ISOMate[.]exe | Triage™

Resubmissions

01/11/2026, 21:39

261101-1hmhpadt6y8

01/11/2026, 21:37

261101-1gtwdadt6t7

Sharing

Copy URL Twitter E-mail

General

Target
ISOMate.exe
Size 2.2MB
Sample261101-1hmhpadt6y
SHA256 7e0dd0d17d4615e01bbdcb1a5c91a5aa9b812c721c6a799a6f6ede0d78b5bfc7
MD5 71c4553089f365efa8a843789ad41710
SHA1 ac4b596a891eddfbe7c10854741b5d6b1d3cadec
SHA512 423b1d88dadac592faac12d6c53a3c4622591d25a1594ccd8bd22d281ffe6c686e69054f6790145411f81e5cf69b8559541906442cbe635917b666f71551d1a3
SSDEEP 49152:gUlRNsnRU/tEyZ0aEoV5F7ZdOciMXAv/2SNsnRU/tEyZ0aEnNsnRU/tEyZ0aEr:gQNsnRU/tEyZ0aEopV0UAmSNsnRU/tE8
TLSH
T11EA5D059D1454ABCC99E70F855368882DDB6EC9F0395D2AA36CFE7E9C70C9808933B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ISOMate.exe

File Explorer

ISOMate.exe

.exe 2.2MB

ISOMate.exe

IMPHASH 27aed74056ed632c29a14b2188a62e9e
SHA256 7e0dd0d17d4615e01bbdcb1a5c91a5aa9b812c721c6a799a6f6ede0d78b5bfc7
MD5 71c4553089f365efa8a843789ad41710
SHA1 ac4b596a891eddfbe7c10854741b5d6b1d3cadec
SHA512 423b1d88dadac592faac12d6c53a3c4622591d25a1594ccd8bd22d281ffe6c686e69054f6790145411f81e5cf69b8559541906442cbe635917b666f71551d1a3
SSDEEP 49152:gUlRNsnRU/tEyZ0aEoV5F7ZdOciMXAv/2SNsnRU/tEyZ0aEnNsnRU/tEyZ0aEr:gQNsnRU/tEyZ0aEopV0UAmSNsnRU/tE8
TLSH
T11EA5D059D1454ABCC99E70F855368882DDB6EC9F0395D2AA36CFE7E9C70C9808933B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d3:aa:3e:98:3d:9b:7d:07:24:2c:dd:02:8c:e3:70:74:25:ae:38:02:d6:92:b8:de:f5:48:a8:94:bf:34:f3:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91440300MA5F16HJ5W,CN=SYSGeeker Technology Limited,O=SYSGeeker Technology Limited,L=Shenzhen,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

142120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipClosePathFigure GdipDeletePath GdipAddPathLine GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRectRect GdipDrawImageRectI GdipFillPath GdipFillEllipseI GdipFillEllipse GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawEllipseI GdipDrawEllipse GdipDrawRectangle GdipDrawLineI GdipDrawLine GdipScaleWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetSmoothingMode GdipReleaseDC GdipGetDC GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapGetPixel GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipLoadImageFromStream GdipSetPenLineJoin GdipSetPenLineCap197819 GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipCreateLineBrush GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathPolygon GdipAddPathArc GdipAlloc

comctl32

InitCommonControlsEx ord410 ord413

shlwapi

PathFindFileNameW

shell32

SHFileOperationW SHGetFolderPathW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW ShellExecuteW

ole32

CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpSetOption

advapi32

RegSetValueExW OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyExW

user32

MapWindowPoints ScreenToClient SetCursor GetWindowRect GetClientRect GetWindowTextW SetWindowTextW RedrawWindow InvalidateRect SetWindowRgn EndPaint BeginPaint ReleaseDC SetWindowLongPtrW GetDC SetForegroundWindow UpdateWindow FillRect GetSystemMetrics EnableWindow KillTimer SetTimer SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW TrackMouseEvent MessageBoxW LoadCursorW GetWindowLongPtrW LoadIconW DestroyIcon LoadImageW DrawIconEx DrawTextW

gdi32

CreateRoundRectRgn CreatePen DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject GetDeviceCaps GetStockObject GetTextExtentPoint32W LineTo SetBkColor SetBkMode SetTextColor MoveToEx CreateSolidBrush CreateFontW SelectObject

kernel32

VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree ExitProcess GetModuleFileNameW GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetStartupInfoW IsDebuggerPresent InitializeSListHead LCMapStringW GetLocaleInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW IsValidLocale GetSystemTimeAsFileTime SleepConditionVariableSRW GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindFirstFileExW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceCounter LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx WideCharToMultiByte FormatMessageW GetTickCount64 CreateProcessW CreateThread GetExitCodeProcess GetCurrentProcessId GetCurrentProcess Sleep WaitForSingleObject CloseHandle GetTempPathW WriteFile SetFilePointerEx SetEndOfFile RemoveDirectoryW GetFileAttributesExW DeleteFileW CreateFileW CreateDirectoryW SearchPathW GetUserDefaultUILanguage MulDiv IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW GetLastError FreeLibrary GetProcAddress LoadLibraryW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetModuleHandleW GlobalAlloc GlobalUnlock GlobalLock

Name

.text

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ISOMate.exe

PE Signature issue

gdiplus

comctl32

shlwapi

shell32

ole32

winhttp

advapi32

user32

gdi32

kernel32

generic