d260733c4fe25a73fcbb5c8f8957d78792997f1a977704ca88750b20de24faca

Sharing

Copy URL Twitter E-mail

General

Target
d260733c4fe25a73fcbb5c8f8957d78792997f1a977704ca88750b20de24faca
Size 243KB
Sample260808-e58tjsttg1
SHA256 d260733c4fe25a73fcbb5c8f8957d78792997f1a977704ca88750b20de24faca
MD5 a6edaa260ec35cc8ab96179dc86e2e69
SHA1 20e2e269c7f8f34db09b5b230ff248255b74018b
SHA512 f535d862699437e78d7b231c35a2c451056bac6170e7d4a6bba0a3b52900c4d5e0921e5969401e08ae4207dc07707ed7d927eead95db5668ddc151e2962eb786
SSDEEP 3072:qYmYA/WX0548ZviNxYDjyCROGsWjsRcLYJWJaLsVAGLMVY292rx:5JA/S0cNxYDjyCRjsWjsC+WJaxGLMVk
TLSH
T1F234AD40F88241F9CA6A20B0397E7693AB3946CD07BC49F78AD51D2F497C5C32EB75A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
d260733c4fe25a73fcbb5c8f8957d78792997f1a977704ca88750b20de24faca

File Explorer

d260733c4fe25a73fcbb5c8f8957d78792997f1a977704ca88750b20de24faca

.dll 243KB

d260733c4fe25a73fcbb5c8f8957d78792997f1a977704ca88750b20de24faca

IMPHASH c2a8fee8ad6288a845b8a5a9454cb2ae
SHA256 d260733c4fe25a73fcbb5c8f8957d78792997f1a977704ca88750b20de24faca
MD5 a6edaa260ec35cc8ab96179dc86e2e69
SHA1 20e2e269c7f8f34db09b5b230ff248255b74018b
SHA512 f535d862699437e78d7b231c35a2c451056bac6170e7d4a6bba0a3b52900c4d5e0921e5969401e08ae4207dc07707ed7d927eead95db5668ddc151e2962eb786
SSDEEP 3072:qYmYA/WX0548ZviNxYDjyCROGsWjsRcLYJWJaLsVAGLMVY292rx:5JA/S0cNxYDjyCRjsWjsC+WJaxGLMVk
TLSH
T1F234AD40F88241F9CA6A20B0397E7693AB3946CD07BC49F78AD51D2F497C5C32EB75A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

66:2f:02:f5:ba:fc:d4:f2:94:0c:2b:ca:38:cd:dd:33:25:63:e8:e3:4d:12:af:13:cc:49:2b:e9:03:72:83:54

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Chains

Jun 26, 2026

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Serial Number

33:00:02:74:4a:32:57:a4:44:af:c4:c8:80:00:00:00:02:74:4a

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2026 - Jun 28, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7B1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:59:7c:da:71:e9:8d:5e:f5:c0:00:00:00:00:00:59

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

118663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Sources\foobar2000-2.25\foobar2000\Release\foo_dsp_std.pdb

kernel32

GetProcessHeap DecodePointer HeapAlloc HeapFree InitializeCriticalSectionEx GetLastError DeleteCriticalSection RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection SetLastError TerminateProcess DisableThreadLibraryCalls GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer GetSystemTimeAsFileTime IsDebuggerPresent GetCurrentProcess GetModuleHandleW GetProcAddress ResetEvent SetEvent CreateEventW OutputDebugStringW CloseHandle

user32

DestroyWindow SendDlgItemMessageW wsprintfA EnableWindow SetDlgItemInt GetDlgItemInt ShowWindow CreateDialogParamW SetWindowLongW DialogBoxParamW UnregisterClassW EndDialog SendMessageW SetWindowTextW wsprintfW GetDlgItem

shared

_uGetDlgItemText@12 _uPrintfV@12 _GetInfiniteWaitEvent@0 ?calculate_peak@audio_math@@YGMPBMI@Z _uBugCheck@0 _uPrintCrashInfo_OnEvent@8 _uSetDlgItemText@12 _uSetWindowText@8 _uGetWindowText@8 _ModalDialog_Switch@4 _uExceptFilterProc@4 _uSendMessageText@16

msvcp140

?_Xbad_function_call@std@@YAXXZ

vcruntime140

__std_type_info_destroy_list _CxxThrowException memcmp _except_handler3 __CxxFrameHandler3 __std_terminate __std_exception_copy __std_exception_destroy _purecall memcpy memmove memset _except_handler4_common

api-ms-win-crt-heap-l1-1-0

realloc malloc _expand calloc _aligned_malloc _aligned_free _callnewh free _aligned_realloc

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _execute_onexit_table _crt_atexit _cexit _initterm _initterm_e _register_onexit_function _invalid_parameter_noinfo_noreturn

api-ms-win-crt-math-l1-1-0

__libm_sse2_sin __libm_sse2_pow ceil lround _CItanh __libm_sse2_cos llround __libm_sse2_log10

Name

.text

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.movehcs

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

d260733c4fe25a73fcbb5c8f8957d78792997f1a977704ca88750b20de24faca

PE Signature issue

kernel32

user32

shared

msvcp140

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

generic