MultiScope[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MultiScope.exe
Size 8.6MB
Sample260824-zh55csfa56
SHA256 c9bf0371ec8270ca76bf6ce982876616e837ba4022f024b2486f8581890732f9
MD5 dc41b0bf2a5ba84e2267a36bf892ba96
SHA1 719a94d7508dba532650f60985340be5ddc9b238
SHA512 740dc2625a820c59836ce5b18521852a8401a2642c5388b4bf83f39cb4be122d6ff5d8eb0b83df59b657d721820d1efd3b77ad0ee6f5b93f1773176e2e3418a1
SSDEEP 98304:MhyXYeZ6yvaIS3AaLZVs6bIgrLU2MZ+O7mitLIEn+WJaR:QGaM+mPjhtLVQ
TLSH
T105966D03F5A681E9C0AEC1B5935A9633FB72B88D063072AF2BD44B312E56F506F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
MultiScope.exe

File Explorer

MultiScope.exe

.exe 8.6MB

MultiScope.exe

IMPHASH 4ec0d0e7fba65fee56b199dabad476af
SHA256 c9bf0371ec8270ca76bf6ce982876616e837ba4022f024b2486f8581890732f9
MD5 dc41b0bf2a5ba84e2267a36bf892ba96
SHA1 719a94d7508dba532650f60985340be5ddc9b238
SHA512 740dc2625a820c59836ce5b18521852a8401a2642c5388b4bf83f39cb4be122d6ff5d8eb0b83df59b657d721820d1efd3b77ad0ee6f5b93f1773176e2e3418a1
SSDEEP 98304:MhyXYeZ6yvaIS3AaLZVs6bIgrLU2MZ+O7mitLIEn+WJaR:QGaM+mPjhtLVQ
TLSH
T105966D03F5A681E9C0AEC1B5935A9633FB72B88D063072AF2BD44B312E56F506F1D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

25:16:c5:9d:07:31:9e:fd:f5:5f:6b:c6:e7:59:23:53:d6:8a:b9:7f:27:e4:5f:32:e0:bf:fe:34:16:1b:cd:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cresqnt

Chains

Jan 26, 2026

CN=cresqnt

Subject

CN=cresqnt

Serial Number

18:ee:5e:79:a9:7d:b5:b7:43:0a:c9:18:a0:14:66:15

Issuer

CN=cresqnt

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 7, 2025 - Dec 7, 2030

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5536544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

multiscope.pdb

kernel32

UnregisterWaitEx IsDebuggerPresent GetCurrentProcess CheckRemoteDebuggerPresent GetProcessId OpenProcess SetUnhandledExceptionFilter LoadLibraryA QueryFullProcessImageNameW Sleep ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId GetSystemTimeAsFileTime FreeEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency SetEnvironmentVariableW GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind TerminateProcess RtlCaptureContext CompareStringOrdinal Process32NextW Process32FirstW IsProcessorFeaturePresent RtlPcToFileHeader WaitForSingleObject MultiByteToWideChar RtlLookupFunctionEntry SetLastError WaitForSingleObjectEx GetCurrentProcessId WideCharToMultiByte ReleaseMutex GetModuleFileNameW SetHandleInformation SleepEx SetWaitableTimer ExitProcess GetExitCodeProcess GetSystemDirectoryW GetWindowsDirectoryW UnhandledExceptionFilter WaitForMultipleObjects CreateToolhelp32Snapshot GetCommandLineW AssignProcessToJobObject AddVectoredExceptionHandler SetInformationJobObject CreateJobObjectW LoadLibraryExA RtlUnwindEx FormatMessageW GetLastError DeleteCriticalSection HeapAlloc CloseHandle RaiseException GetProcAddress PostQueuedCompletionStatus FindNextFileW GetFileAttributesW CreateProcessW ReadFile GetOverlappedResult CancelIo CreateEventW CreateWaitableTimerExW ReadFileEx WriteFileEx CreateThread DeviceIoControl MoveFileExW GetFinalPathNameByHandleW DeleteFileW RemoveDirectoryW GetTempPathW LCIDToLocaleName GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle CreateFileW FindFirstFileExW GetFullPathNameW CreateDirectoryW CreateMutexA WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetUserDefaultUILanguage EncodePointer TlsAlloc TlsGetValue LoadLibraryW InitializeCriticalSectionAndSpinCount TlsSetValue DuplicateHandle GetModuleHandleA GetSystemInfo SwitchToThread lstrlenW TlsFree InitializeSListHead OutputDebugStringA OutputDebugStringW LoadLibraryExW FreeLibrary GetSystemTimePreciseAsFileTime HeapReAlloc HeapFree CreatePipe GetModuleHandleW GetCurrentThread CopyFileExW GetEnvironmentStringsW SetThreadStackGuarantee GetProcessHeap SetFilePointerEx GetQueuedCompletionStatusEx FindClose SetFileCompletionNotificationModes CreateIoCompletionPort

advapi32

SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW EventSetInformation EventWriteTransfer EventRegister RegGetValueW EventUnregister

oleaut32

GetErrorInfo SetErrorInfo SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

ntdll

NtDeviceIoControlFile NtCreateFile RtlGetVersion NtReadFile NtCancelIoFileEx NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtWriteFile

shell32

SHGetKnownFolderPath DragFinish DragQueryFileW ShellExecuteW SHAppBarMessage SHOpenFolderAndSelectItems ord190 ShellExecuteExW ord155

ole32

CoInitialize CoUninitialize CoCreateInstance CoTaskMemFree CoInitializeEx RegisterDragDrop OleInitialize RevokeDragDrop CoTaskMemAlloc CoCreateFreeThreadedMarshaler

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

user32

SetCursor LoadCursorW GetForegroundWindow FlashWindowEx InvalidateRect UpdateWindow RegisterTouchWindow IsWindow IsWindowEnabled IsIconic GetKeyState EnableWindow SetPropW GetKeyboardState SetWindowTextW GetWindowTextW SetWindowDisplayAffinity MonitorFromRect ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout ClipCursor GetSystemMetrics SetCursorPos GetClipCursor ScreenToClient DefWindowProcW GetAsyncKeyState RegisterHotKey DestroyMenu DestroyIcon DestroyAcceleratorTable SystemParametersInfoW CreateAcceleratorTableW SetCapture GetTouchInputInfo GetMonitorInfoW SetFocus GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW SetWindowLongW GetSystemMenu RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture SetParent CloseTouchInputHandle TrackMouseEvent RegisterWindowMessageA UnregisterHotKey RegisterClassW FindWindowExW TranslateAcceleratorW MsgWaitForMultipleObjectsEx MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetRawInputData GetParent SetWindowLongPtrW DispatchMessageW GetMessageW GetWindow GetWindowTextLengthW IsWindowVisible GetWindowThreadProcessId EnumWindows DestroyWindow ShowCursor CreateMenu CreatePopupMenu EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW DrawMenuBar GetWindowLongPtrW RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC AppendMenuW InsertMenuW SendInput CheckMenuItem ReleaseDC GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo DrawTextW FillRect GetMenuItemInfoW PostQuitMessage ShowWindow SendMessageW SystemParametersInfoA PostMessageW GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW SetWindowRgn

gdi32

BitBlt CombineRgn GetDeviceCaps DeleteDC DeleteObject CreateRectRgn SelectObject CreateSolidBrush CreateDIBSection CreateCompatibleDC SetBkMode SetTextColor

comctl32

RemoveWindowSubclass TaskDialogIndirect DefSubclassProc SetWindowSubclass

shlwapi

SHCreateMemStream

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

bcrypt

BCryptGenRandom

ws2_32

WSAGetLastError WSASend shutdown send ioctlsocket WSASocketW recv getpeername getsockname freeaddrinfo WSACleanup getsockopt WSAIoctl WSAStartup getaddrinfo bind connect setsockopt closesocket

crypt32

CertEnumCertificatesInStore CertCloseStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertDuplicateCertificateContext CertOpenStore CertVerifyCertificateChainPolicy CertDuplicateStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateContext

secur32

DecryptMessage ApplyControlToken AcceptSecurityContext QueryContextAttributesW DeleteSecurityContext AcquireCredentialsHandleA InitializeSecurityContextW FreeCredentialsHandle FreeContextBuffer EncryptMessage

api-ms-win-crt-math-l1-1-0

floor __setusermatherr trunc pow round roundf

api-ms-win-crt-string-l1-1-0

wcsncat _wcsicmp strcpy_s wcscmp wcslen wcsncmp

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _set_app_type __p___argv _register_thread_local_exe_atexit_callback _register_onexit_function _c_exit _cexit _exit _get_initial_narrow_environment _seh_filter_exe terminate exit _initterm_e _initialize_narrow_environment __p___argc _initterm abort _configure_narrow_argv _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc free calloc _callnewh _set_new_mode

Name

.text

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MultiScope.exe

PE Signature issue

kernel32

advapi32

oleaut32

bcryptprimitives

ntdll

shell32

ole32

api-ms-win-core-synch-l1-2-0

user32

gdi32

comctl32

shlwapi

dwmapi

bcrypt

ws2_32

crypt32

secur32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic