindowEnabled InvalidateRect EndPaint BeginPaint GetClientRect SetLayeredWindowAttributes CallWindowProcW DefWindowProcW GetWindowLongW SetWindowLongW DestroyWindow UnregisterClassW SendMessageW GetScrollInfo

gdi32

CreateCompatibleDC SelectObject GetTextMetricsW LPtoDP SetViewportOrgEx GetDeviceCaps FillRgn FrameRgn SetDCBrushColor GetStockObject CreatePolygonRgn CreateCompatibleBitmap CombineRgn CreateFontIndirectW SetDCPenColor LineTo MoveToEx SetBkMode GetObjectW CreateRectRgnIndirect GetTextExtentPoint32W GetTextColor GetBkColor GetCurrentObject CreatePen OffsetRgn CreateRectRgn IntersectClipRect SetWindowOrgEx OffsetWindowOrgEx BitBlt SaveDC RestoreDC ExtTextOutW SetBkColor SetTextColor DeleteObject DeleteDC

shell32

SHFileOperationW ord74

oleaut32

VariantInit VariantClear SysAllocString

shared

??0uCallStackTracker@@QAE@PBD@Z _stricmp_utf8_ex@16 _PokeWindow@4 _uGetWindowText@8 _uShellExecute@24 ??1uCallStackTracker@@QAE@XZ _ModalDialog_CanCreateNew@0 _ModalDialog_PokeExisting@0 _uSetWindowText@8 ?g_from_system@t_font_description@@SG?AU1@H@Z ?create@t_font_description@@QBGPAUHFONT__@@XZ _GetInfiniteWaitEvent@0 _FindOwningPopup@4 _uFormatSystemErrorMessage@8 _ModalDialog_Switch@4 _uAddStringLower@12 _uExceptFilterProc@4 _stricmp_utf8@8 _uGetFileAttributes@4 _uPrintCrashInfo_OnEvent@8 _uBugCheck@0 _uEvalKnownFolder@4

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xbad_function_call@std@@YAXXZ ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrRethrow@@YAXPBX@Z

shlwapi

SHAutoComplete

comctl32

ord410 ord413

msimg32

GradientFill

oleacc

AccessibleObjectFromWindow LresultFromObject

gdiplus

GdipDrawLineI GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipDeletePen GdipCreatePen1 GdiplusStartup GdiplusShutdown

vcruntime140

_except_handler3 __CxxFrameHandler3 __std_terminate _purecall __std_exception_copy __std_exception_destroy memset strrchr strstr memcpy memmove strchr memcmp __current_exception_context _except_handler4_common _CxxThrowException __current_exception __std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn abort _invalid_parameter_noinfo _initterm_e _initterm terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _errno _beginthreadex

api-ms-win-crt-string-l1-1-0

strncmp _strdup strlen wcsnlen wcslen strcmp

api-ms-win-crt-heap-l1-1-0

_recalloc _expand malloc realloc _callnewh free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s

api-ms-win-crt-math-l1-1-0

fabs __libm_sse2_pow ceil sqrt lround

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-convert-l1-1-0

_wtol

uxtheme

DrawThemeBackground IsThemePartDefined CloseThemeData OpenThemeData SetWindowTheme

advapi32

RegGetValueW

ole32

CoUninitialize CoInitialize CoCreateInstance CreateStreamOnHGlobal RegisterDragDrop RevokeDragDrop ReleaseStgMedium DoDragDrop

Name

.text

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.movehcs

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

6f60879203b8d12816d87783a0ccb096d2119f93ca333db3dfe6551e645bf5e9

PE Signature issue

kernel32

user32

gdi32

shell32

oleaut32

shared

msvcp140

shlwapi

comctl32

msimg32

oleacc

gdiplus

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

uxtheme

advapi32

ole32

generic