General

Malware Config

Signatures

Files

• 0f888907403ebaee309e7927c72e5ebd6aca817209fd1a5a8ceaa0b028116fcd

  .rar
• PO.exe

  .exe windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  86:79:3c:93:4d:fd:84:27:0b:3a:ce:61:68:f5:06:77

  Certificate

  Issuer

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a39463530353931303533303234444246423745464238314346384533364441394061766173742e636f6d

  Not Before

  05-08-2020 06:36

  Not After

  05-08-2021 06:36

  Subject

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a39463530353931303533303234444246423745464238314346384533364441394061766173742e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-05-2019 00:00

  Not After

  01-08-2030 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1b:63:b3:ff:80:db:d9:3c:a8:f2:28:53:fa:37:cd:ea:10:82:8a:65:ce:6d:ee:cf:3c:d1:e1:30:77:4e:31:95

  Signer

  Actual PE Digest

  1b:63:b3:ff:80:db:d9:3c:a8:f2:28:53:fa:37:cd:ea:10:82:8a:65:ce:6d:ee:cf:3c:d1:e1:30:77:4e:31:95

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a39463530353931303533303234444246423745464238314346384533364441394061766173742e636f6d

  18-05-2022 18:07

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 99KB - Virtual size: 99KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• new PO.exe

  .exe windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  d6:b8:d2:b5:ab:7f:32:10:c3:01:bf:21:f2:29:d8:eb

  Certificate

  Issuer

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a43353342324237323241314534373937414531463137314433444344314345324061766173742e636f6d

  Not Before

  05-08-2020 06:37

  Not After

  05-08-2021 06:37

  Subject

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a43353342324237323241314534373937414531463137314433444344314345324061766173742e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-05-2019 00:00

  Not After

  01-08-2030 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9e:9a:50:33:dd:c5:7f:6c:85:d6:b3:df:56:e4:a3:e5:b5:f2:46:ec:7e:01:79:82:80:b7:5e:2d:40:9b:80:c5

  Signer

  Actual PE Digest

  9e:9a:50:33:dd:c5:7f:6c:85:d6:b3:df:56:e4:a3:e5:b5:f2:46:ec:7e:01:79:82:80:b7:5e:2d:40:9b:80:c5

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a43353342324237323241314534373937414531463137314433444344314345324061766173742e636f6d

  18-05-2022 18:07

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 177KB - Virtual size: 176KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• req.exe

  .exe windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  b7:e2:23:8a:14:66:6b:82:ab:da:37:02:8c:35:c4:9c

  Certificate

  Issuer

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a34423941424136313746364334443643393838314341363942303834444239364061766173742e636f6d

  Not Before

  05-08-2020 06:37

  Not After

  05-08-2021 06:37

  Subject

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a34423941424136313746364334443643393838314341363942303834444239364061766173742e636f6d

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  02-05-2019 00:00

  Not After

  01-08-2030 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  10:3d:f5:b0:5d:b3:9c:2c:34:f8:d2:d5:ca:8c:78:d5:ab:aa:84:f3:eb:98:ee:e6:36:5e:77:44:0a:fb:d4:91

  Signer

  Actual PE Digest

  10:3d:f5:b0:5d:b3:9c:2c:34:f8:d2:d5:ca:8c:78:d5:ab:aa:84:f3:eb:98:ee:e6:36:5e:77:44:0a:fb:d4:91

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Avast Software s.r.o.,OU=RE 999,O=Avast Software s.r.o.,L=Prague,C=CZ,1.2.840.113549.1.9.1=#0c2a34423941424136313746364334443643393838314341363942303834444239364061766173742e636f6d

  18-05-2022 18:07

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 185KB - Virtual size: 184KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ