d3eb908815b82cb020ee8563218f2bc92661545901b2212594082d5e96b6e87e

Sharing

Copy URL Twitter E-mail

General

Target
d3eb908815b82cb020ee8563218f2bc92661545901b2212594082d5e96b6e87e
Size 513KB
Sample260808-e71kyshn8w
SHA256 d3eb908815b82cb020ee8563218f2bc92661545901b2212594082d5e96b6e87e
MD5 007cd21e3e696f444f9961965f189c9e
SHA1 924a2164a3295688481b8d9b74d516860a504b79
SHA512 3038facb4d14f7f058f679af0a08ac04e396e2f6b0a2c53648766dc2a384efa0cc03a3f52a8abda020f8dc8a02498a376d39803acb4756b9532be71075513269
SSDEEP 12288:zWO4KRzy+7Fgutc7MQ6/o86A3ALk02eVyhBIdPX85jTrau:6OY4guub6w8RwLp8nEPX81
TLSH
T146B4D032B793C2F5E28D01306ABD7B5EA6BDA7540B2185C7B3D41C3D1EB15D3263264A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
d3eb908815b82cb020ee8563218f2bc92661545901b2212594082d5e96b6e87e

File Explorer

d3eb908815b82cb020ee8563218f2bc92661545901b2212594082d5e96b6e87e

.dll 513KB

d3eb908815b82cb020ee8563218f2bc92661545901b2212594082d5e96b6e87e

IMPHASH 6094bd0f8e00ec0883d824e9d5023c5e
SHA256 d3eb908815b82cb020ee8563218f2bc92661545901b2212594082d5e96b6e87e
MD5 007cd21e3e696f444f9961965f189c9e
SHA1 924a2164a3295688481b8d9b74d516860a504b79
SHA512 3038facb4d14f7f058f679af0a08ac04e396e2f6b0a2c53648766dc2a384efa0cc03a3f52a8abda020f8dc8a02498a376d39803acb4756b9532be71075513269
SSDEEP 12288:zWO4KRzy+7Fgutc7MQ6/o86A3ALk02eVyhBIdPX85jTrau:6OY4guub6w8RwLp8nEPX81
TLSH
T146B4D032B793C2F5E28D01306ABD7B5EA6BDA7540B2185C7B3D41C3D1EB15D3263264A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

19:42:00:3a:e7:bd:70:6a:23:8f:db:31:78:e4:59:b9:af:a0:c9:bf:97:ea:20:22:7e:c7:d3:9f:12:19:13:93

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Chains

Jun 26, 2026

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Serial Number

33:00:02:74:4a:32:57:a4:44:af:c4:c8:80:00:00:00:02:74:4a

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2026 - Jun 28, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:491A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5a:f6:0d:67:8c:85:ed:dd:08:00:00:00:00:00:5a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

413579

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Sources\foobar2000-2.25\foobar2000\Release\foo_unpack.pdb

kernel32

GetProcAddress SetFilePointer DeviceIoControl GetCurrentProcess GetModuleHandleW FileTimeToSystemTime FileTimeToLocalFileTime GetProcessAffinityMask GetSystemInfo GlobalMemoryStatus GetSystemTimeAsFileTime DosDateTimeToFileTime VirtualFree VirtualAlloc GetVersion IsProcessorFeaturePresent SetThreadAffinityMask ReleaseSemaphore WaitForSingleObject ResumeThread CreateEventW SetEvent ResetEvent CreateFileW InitializeSListHead DisableThreadLibraryCalls QueryPerformanceCounter WaitForSingleObjectEx GetCurrentDirectoryW CloseHandle DeleteFileW CreateHardLinkW GetTempPathW SetFileTime RemoveDirectoryW CreateDirectoryW WideCharToMultiByte MultiByteToWideChar GetLastError GetFileInformationByHandle WriteFile GetStdHandle ReadFile DeleteCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx GetModuleHandleA IsDebuggerPresent NormalizeString OutputDebugStringW CreateThread GetFileAttributesW FindClose FindFirstFileW MoveFileW GetTickCount GetCurrentProcessId GetShortPathNameW GetLongPathNameW GetFileType SetThreadExecutionState SetThreadPriority SetFileAttributesW GetCurrentThreadId SetLastError LeaveCriticalSection CreateSemaphoreW EnterCriticalSection LocalFileTimeToFileTime GetTickCount64 Sleep GetSystemTime SystemTimeToFileTime IsDBCSLeadByte GetCPInfo CompareStringW FreeLibrary AreFileApisANSI AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

CharLowerW OemToCharA CharUpperW CharToOemA OemToCharBuffA

advapi32

AllocateAndInitializeSid FreeSid SetFileSecurityW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken CheckTokenMembership

ole32

CoCreateGuid

oleaut32

SysFreeString SysAllocString VariantClear SysAllocStringLen VariantCopy SysStringLen

zlib1

crc32 inflateReset inflateInit2_ inflateEnd inflate

shared

_stricmp_utf8@8 ??0uCallStackTracker@@QAE@PBD@Z ??1uCallStackTracker@@QAE@XZ _uBugCheck@0 _uPrintCrashInfo_OnEvent@8 _uFormatSystemErrorMessage@8 _GetInfiniteWaitEvent@0 _uGetTempPath@4

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?__ExceptionPtrToBool@@YA_NPBX@Z ?_Xbad_function_call@std@@YAXXZ ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrCreate@@YAXPAX@Z ?__ExceptionPtrAssign@@YAXPAXPBX@Z

vcruntime140

__std_exception_destroy __std_exception_copy _purecall __std_terminate memcpy memcmp memset memchr memmove strstr strchr wcschr __CxxFrameHandler3 __current_exception __current_exception_context _except_handler4_common _CxxThrowException __std_type_info_destroy_list strrchr

api-ms-win-crt-runtime-l1-1-0

_beginthreadex abort _invalid_parameter_noinfo_noreturn _seh_filter_dll _initterm_e _initterm terminate _cexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen _strdup wcspbrk strncmp

api-ms-win-crt-heap-l1-1-0

free realloc malloc _callnewh

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-math-l1-1-0

lround ceil

Name

.text

Size

419KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.movehcs

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

d3eb908815b82cb020ee8563218f2bc92661545901b2212594082d5e96b6e87e

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

zlib1

shared

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

generic