cb4cb245980021bf9008ecb63f7dad0d7ee310285d93198ae937603132765538

Sharing

Copy URL Twitter E-mail

General

Target
cb4cb245980021bf9008ecb63f7dad0d7ee310285d93198ae937603132765538
Size 238KB
Sample260808-e71wqahn8y
SHA256 cb4cb245980021bf9008ecb63f7dad0d7ee310285d93198ae937603132765538
MD5 8e1c454f91db9911d8cb7b118f278837
SHA1 5864428cf9475f9f6ca3e475311ded6256973d06
SHA512 8c7c208208d9efb7c7540a4b882e012a9f2d25452e61b8669c35b375593dba3557ec5d91a08cc30647e60d74c72016a4a978cb1f828820f1497882e299c4f2ea
SSDEEP 3072:H2A/82qD8bem5Eou7e1el2ujQ/1Ac9daaMR7lytX1MVmUKZRGpriOd8zxt:WA/XemLuR1Uaao5QcpOGprAt
TLSH
T1AE34AD027AB4C0BAC39F1334596BAF6BF3BCD6840FA149CB57881E5E593ADD25D32108
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
cb4cb245980021bf9008ecb63f7dad0d7ee310285d93198ae937603132765538

File Explorer

cb4cb245980021bf9008ecb63f7dad0d7ee310285d93198ae937603132765538

.dll 238KB

cb4cb245980021bf9008ecb63f7dad0d7ee310285d93198ae937603132765538

IMPHASH 30796ca69e91972c86b9edcf2f9ddaed
SHA256 cb4cb245980021bf9008ecb63f7dad0d7ee310285d93198ae937603132765538
MD5 8e1c454f91db9911d8cb7b118f278837
SHA1 5864428cf9475f9f6ca3e475311ded6256973d06
SHA512 8c7c208208d9efb7c7540a4b882e012a9f2d25452e61b8669c35b375593dba3557ec5d91a08cc30647e60d74c72016a4a978cb1f828820f1497882e299c4f2ea
SSDEEP 3072:H2A/82qD8bem5Eou7e1el2ujQ/1Ac9daaMR7lytX1MVmUKZRGpriOd8zxt:WA/XemLuR1Uaao5QcpOGprAt
TLSH
T1AE34AD027AB4C0BAC39F1334596BAF6BF3BCD6840FA149CB57881E5E593ADD25D32108
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d7:d6:20:d7:49:38:38:14:03:5f:74:42:f8:10:2f:80:85:71:bb:69:66:b4:22:b3:c9:36:56:6d:8e:33:b3:05

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Chains

Jun 26, 2026

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Illustrate Ltd,O=Illustrate Ltd,L=Bury,C=GB

Serial Number

33:00:02:74:4a:32:57:a4:44:af:c4:c8:80:00:00:00:02:74:4a

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 25, 2026 - Jun 28, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7B1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:59:7c:da:71:e9:8d:5e:f5:c0:00:00:00:00:00:59

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

138099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Sources\foobar2000-2.25\foobar2000\Release\foo_freedb2.pdb

kernel32

GetProcessHeap HeapDestroy DecodePointer HeapAlloc HeapReAlloc HeapSize HeapFree RaiseException LeaveCriticalSection DisableThreadLibraryCalls GetCurrentProcessId QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer InitOnceBeginInitialize InitOnceComplete GetSystemTimeAsFileTime OutputDebugStringW AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockExclusive EnterCriticalSection GetCurrentThreadId InitializeCriticalSectionEx GetLastError DeleteCriticalSection SetLastError GetThreadPriority SetThreadPriority GetCurrentThread SetEvent GetTickCount64 TerminateProcess ResetEvent CloseHandle IsDebuggerPresent WaitForSingleObject CreateEventW GlobalUnlock GlobalLock GetVersionExW GetCurrentProcess GlobalSize GetModuleHandleW GetProcAddress lstrlenW InitializeCriticalSection

user32

GetDlgItemInt MessageBeep SetFocus EndDialog DialogBoxParamW SetWindowTextW DefWindowProcW CopyRect FillRect DrawTextW GetWindowTextW GetWindowTextLengthW IsWindowEnabled GetSysColor SetWindowsHookExW EndPaint BeginPaint LoadCursorW WindowFromPoint ShowWindow InvalidateRect GetKeyState UpdateWindow UnhookWindowsHookEx GetDlgItem RegisterClassW MessageBoxW GetParent EnableWindow CreateDialogParamW LoadIconW SetWindowLongW UnregisterClassW AdjustWindowRect DestroyWindow RegisterClassExW SendMessageW PostMessageW GetWindowLongW SetWindowPos CallNextHookEx GetClassInfoExW DrawEdge AdjustWindowRectEx GetClipboardData CloseClipboard OpenClipboard GetWindowRect MapWindowPoints GetClientRect BeginDeferWindowPos DeferWindowPos IsZoomed EndDeferWindowPos MapDialogRect CallWindowProcW CreateWindowExW IntersectRect

gdi32

DeleteObject GetObjectW SetBkMode SetTextColor CreateFontIndirectW SelectObject GetTextExtentPoint32W

advapi32

CryptHashData CryptAcquireContextW CryptDestroyHash CryptCreateHash CryptGetHashParam CryptReleaseContext

shared

_ModalDialog_PokeExisting@0 _uSetDlgItemText@12 _uGetDlgItemText@12 _ModalDialog_Switch@4 _GetInfiniteWaitEvent@0 _uGetWindowText@8 _uSetWindowText@8 _uExceptFilterProc@4 _uPrintCrashInfo_OnEvent@8 _uBugCheck@0 _uFormatSystemErrorMessage@8 _stricmp_utf8@8 _ModalDialog_CanCreateNew@0 ??0uCallStackTracker@@QAE@PBD@Z ??1uCallStackTracker@@QAE@XZ _stricmp_utf8_ex@16

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_function_call@std@@YAXXZ

vcruntime140

strchr _purecall memset memcpy memmove __current_exception __current_exception_context _except_handler4_common _CxxThrowException __std_type_info_destroy_list _except_handler3 memcmp strstr __std_exception_copy __std_exception_destroy __std_terminate __CxxFrameHandler3 memchr

api-ms-win-crt-string-l1-1-0

_strdup strncmp strcmp wcsnlen strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _errno _invalid_parameter_noinfo abort terminate _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _invalid_parameter_noinfo_noreturn _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm _initterm_e

api-ms-win-crt-heap-l1-1-0

_callnewh _recalloc realloc _expand free malloc

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

llround lround ceil

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vswprintf_s

api-ms-win-crt-utility-l1-1-0

rand srand

uxtheme

SetWindowTheme

ole32

CoCreateInstance

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.movehcs

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

cb4cb245980021bf9008ecb63f7dad0d7ee310285d93198ae937603132765538

PE Signature issue

kernel32

user32

gdi32

advapi32

shared

msvcp140

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

uxtheme

ole32

generic