c259d161878258a74f7b6bab19f2a59d4375f32cffc7948f1826112a35fd9a82

Sharing

Copy URL Twitter E-mail

General

Target
c259d161878258a74f7b6bab19f2a59d4375f32cffc7948f1826112a35fd9a82
Size 1.9MB
Sample260808-e57lgsttgt
SHA256 c259d161878258a74f7b6bab19f2a59d4375f32cffc7948f1826112a35fd9a82
MD5 e70460d84fbb85bd1e9b18cea8c1691f
SHA1 7d2a8610fdb90ea7c2bf2c4ad35b908433158941
SHA512 aa535e7c8b5172ec72dcb27baddef7dd2cf6814b5f6637be3e3c48dc084cb1f48a098cffee6408ece7ae6afc9e7f9b55e4926b427351c04bd141eaaaf5e3b898
SSDEEP 24576:C+DTn841QL6qMLWgZlXeEauoo69NaW09sh2vZ0qnAfqTjcyUWLhZsxs+/hIRHYXC:CkTn84ktQWxENEjqymZ0IBjjflZSX+/
TLSH
T11295AF13BBA081BCC3DD01742A79BB2BD56D97DC0B328DC393C42DA96532DD26D32A59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
c259d161878258a74f7b6bab19f2a59d4375f32cffc7948f1826112a35fd9a82

File Explorer

c259d161878258a74f7b6bab19f2a59d4375f32cffc7948f1826112a35fd9a82

.dll 1.9MB

c259d161878258a74f7b6bab19f2a59d4375f32cffc7948f1826112a35fd9a82

IMPHASH f99e2d9846c3e5da866e6c93fd9aa6e7
SHA256 c259d161878258a74f7b6bab19f2a59d4375f32cffc7948f1826112a35fd9a82
MD5 e70460d84fbb85bd1e9b18cea8c1691f
SHA1 7d2a8610fdb90ea7c2bf2c4ad35b908433158941
SHA512 aa535e7c8b5172ec72dcb27baddef7dd2cf6814b5f6637be3e3c48dc084cb1f48a098cffee6408ece7ae6afc9e7f9b55e4926b427351c04bd141eaaaf5e3b898
SSDEEP 24576:C+DTn841QL6qMLWgZlXeEauoo69NaW09sh2vZ0qnAfqTjcyUWLhZsxs+/hIRHYXC:CkTn84ktQWxENEjqymZ0IBjjflZSX+/
TLSH
T11295AF13BBA081BCC3DD01742A79BB2BD56D97DC0B328DC393C42DA96532DD26D32A59
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

eb:53:3f:6e:5b:0c:5f:2a:05:dc:59:f6:9d:7d:fb:c9:bc:d8:74:c6:77:43:7f:5d:58:54:ac:9c:3b:90:9c:1d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Chains

Jun 26, 2026

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Serial Number

33:00:02:74:4a:32:57:a4:44:af:c4:c8:80:00:00:00:02:74:4a

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2026 - Jun 28, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

1400356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Sources\foobar2000-2.25\foobar2000\Release\foo_input_std.pdb

zlib1

inflateEnd inflate inflateInit_

msacm32

acmStreamPrepareHeader acmStreamClose acmFormatTagDetailsW acmFormatSuggest acmStreamUnprepareHeader acmStreamOpen acmStreamConvert

avcodec-fb2k-62

avcodec_find_decoder avcodec_send_packet avcodec_free_context avcodec_open2 avcodec_alloc_context3 av_packet_alloc av_packet_free avcodec_parameters_to_context avcodec_flush_buffers avcodec_parameters_free avcodec_parameters_alloc avcodec_parameters_from_context avcodec_receive_frame

avformat-fb2k-62

avformat_alloc_context avformat_close_input avio_context_free avio_alloc_context avformat_open_input av_find_best_stream av_seek_frame av_read_frame avformat_find_stream_info

avutil-fb2k-60

av_frame_unref av_version_info av_malloc av_dict_free av_dict_set av_mallocz av_crc av_crc_get_table

kernel32

InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx GetCurrentThreadId RaiseException HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive MulDiv GetTickCount64 DecodePointer FreeLibrary GetProcAddress DeviceIoControl VerSetConditionMask SetEvent GetStdHandle CreateFileW QueryPerformanceCounter WaitForSingleObject ResetEvent WaitForMultipleObjects GetModuleHandleW Sleep GetThreadPriority SetThreadPriority ResumeThread SystemTimeToFileTime lstrlenW GetCurrentProcess GetVersionExW InterlockedPushEntrySList GetDriveTypeW VirtualFree VirtualAlloc GetLastError CloseHandle GlobalSize ReadFile SetLastError WideCharToMultiByte MultiByteToWideChar SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx FlushInstructionCache CreateEventW GlobalUnlock GlobalLock GetCurrentThread VerifyVersionInfoW WriteFile SetFilePointer SetEndOfFile SetFileAttributesW DeleteFileW GetFileSize InitOnceBeginInitialize InitOnceComplete EncodePointer InitializeSListHead InterlockedPopEntrySList OutputDebugStringW GetCurrentProcessId GetSystemTimeAsFileTime DisableThreadLibraryCalls IsProcessorFeaturePresent LoadLibraryExA IsDebuggerPresent InitializeCriticalSectionAndSpinCount TerminateProcess

user32

AdjustWindowRect UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx DrawEdge ClientToScreen AdjustWindowRectEx IsZoomed MapWindowPoints GetMenu MonitorFromRect GetMonitorInfoW PeekMessageW DispatchMessageW MsgWaitForMultipleObjects GetDlgItemInt SetWindowTextW RegisterClassW CreateWindowExW LoadCursorW GetWindowRect SetFocus GetDC InvalidateRect CreateDialogParamW MessageBeep ShowWindow GetDlgItem SendDlgItemMessageW SetDlgItemInt CallWindowProcW UpdateWindow DefWindowProcW DestroyWindow GetKeyState EnableWindow GetWindowLongW GetClassInfoExW RegisterClassExW EndDeferWindowPos DeferWindowPos GetFocus SetWindowLongW SetWindowPos BeginDeferWindowPos TrackMouseEvent FillRect PostMessageW IsWindowEnabled GetClientRect GetParent UnregisterClassW SendMessageW wsprintfW GetClipboardData IsIconic DrawTextW DrawFrameControl GetDlgCtrlID GetWindowPlacement OffsetRect CopyRect IntersectRect GetSystemMetrics GetSysColor EnumThreadWindows ReleaseDC GetWindowDC RegisterWindowMessageW EndPaint BeginPaint IsWindowVisible CharLowerW GetWindowTextLengthW GetWindowTextW WindowFromPoint CloseClipboard OpenClipboard MapDialogRect

gdi32

SelectObject SetTextColor GetDeviceCaps GetTextExtentPoint32W SetBkMode CreateFontIndirectW GetObjectW DeleteObject DeleteDC GetStockObject

shell32

DragFinish

shared

_stricmp_utf8_ex@16 _uCharUpper@4 _uCharLower@4 _uDragQueryFileCount@4 _uDragQueryFile@12 _uGetWindowText@8 ??0uCallStackTracker@@QAE@PBD@Z ??1uCallStackTracker@@QAE@XZ _uAddStringUpper@12 _stricmp_utf8_partial@12 _LoadSystemLibrary@4 _uGetTempPath@4 _uGetTempFileName@16 _uDeleteFile@4 _uReplaceStringAdd@32 _GetInfiniteWaitEvent@0 ?scale@audio_math@@YGXPBMIPAMM@Z ?convert_from_int32@audio_math@@YGXPBHIPAMM@Z ?convert_from_int16@audio_math@@YGXPBFIPAMM@Z ?convert_to_int16@audio_math@@YGXPBMIPAFM@Z _uAddStringLower@12 _uSendMessageText@16 _uExceptFilterProc@4 _PokeWindow@4 _uSetWindowText@8 _uGetDlgItemText@12 _CreateFileAbortable@28 _uBugCheck@0 _uPrintCrashInfo_OnEvent@8 _uFormatSystemErrorMessage@8 _stricmp_utf8@8

msvcp140

?__ExceptionPtrToBool@@YA_NPBX@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?__ExceptionPtrAssign@@YAXPAXPBX@Z ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrCopy@@YAXPAXPBX@Z

shlwapi

StrCmpLogicalW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Create InitCommonControlsEx

uxtheme

SetWindowTheme DrawThemeBackground OpenThemeData CloseThemeData

vcruntime140

wcschr _except_handler3 _except_handler4_common __CxxFrameHandler3 __std_terminate __std_exception_copy __current_exception __current_exception_context _CxxThrowException __std_type_info_destroy_list memcmp memchr __std_exception_destroy memcpy memset strchr _purecall strstr wcsrchr memmove strrchr

api-ms-win-crt-runtime-l1-1-0

abort _invalid_parameter_noinfo_noreturn _set_abort_behavior _invalid_parameter_noinfo _errno _initterm_e _initterm terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _controlfp_s _beginthreadex exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __acrt_iob_func __stdio_common_vswprintf_s fclose __stdio_common_vfprintf

api-ms-win-crt-convert-l1-1-0

_atoi64 strtod _wtoi atoll _itoa_s atoi

api-ms-win-crt-string-l1-1-0

wcsnlen _strdup strcmp strlen _wcsicmp wcscpy_s wcscat_s wcslen _strnicmp towlower strncmp isdigit isalnum strcat_s strcpy_s

api-ms-win-crt-heap-l1-1-0

realloc _expand _aligned_free _recalloc _aligned_realloc malloc free _aligned_malloc calloc _callnewh

api-ms-win-crt-math-l1-1-0

_libm_sse2_exp_precise _libm_sse2_sqrt_precise _libm_sse2_cos_precise floor __libm_sse2_log lround llround __libm_sse2_sin fabs ldexp log exp sqrt pow acos atan ceil sin cos __libm_sse2_log10 __libm_sse2_log10f __libm_sse2_pow exp2

api-ms-win-crt-utility-l1-1-0

rand srand labs abs qsort

ole32

CoUninitialize CoInitialize CoCreateInstance CoCreateGuid

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

350KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.movehcs

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=253, version=28518,

count=11, id=260, version=30034,

count=18, id=259, version=30034,

count=29, id=261, version=30034,

count=4, id=257, version=30034,

count=2, id=253, version=23601,

count=2, id=257, version=30159,

count=5, id=260, version=33145,

count=1, id=262, version=33145,

count=89, id=260, version=30159,

count=6, id=257, version=35222,

count=30, id=257, version=33145,

count=3, id=257, version=35225,

count=603, id=1, productName=Unmarked objects,

count=341, id=265, version=30159,

count=1, id=256, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,