Sophia[.]Script[.]for[.]Windows[.]10[.]PowerShell[.]7[.]v5[.]13[.]5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Sophia.Script.for.Windows.10.PowerShell.7.v5.13.5.zip
Size

6.4MB
MD5

170c76834d678a179f71ae5c35e111f4
SHA1

54625c43d5483f5e65971e22d3fdd079450b605c
SHA256

1b8338335f12257ae2dc0f8ad80aa7d1cbb99d07916b4bf66ae52ef1c95ecde3
SHA512

47b7298fc58cb1a21bbf906b928e6ebf55b879ecfa0bb59bc00bbcf6e20f240c5900eebdd6f25ff211c8c9269bbbdc510531dc555ee7841b6f42ce831b831774
SSDEEP

196608:wPgiglydJspuOL76SeNNPqMmr7eliJUo6Xgkk+vCxPYNbGo8zMDm:A7fxOv6Se7qMmbJiQkkjPYNKom

Score

N/A

Malware Config

Signatures

Files

Sophia.Script.for.Windows.10.PowerShell.7.v5.13.5.zip
.zip
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Functions.ps1
.ps1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/de-DE/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/en-US/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/es-ES/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/fr-FR/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/hu-HU/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/it-IT/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/pt-BR/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/ru-RU/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/tr-TR/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/uk-UA/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Localizations/zh-CN/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Manifest/Sophia.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Module/Sophia.psm1
.ps1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/Sophia.ps1
.ps1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/bin/Microsoft.Windows.SDK.NET.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fe:6b:c4:79:f7:ac:ba:4f:5b:24:ff:ef:51:66:18:13:30:aa:f9:91:51:11:54:b3:4d:e2:b2:33:6f:ee:2e:e1
Signer

Actual PE Digest

fe:6b:c4:79:f7:ac:ba:4f:5b:24:ff:ef:51:66:18:13:30:aa:f9:91:51:11:54:b3:4d:e2:b2:33:6f:ee:2e:e1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

17/11/2022, 13:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 20.7MB - Virtual size: 20.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/bin/PolicyFileEditor/Commands.ps1
.ps1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/bin/PolicyFileEditor/Common.ps1
.ps1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/bin/PolicyFileEditor/PolFileEditor.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:69:8e:c8:30:50:51:02:8a:99:07:7c:1b:a0:f2:ae
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/04/2015, 00:00

Not After

16/06/2016, 12:00

Subject

CN=David Lee Wyatt,O=David Lee Wyatt,L=Brampton,ST=ON,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:e5:18:d9:d5:f8:8e:c8:52:9c:bb:b5:29:39:db:83:ed:7c:ec:88:a5:1f:8c:74:53:a5:98:a2:8d:f7:e1:bc
Signer

Actual PE Digest

9c:e5:18:d9:d5:f8:8e:c8:52:9c:bb:b5:29:39:db:83:ed:7c:ec:88:a5:1f:8c:74:53:a5:98:a2:8d:f7:e1:bc

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=David Lee Wyatt,O=David Lee Wyatt,L=Brampton,ST=ON,C=CA

11/04/2015, 21:33
Valid: true

Chain 1

CN=David Lee Wyatt,O=David Lee Wyatt,L=Brampton,ST=ON,C=CA

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/bin/PolicyFileEditor/PolicyFileEditor.psd1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/bin/PolicyFileEditor/PolicyFileEditor.psm1
.ps1
Sophia_Script_for_Windows_10_PowerShell_7_v5.13.5/bin/WinRT.Runtime.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:46

Not After

11/05/2023, 20:46

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:70:7b:e0:4e:99:ec:9a:36:3c:d8:93:a9:07:4e:4f:7e:72:bd:74:f8:b6:9c:8a:20:e7:2c:3d:65:44:2b:c9
Signer

Actual PE Digest

3a:70:7b:e0:4e:99:ec:9a:36:3c:d8:93:a9:07:4e:4f:7e:72:bd:74:f8:b6:9c:8a:20:e7:2c:3d:65:44:2b:c9

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

17/11/2022, 13:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 374KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:ccCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

fe:6b:c4:79:f7:ac:ba:4f:5b:24:ff:ef:51:66:18:13:30:aa:f9:91:51:11:54:b3:4d:e2:b2:33:6f:ee:2e:e1Signer

Signature Validations

Verification

17/11/2022, 13:20 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 20.7MB - Virtual size: 20.7MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

04:69:8e:c8:30:50:51:02:8a:99:07:7c:1b:a0:f2:aeCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

9c:e5:18:d9:d5:f8:8e:c8:52:9c:bb:b5:29:39:db:83:ed:7c:ec:88:a5:1f:8c:74:53:a5:98:a2:8d:f7:e1:bcSigner

Signature Validations

Verification

11/04/2015, 21:33 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 12KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 696B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:ccCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

3a:70:7b:e0:4e:99:ec:9a:36:3c:d8:93:a9:07:4e:4f:7e:72:bd:74:f8:b6:9c:8a:20:e7:2c:3d:65:44:2b:c9Signer

Signature Validations

Verification

17/11/2022, 13:20 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 374KB - Virtual size: 373KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

fe:6b:c4:79:f7:ac:ba:4f:5b:24:ff:ef:51:66:18:13:30:aa:f9:91:51:11:54:b3:4d:e2:b2:33:6f:ee:2e:e1
Signer

17/11/2022, 13:20
Valid: false

.text
Size: 20.7MB - Virtual size: 20.7MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

04:69:8e:c8:30:50:51:02:8a:99:07:7c:1b:a0:f2:ae
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

9c:e5:18:d9:d5:f8:8e:c8:52:9c:bb:b5:29:39:db:83:ed:7c:ec:88:a5:1f:8c:74:53:a5:98:a2:8d:f7:e1:bc
Signer

11/04/2015, 21:33
Valid: true

.text
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 696B

.reloc
Size: 4KB - Virtual size: 12B

33:00:00:02:cc:8e:b5:96:a6:bd:d1:c9:4e:00:00:00:00:02:cc
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

3a:70:7b:e0:4e:99:ec:9a:36:3c:d8:93:a9:07:4e:4f:7e:72:bd:74:f8:b6:9c:8a:20:e7:2c:3d:65:44:2b:c9
Signer

17/11/2022, 13:20
Valid: false

.text
Size: 374KB - Virtual size: 373KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B