photocraft[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
photocraft.exe
Size 100.8MB
Sample261102-e6g28aey8t
SHA256 5edf9461fb33181e908f2df6a8223dbbe1b549bce07543c8627e727a8f6f2fb0
MD5 f246a4068d72319a92f6751f5228d9f2
SHA1 524f2dc80786c52dacb370379846d3ad0203180c
SHA512 f8be4081d7faa73d1fd302abc2d1c6193571218aa55cde36102070b513315069cdf744fa41db06408fdb471a97258f8c9ba6c80172897b17276ec059a4fb50ca
SSDEEP 786432:IGYBor/1oPNSeL+PA1bpXTYBSI/Ovlnym2l2LRP:IGYg/uSazbpDLD
TLSH
T1D4387E46F69FB86CE056CCB0D30686235E2530CB162A69FB49D481793F7EBE05B2C716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

photocraft.exe

.exe 100.8MB

photocraft.exe

IMPHASH 94f833ac8240217eae4b7683f15d98fd
SHA256 5edf9461fb33181e908f2df6a8223dbbe1b549bce07543c8627e727a8f6f2fb0
MD5 f246a4068d72319a92f6751f5228d9f2
SHA1 524f2dc80786c52dacb370379846d3ad0203180c
SHA512 f8be4081d7faa73d1fd302abc2d1c6193571218aa55cde36102070b513315069cdf744fa41db06408fdb471a97258f8c9ba6c80172897b17276ec059a4fb50ca
SSDEEP 786432:IGYBor/1oPNSeL+PA1bpXTYBSI/Ovlnym2l2LRP:IGYg/uSazbpDLD
TLSH
T1D4387E46F69FB86CE056CCB0D30686235E2530CB162A69FB49D481793F7EBE05B2C716
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

e1:39:86:29:ad:c4:40:eb:db:d2:4e:c9:19:35:7c:6f:2a:15:29:60:ce:f4:f2:44:5c:d9:23:60:9b:6c:98:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Learning Machines Inc,O=Learning Machines Inc,L=Atlanta,ST=Georgia,C=US

Chains

Oct 18, 2026

CN=Learning Machines Inc,O=Learning Machines Inc,L=Atlanta,ST=Georgia,C=US

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Learning Machines Inc,O=Learning Machines Inc,L=Atlanta,ST=Georgia,C=US

Serial Number

33:00:08:b0:13:7e:2d:27:3e:31:a0:20:3f:00:00:00:08:b0:13

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 16, 2026 - Oct 19, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5f:2a:e4:f8:23:45:bc:1a:49:00:00:00:00:00:5f

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

59417344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

photocraft.pdb

kernel32

SetFilePointerEx IsValidCodePage GetFileInformationByHandle FlushFileBuffers SetFileInformationByHandle ReadFileEx WriteFileEx CreateFileW GetFullPathNameW SetLastError CreateHardLinkW CloseHandle GlobalFree SetHandleInformation ReadFile GetOverlappedResult CompareStringW LCMapStringW SetFileTime GetFileInformationByHandleEx CreateDirectoryW RemoveDirectoryW SetFileAttributesW MoveFileExW FindFirstFileExW GetStringTypeW DeleteFileW DeviceIoControl GetFileAttributesW FindClose GetTempPathW GetModuleHandleExW GetModuleFileNameW HeapAlloc CancelIo FindNextFileW HeapFree GetProcessHeap GetCPInfo DuplicateHandle GetACP LockFileEx WriteFile GetFileType FreeLibrary LoadLibraryW InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx LoadLibraryExA RemoveVectoredExceptionHandler RtlPcToFileHeader RaiseException FlsGetValue CreateEventA GetUserPreferredUILanguages RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceFrequency FlsSetValue IsThreadAFiber GetModuleHandleW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW EncodePointer EnterCriticalSection LeaveCriticalSection ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx InitializeCriticalSectionEx ExitProcess lstrlenW SetThreadStackGuarantee AddVectoredExceptionHandler WaitForMultipleObjects GetExitCodeProcess LocalFree CreateProcessW QueryPerformanceCounter SleepEx DeleteCriticalSection TerminateProcess IsProcessorFeaturePresent CompareStringOrdinal GetProcAddress GetOEMCP IsDebuggerPresent GetCurrentProcessId UnhandledExceptionFilter GetModuleHandleA Sleep GetCurrentProcess LoadLibraryExW FormatMessageW CreateThread GetCurrentThreadId CreateEventW SetEvent LocaleNameToLCID SetThreadErrorMode SwitchToThread GetFinalPathNameByHandleW WaitForSingleObject GetLastError GetCurrentThread MultiByteToWideChar WideCharToMultiByte FreeEnvironmentStringsW GetConsoleOutputCP GetConsoleMode WriteConsoleW GetEnvironmentVariableW HeapReAlloc GlobalAlloc GlobalLock GlobalUnlock HeapSize SetStdHandle SetEnvironmentVariableW GetCommandLineA GetSystemTimeAsFileTime GlobalSize GetSystemInfo UnmapViewOfFile GetCommandLineW GetCurrentDirectoryW VirtualProtect CreateFileMappingW MapViewOfFile GetSystemTimePreciseAsFileTime GlobalMemoryStatusEx GetStdHandle GetEnvironmentStringsW GetWindowsDirectoryW GetSystemDirectoryW

bcryptprimitives

ProcessPrng

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SafeArrayCreateVector SafeArrayPutElement SysAllocStringLen SysStringLen VariantClear

user32

GetWindowTextW ShowWindow GetSystemMenu EnableMenuItem DisplayConfigGetDeviceInfo QueryDisplayConfig CreateWindowExW RegisterClassExW GetDisplayConfigBufferSizes SetWindowLongW TrackMouseEvent GetWindowLongW AdjustWindowRectEx SetCapture ToUnicodeEx GetKeyboardLayout MonitorFromRect ScreenToClient MapVirtualKeyExW GetKeyboardState GetMenu ReleaseCapture GetWindowTextLengthW CreateIcon DestroyIcon GetClipCursor GetPropW DefWindowProcA ClipCursor ShowCursor RegisterClassExA GetClassInfoExA ReleaseDC CreateIconIndirect CreateWindowExA SetPropW SetWindowLongPtrW CallWindowProcW DefWindowProcW DestroyCursor ClientToScreen SetWindowDisplayAffinity RemovePropW MessageBeep GetWindowDC GetDesktopWindow EnumDisplaySettingsW InvalidateRect DestroyWindow RegisterWindowMessageA GetAsyncKeyState IsProcessDPIAware PostMessageW IsZoomed GetKeyState GetCursorPos RedrawWindow EnumWindows SystemParametersInfoA IsWindowVisible PeekMessageW GetDC SetForegroundWindow SendInput MapVirtualKeyW GetForegroundWindow SetCursorPos SetWindowTextW GetWindowRect FlashWindowEx MonitorFromWindow SetWindowPlacement GetWindowPlacement MsgWaitForMultipleObjectsEx ChangeDisplaySettingsExW SetCursor LoadCursorW TranslateMessage InvalidateRgn DispatchMessageW GetRawInputData SetWindowPos MonitorFromPoint SendMessageW GetSystemMetrics GetActiveWindow CreateIconFromResourceEx RegisterRawInputDevices IsIconic GetMonitorInfoW ValidateRect GetClientRect EnumDisplayMonitors GetWindowLongPtrW CloseTouchInputHandle GetTouchInputInfo RegisterClipboardFormatW GetClipboardData IsClipboardFormatAvailable RegisterTouchWindow SetClipboardData EmptyClipboard CloseClipboard OpenClipboard

advapi32

ImpersonateAnonymousToken RegGetValueW RevertToSelf

gdi32

GetPixelFormat SetPixelFormat AbortDoc DescribePixelFormat SwapBuffers EndDoc ChoosePixelFormat CreateRectRgn CreateCompatibleDC BitBlt MoveToEx Ellipse SetBitmapBits CreateCompatibleBitmap GetDIBits CreateBitmap SelectObject GetStockObject CreatePen StretchDIBits StartPage EndPage StartDocW SetBrushOrgEx SetStretchBltMode SetICMMode DeleteObject LineTo DeleteDC GetDeviceCaps CreateDCW

ntdll

NtReadFile NtOpenFile NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError NtCreateFile

shell32

DragFinish SHGetKnownFolderPath DragQueryFileW SHCreateItemFromParsingName

combase

CoCreateFreeThreadedMarshaler CoIncrementMTAUsage CoTaskMemFree

ole32

CoCreateInstance CoUninitialize CoInitializeEx RevokeDragDrop OleInitialize RegisterDragDrop

shlwapi

SHCreateMemStream

winspool.drv

EnumPrintersW OpenPrinterW GetDefaultPrinterW ClosePrinter DocumentPropertiesW

ws2_32

getaddrinfo send getsockopt recv accept select setsockopt WSASocketW WSADuplicateSocketW getsockname WSAStartup bind listen freeaddrinfo connect WSAGetLastError ioctlsocket closesocket

uiautomationcore

UiaLookupId UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaGetReservedMixedAttributeValue UiaRaiseAutomationEvent UiaGetReservedNotSupportedValue

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

prntvpt

PTMergeAndValidatePrintTicket PTCloseProvider PTReleaseMemory PTOpenProvider PTGetPrintCapabilities PTConvertPrintTicketToDevMode

windows.data.pdf

PdfCreateRenderer

dxgi

CreateDXGIFactory1

opengl32

wglGetCurrentContext wglMakeCurrent wglCreateContext wglDeleteContext wglGetProcAddress

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

d3d11

D3D11CreateDevice

d2d1

D2D1CreateFactory

imm32

ImmGetCompositionStringW ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmAssociateContextEx

uxtheme

SetWindowTheme

Name

.text

Size

57.9MB

Virtual Size

57.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40.8MB

Virtual Size

40.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

290KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

photocraft.exe

kernel32

bcryptprimitives

oleaut32

user32

advapi32

gdi32

ntdll

shell32

combase

ole32

shlwapi

winspool.drv

ws2_32

uiautomationcore

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-0

prntvpt

windows.data.pdf

dxgi

opengl32

setupapi

dwmapi

d3d11

d2d1

imm32

uxtheme

generic