701d3ddea998aaaaf0dfadb3192b5690c9ba95587c8da19c66dd2808edf97f3c

Sharing

Copy URL Twitter E-mail

General

Target
701d3ddea998aaaaf0dfadb3192b5690c9ba95587c8da19c66dd2808edf97f3c
Size 622KB
Sample260808-e57aqattfz
SHA256 701d3ddea998aaaaf0dfadb3192b5690c9ba95587c8da19c66dd2808edf97f3c
MD5 2ebdcc661adb8d93667ef4b3b0cb0031
SHA1 9f12f1213828256c6e107b3204484128ffc5b25c
SHA512 fae790d55ddedb5d39e81386185770f72b705c9d971233a3e79ff64541f69e4aa68362972c97e39775103568baddb38ab057c327dd340fd43a8cb110453d34e4
SSDEEP 6144:HBh1buvjrALNSAnlc4eGV9TCYqpUoabD4T/li+OQzc9XGQet6p5jkQ97lhh+RG1f:HBCjrISw9cpP5ltzc9XGCpWQB8G1
TLSH
T170D49F237BA0C0B5D36E15301FE9AF6AE3FDD7941BB18AC71B841A1D26B6CD19E31205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
701d3ddea998aaaaf0dfadb3192b5690c9ba95587c8da19c66dd2808edf97f3c

File Explorer

701d3ddea998aaaaf0dfadb3192b5690c9ba95587c8da19c66dd2808edf97f3c

.dll 622KB

701d3ddea998aaaaf0dfadb3192b5690c9ba95587c8da19c66dd2808edf97f3c

IMPHASH c1abe55ca21c4ff3c5f757e29ae46a47
SHA256 701d3ddea998aaaaf0dfadb3192b5690c9ba95587c8da19c66dd2808edf97f3c
MD5 2ebdcc661adb8d93667ef4b3b0cb0031
SHA1 9f12f1213828256c6e107b3204484128ffc5b25c
SHA512 fae790d55ddedb5d39e81386185770f72b705c9d971233a3e79ff64541f69e4aa68362972c97e39775103568baddb38ab057c327dd340fd43a8cb110453d34e4
SSDEEP 6144:HBh1buvjrALNSAnlc4eGV9TCYqpUoabD4T/li+OQzc9XGQet6p5jkQ97lhh+RG1f:HBCjrISw9cpP5ltzc9XGCpWQB8G1
TLSH
T170D49F237BA0C0B5D36E15301FE9AF6AE3FDD7941BB18AC71B841A1D26B6CD19E31205
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c5:01:a1:47:31:f2:0c:fa:2a:5c:09:ab:5b:0c:5f:65:e3:47:c1:b9:a3:a0:c8:fd:00:24:3e:0b:6c:87:f3:c5

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Chains

Jun 26, 2026

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Serial Number

33:00:02:74:4a:32:57:a4:44:af:c4:c8:80:00:00:00:02:74:4a

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2026 - Jun 28, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

411992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Sources\foobar2000-2.25\foobar2000\Release\foo_converter.pdb

uxtheme

DrawThemeBackground GetThemePartSize CloseThemeData OpenThemeData SetWindowTheme IsThemePartDefined

kernel32

ResumeThread NormalizeString SetEvent OutputDebugStringW AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalSize GlobalUnlock GlobalLock GlobalAlloc GlobalFree GetTickCount InitializeCriticalSectionEx WideCharToMultiByte PowerCreateRequest PowerClearRequest PowerSetRequest CompareStringW GetModuleHandleW GetProcAddress lstrcmpiW VerSetConditionMask IsDebuggerPresent GetSystemTimeAsFileTime VerifyVersionInfoW lstrlenW VirtualAlloc VirtualFree LoadLibraryExA InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError DeleteCriticalSection RaiseException GetCurrentThreadId LeaveCriticalSection InitOnceComplete InitOnceBeginInitialize EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList DecodePointer GetExitCodeProcess GetStdHandle CreateFileW CreateNamedPipeW GetCurrentProcessId TerminateProcess CreateProcessW GetThreadPriority CancelIoEx GetOverlappedResult WaitForMultipleObjects WriteFile ResetEvent CreateEventW GetCurrentProcess DuplicateHandle GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy MulDiv GetCurrentThread SetThreadPriority CloseHandle WaitForSingleObject GetVersionExW QueryPerformanceCounter DisableThreadLibraryCalls GetTickCount64 IsProcessorFeaturePresent EnterCriticalSection SetLastError FlushInstructionCache

user32

MonitorFromRect GetMenu GetSystemMetrics EnumThreadWindows IsWindowVisible GetWindowPlacement IsIconic GetClipboardData CloseClipboard OpenClipboard AdjustWindowRect DrawEdge DrawFrameControl RegisterWindowMessageW NotifyWinEvent InvalidateRect SendMessageW GetDlgItem RegisterClassW DefWindowProcW UnregisterClassW SetWindowLongW GetWindowLongW LoadCursorW CreateDialogParamW ShowWindow SendDlgItemMessageW EnableWindow CharLowerW PostMessageW SetTimer GetActiveWindow DestroyWindow IsRectEmpty GetMessagePos InflateRect FrameRect UnhookWindowsHookEx SetWindowsHookExW WindowFromPoint CallNextHookEx GetNextDlgTabItem InvalidateRgn ScrollWindowEx SetScrollInfo SetGestureConfig CloseGestureInfoHandle GetGestureInfo SetMenuItemInfoW GetMenuItemInfoW GetScrollInfo SetLayeredWindowAttributes IsWindowEnabled SetWindowPos AdjustWindowRectEx MapDialogRect EndDeferWindowPos IsZoomed DeferWindowPos BeginDeferWindowPos GetWindowDC MessageBeep CopyRect SetRectEmpty FillRect DrawFocusRect CharNextW DrawTextW GetWindowTextW GetWindowTextLengthW GetClassNameW GetFocus SystemParametersInfoW ReleaseDC GetDC GetSysColor OffsetRect ReleaseCapture TrackMouseEvent GetCapture UpdateWindow IsWindow DestroyAcceleratorTable LoadAcceleratorsW SetFocus TranslateAcceleratorW SetScrollPos GetClientRect BeginPaint EndPaint CallWindowProcW CreateWindowExW RegisterClassExW SetDlgItemTextW GetClassInfoExW SetWindowTextW MapWindowPoints GetDlgCtrlID SetDlgItemInt DialogBoxParamW EndDialog RedrawWindow GetKeyState GetParent SetCursor SetCapture KillTimer GetCursorPos DestroyMenu GetMonitorInfoW MonitorFromPoint CreatePopupMenu TrackPopupMenu AppendMenuW PtInRect ClientToScreen IntersectRect ScreenToClient GetWindowRect

gdi32

CreateFontIndirectW GetStockObject SetBkMode GetObjectW SetDCBrushColor OffsetRgn CombineRgn CreateRectRgnIndirect CreatePolygonRgn FrameRgn FillRgn GetDeviceCaps CreateCompatibleDC GetTextMetricsW LPtoDP SaveDC RestoreDC OffsetWindowOrgEx SetWindowOrgEx IntersectClipRect CreateCompatibleBitmap SetViewportOrgEx BitBlt SetDCPenColor LineTo MoveToEx GetTextExtentPoint32W GetTextColor GetBkColor GetCurrentObject CreatePen CreateRectRgn ExtTextOutW SetBkColor SetTextColor DeleteObject DeleteDC SelectObject

shell32

ShellExecuteW ord74

oleaut32

VariantInit VariantClear SysAllocString

shared

_uSearchPath@16 _uGetModuleFileName@8 _uFileExists@4 _stricmp_utf8_partial@12 _stricmp_utf8@8 _uDeleteFile@4 _uGetOpenFileName@32 _uGetDlgItemText@12 _uSendMessageText@16 ?g_from_system@t_font_description@@SG?AU1@H@Z ?create@t_font_description@@QBGPAUHFONT__@@XZ _PokeWindow@4 _uGetWindowText@8 _stricmp_utf8_ex@16 _ModalDialog_Switch@4 _FindOwningPopup@4 _uShellExecute@24 _GetInfiniteWaitEvent@0 _uAddStringLower@12 _ModalDialog_CanCreateNew@0 _ModalDialog_PokeExisting@0 _uStringCompare@8 _uCreateDirectory@8 _uGetTempPath@4 ??1uCallStackTracker@@QAE@XZ ??0uCallStackTracker@@QAE@PBD@Z _uSetDlgItemText@12 _uExceptFilterProc@4 _uReplaceStringAdd@32 ?scale@audio_math@@YGXPBMIPAMM@Z _uFormatSystemErrorMessage@8 _uBrowseForFolder@12 _uCharUpper@4 _uSetWindowText@8 _uPrintCrashInfo_OnEvent@8 _uBugCheck@0 _uFindFirstFile@4 _uCreateFile@28

msvcp140

_Thrd_hardware_concurrency ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z

shlwapi

SHAutoComplete

comctl32

ord410 ord413

msimg32

GradientFill

oleacc

AccessibleObjectFromWindow LresultFromObject

gdiplus

GdipDrawLineI GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipDeletePen GdipCreatePen1 GdiplusStartup GdiplusShutdown

vcruntime140

_except_handler3 __CxxFrameHandler3 __std_terminate __std_exception_destroy __std_type_info_destroy_list _CxxThrowException _except_handler4_common __current_exception_context __current_exception memcmp wcschr strstr strrchr strchr memmove memcpy memset _purecall __std_exception_copy

api-ms-win-crt-string-l1-1-0

strlen wcsnlen _strdup wcscpy_s strncmp strcat_s strcmp wcslen

api-ms-win-crt-heap-l1-1-0

_aligned_realloc _aligned_malloc _callnewh _aligned_free realloc _recalloc malloc free _expand

api-ms-win-crt-runtime-l1-1-0

_initterm_e _invalid_parameter_noinfo_noreturn terminate _seh_filter_dll abort _initterm _cexit _controlfp_s _beginthreadex _crt_atexit _invalid_parameter_noinfo _execute_onexit_table _errno _register_onexit_function _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table

api-ms-win-crt-utility-l1-1-0

_byteswap_ulong _byteswap_ushort rand srand abs

api-ms-win-crt-math-l1-1-0

fabs frexp ldexp lround __libm_sse2_pow llround ceil floor sqrt

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vswprintf_s __stdio_common_vsprintf_s

api-ms-win-crt-locale-l1-1-0

_free_locale _create_locale

api-ms-win-crt-convert-l1-1-0

_wtol _atoi64 _wtoi atoi

advapi32

RegGetValueW RegQueryValueExW RegOpenKeyExW RegCloseKey

ole32

CoCreateGuid CoUninitialize CoInitialize CoCreateInstance CreateStreamOnHGlobal RegisterDragDrop RevokeDragDrop ReleaseStgMedium DoDragDrop

Name

.text

Size

428KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.movehcs

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

701d3ddea998aaaaf0dfadb3192b5690c9ba95587c8da19c66dd2808edf97f3c

PE Signature issue

uxtheme

kernel32

user32

gdi32

shell32

oleaut32

shared

msvcp140

shlwapi

comctl32

msimg32

oleacc

gdiplus

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

advapi32

ole32

generic