ihr05yb-il-fls.part1.rar
- SHA256 45eaf4378df6844bfa45f89c9a3765a22bd476133314e1eb30abd38d63fd509c
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
R2R/WM_FLStudio.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
R2R/WM_FLStudio.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
R2R/dsound.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
R2R/dsound.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ihr05yb-il-fls.part1.rar
- Size 906.9MB
- Sample260930-yeqptsshqg
- SHA256 45eaf4378df6844bfa45f89c9a3765a22bd476133314e1eb30abd38d63fd509c
- MD5 27ea7c16f04a62b6f958b61f590360b8
- SHA1 089aab35d0782f18055b537579115e31648015c2
- SHA512 bdb550771b64672431e2cdbdf972835862048a3aab0d8bf9c88b4a809101c3dd5b1236335e7311ca4e7153b516d767499a7bf561388e11dca6fb79e19c3dca08
- SSDEEP 25165824:AUmnWXH3TiCXx6GbbUjWmMZnW2b1vXBvVlPsMhN6:PXeCh6GITIHbNdsYc
- TLSH T18CA933622E8BB726F4151DDE20DECDDCFB63DC8D03E655694041DF229F9EA620AE8710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/R2R/WM_FLStudio.r2rwm - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/R2R/dsound.dll
File Explorer
-
ihr05yb-il-fls.part1.rar.rar 906.9MB
-
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.part1.rar.rar 238.4MB
-
R2R/R2R.txt1KB
-
R2R/WM_FLStudio.r2rwm.dll 535KB
-
R2R/dsound.dll.dll 8KB
-
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.part3.rar.rar 238.4MB
-
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.part4.rar.rar 238.4MB
-
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.part5.rar.rar 100.5MB
-
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.sfv145B
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.part1.rar
- SHA256 7a7c1d3b17d951b5bc5d7fb9329048e5b4a6cc6340aeb07fc65b604d05ac2119
- MD5 0f62e334e2a1109024b8813416279481
- SHA1 97fb8d8c9977c2164053581057b7072cc7b67d14
- SHA512 aa3907e6155f9a5124f55c4d9596e79e6bdf0fd2f9270e6a5d82a46ca1bb3e5c3d938bf356214d6b58d338e09189e6b4c11580ebad3317f148ccbf3a54e36873
- SSDEEP 6291456:FkXlHTe39J63zqwTLhnS4jx6tNvO+WzepXYbd:IHK3CmwBjx6tEbb
- TLSH T150C833312CE78A16F3067AEA10DF8FDEEFE1EC560C9A1C0A58E63F571F959284964D40
- MD5 SHA1 SHA512 SSDEEP TLSH
R2R/R2R.txt
- SHA256 3493eae2e3490f16bc73a09dc38ce703008f57b1b419757e6cb0f4e9775dc8fc
- MD5 48702104868c1157dde1ffc0760876b6
- SHA1 3fcc6a7c0cec85450760fc787850ad8a38e872ba
- SHA512 30b7b151d8be42a3460813926c235674957ceac78cc5376a89b0afc18a50f4491dff010c24fb9c4abd53956cc4fa9ed822fb82947e89346e90ef8a4d99e5a8de
- TLSH T1003141892E2ED1FA20C2E7571F18D993E3256049236420656D3991592B3778AF3BF0CF
- MD5 SHA1 SHA512 TLSH
R2R/WM_FLStudio.r2rwm
- IMPHASH a3b5678f996682190b7c32b1463c6ccc
- SHA256 63c51a11ed10ecc0a0174229a43094fd76dffcaed77b910937f429698418422e
- MD5 441610377153202858e94dfa5192229f
- SHA1 38ac6228570bc48faa4b143a7041c012671ce990
- SHA512 4000355e4d4d64d31d9b8ebdce857e22639be1f0cca9147f9b5c02f3935369e6822ea64e3f1ece606ea6009978ca6070ab4f367294bc0276fc2acd8e7afc9d43
- SSDEEP 12288:+LKMwxqyAHnZ+c9UHbJC/3tCjsx5IunyZXsJ5m4RzeaBNMLLwr1U3:+LDyqyAHZ+c9QbJC/3BcayZkbRzhBNmn
- TLSH T192C42371EE81410EFAC5C3354ED687A63724E3708978F68EC27C966EEB211877487A64
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5364
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
r2rsys
R2RSys_ValidateUserInfo
r2rezkg
EZKG_RegWrite
EZKG_SplitTextFixed
EZKG_GetSystemInfo
EZKG_HashText
EZKG_RandomText
EZKG_MemFree
shell32
SHGetFolderPathA
magic
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
800B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
529KB
Virtual Size
529KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=35222,
count=5, id=257, version=36248,
count=8, id=1, productName=Unmarked objects,
count=2, id=264, version=36256,
count=1, id=256, version=36256,
count=1, id=255, version=36256,
count=1, id=151,
count=1, id=258, version=36256,
R2R/dsound.dll
- IMPHASH 6cee4084f435e37ce42a215d5f5d74c0
- SHA256 c97aeaca2672ad28906bd03c39a5dbf158b9f7bc570702151988e35e764e68ce
- MD5 ee9bccab5efa3db13981936c222ecd1b
- SHA1 5c36b86c56e78bd05bbc582a3275fc759bb1dd4c
- SHA512 480dc65d1a601eac668d819b5a009e47d272132085c52cecae00839756ca0b08750f390a1447855b1e7653ffdb947fed3e23da0c3adb65588585ad6e83aa14fc
- SSDEEP 96:XMDw0sgGB/fcoExK21nYEUonFIeIVIsuEPFyhiz2Kt4t2HvkuoG:X7012/f1dLQ8Tscz7t4tCvh
- TLSH T1170208B537D444CCF2D6C7B418B2E2199436B9628624833C06F0A3ACAC1D341F617EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
51:e5:17:b5:56:d5:66:f8:56:ca:18:a0:16:bd:46:3e:dd:96:f0:99:1f:2a:58:39:52:46:22:d0:68:12:8e:2e:3b:0b:35:9d:12:bc:10:87:02:58:2d:19:84:ce:2f:64:50:70:7a:37:6e:0e:39:35:82:bc:ca:2e:75:63:ae:a1
Digest Algorithm
sha512
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Minor OS version
0
Major OS version
6
Entry point
5028
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wininet
InternetOpenW
shlwapi
PathStripPathW
PathRemoveFileSpecW
kernel32
LoadLibraryW
FreeLibrary
GetProcAddress
GetModuleHandleA
GetSystemDirectoryW
VirtualProtect
GetModuleFileNameW
user32
MessageBoxA
CharUpperW
msvcrt
wcscmp
strcmp
DirectSoundCaptureCreate
DirectSoundCaptureCreate8
DirectSoundCaptureEnumerateA
DirectSoundCaptureEnumerateW
DirectSoundCreate
DirectSoundCreate8
DirectSoundEnumerateA
DirectSoundEnumerateW
DirectSoundFullDuplexCreate
DllCanUnloadNow
DllGetClassObject
GetDeviceID
Name
.text
Size
1024B
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
496B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=257, version=35222,
count=14, id=1, productName=Unmarked objects,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=264, version=36256,
count=1, id=256, version=36256,
count=1, id=255, version=36256,
count=1, id=151,
count=1, id=258, version=36256,
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.part3.rar
- SHA256 5a929b476e99b9e947721f29e129675eb24a49ad5e6c9881dedf1fb445258619
- MD5 57f8e44e77526a194d9328769848600a
- SHA1 c866d5641ebb31fbce38aaf8fe0f33c0b4889e8c
- SHA512 d97a7fe845b096e165bb8f9b957c77592df4909164ce5f39790c0c274a8b6424a3a314dc149e01a333f21d089de92b3c2e77244751cf2aff0df0006235eefefc
- SSDEEP 6291456:BjDT3u9RsBDM0DulKMnW+djw72jVgutQ41/Pa5pcvZS:BjWYVM0OnWMwcftQ41/Pa5qvZ
- TLSH T126C833259599F356AC190A5D3DEFDC843B73AECC835480E45618C923EFBDAA96BC1330
- MD5 SHA1 SHA512 SSDEEP TLSH
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.part4.rar
- SHA256 36a21fa057bd38974ad8f2a462a88759029958d032f067457a749141c88bc5cd
- MD5 1b9dd42b1355c1ba780c655152f34669
- SHA1 e4382ca228a3717baedc55dc7e8846211ef520de
- SHA512 0eda6a357dbd71f5f0c59b1cf0a6150b5402f1d84d4fc994ccfa6854a3ca53fe54fee096ff96ae845b586140544cb7aa5dfd074148272f1d77fb35dec67f3dfa
- SSDEEP 6291456:xuCEdTXIDboU8AdNyaInGNrcNyAyMFNxLQqjjWpCi48X:xnElXe8AdN4GiEAlPRmCw
- TLSH T1DBC833D27F96FEBB79502ED715C88EBCEB638C1E02D7B1124241DB65031B93346AA316
- MD5 SHA1 SHA512 SSDEEP TLSH
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.part5.rar
- SHA256 d3ad083a9b59a067943db0a49ddcfc44a20a6d58fb35b0c519e82feff2f38059
- MD5 1f374a966fbdd62d36080bfd88e4ae24
- SHA1 fe0c57518c4e032ad814ed0c0a9953bf77cd968b
- SHA512 8e92e6b30bc05c1ec2c6a2bf0044c143272c418cf7881aadcb66c20a9f8cb1faac1ad6802543ab37bd1b2c10f8ede217571388fb9bcc009590d2a8e5ba738c69
- SSDEEP 3145728:tUmGxid737M0TM5Ge+ojgT6nl5BqAmRAdffzmMD:tUm7Li5X+8o6n7BqLed3zx
- TLSH T1143833178B073346AC7B8CE882DD89CC7667989453F3537BD0966CB1EB462D604ADB0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Image-Line.FL.Studio.v26.1.4.5589.Incl.Keygen-R2R/r2r16704.sfv
- SHA256 ac6ab1c3dadd0baa66da313ff797aef104a616b4f9aa38b5c8fbfc81f089da21
- MD5 4f3ef849226fd8874fd16191250288a4
- SHA1 71b4b6070e5bc74818a5ec18236a4485f5f301d1
- SHA512 fe43e009e57020b84130bfe91d031170f4dd2074c94bd0946dff6c882e7a75285a11f2be4c080ef694ab64922adc926885cdc2cded9415b8b25391d10cec04cc
- TLSH T1BBC048FCB83824D14BC2DB627204A882801FC136B3E6D5300C8A0930AEB10F09901678
- MD5 SHA1 SHA512 TLSH