General

Malware Config

Signatures

Files

• 8295fc538990ba0e29ccee1344cfe5426a5132b65c45f9005706ce7f98c7a6d8

  .rar
• Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe

  .exe windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:80:3b:c7:53:7a:18:18:c4:ab:13:54:69:96:3c:10

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  21-02-2019 00:00

  Not After

  20-02-2022 23:59

  Subject

  CN=Rare Ideas LLC,O=Rare Ideas LLC,POSTALCODE=10118,STREET=350 Fifth Ave Suite 5209,L=New York,ST=New York,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01:80:3b:c7:53:7a:18:18:c4:ab:13:54:69:96:3c:10

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  21-02-2019 00:00

  Not After

  20-02-2022 23:59

  Subject

  CN=Rare Ideas LLC,O=Rare Ideas LLC,POSTALCODE=10118,STREET=350 Fifth Ave Suite 5209,L=New York,ST=New York,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  19-02-2018 00:00

  Not After

  18-03-2029 10:00

  Subject

  CN=GlobalSign TSA for Advanced - G2

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  04:00:00:00:00:01:31:89:c6:50:04

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  02-08-2011 10:00

  Not After

  29-03-2029 10:00

  Subject

  CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  63:ac:e7:e7:de:ac:fe:b7:74:04:0d:df:82:6c:6c:01:7d:28:d7:3c:14:d8:12:2f:8e:c0:15:ef:c0:87:65:6e

  Signer

  Actual PE Digest

  63:ac:e7:e7:de:ac:fe:b7:74:04:0d:df:82:6c:6c:01:7d:28:d7:3c:14:d8:12:2f:8e:c0:15:ef:c0:87:65:6e

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Rare Ideas LLC,O=Rare Ideas LLC,POSTALCODE=10118,STREET=350 Fifth Ave Suite 5209,L=New York,ST=New York,C=US

  24-06-2020 16:44

  Valid: true

  Chain 1

  CN=Rare Ideas LLC,O=Rare Ideas LLC,POSTALCODE=10118,STREET=350 Fifth Ave Suite 5209,L=New York,ST=New York,C=US

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  8a:be:4e:d3:6f:62:5b:6e:54:d5:4b:03:88:95:9c:2b:47:eb:e5:10

  Signer

  Actual PE Digest

  8a:be:4e:d3:6f:62:5b:6e:54:d5:4b:03:88:95:9c:2b:47:eb:e5:10

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  CN=Rare Ideas LLC,O=Rare Ideas LLC,POSTALCODE=10118,STREET=350 Fifth Ave Suite 5209,L=New York,ST=New York,C=US

  24-06-2020 16:44

  Valid: true

  Chain 1

  CN=Rare Ideas LLC,O=Rare Ideas LLC,POSTALCODE=10118,STREET=350 Fifth Ave Suite 5209,L=New York,ST=New York,C=US

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 235KB - Virtual size: 235KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ