General

Malware Config

Signatures

Files

• Contract_March_23_INV#398.exe

  .exe windows x64

  dff367c9375e1b68769b5ca3b25ac329

  
  

  Code Sign

  62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  11-09-2018 09:28

  Not After

  11-09-2023 09:28

  Subject

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2

  Certificate

  Issuer

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  17-03-2023 13:56

  Not After

  16-03-2024 13:56

  Subject

  SERIALNUMBER=4613074,CN=1105 SOFTWARE LLC,O=1105 SOFTWARE LLC,L=Dublin,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  26-03-2019 17:44

  Not After

  22-03-2034 17:44

  Subject

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

  Certificate

  Issuer

  CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  09-12-2022 18:30

  Not After

  06-12-2032 18:30

  Subject

  CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  11-09-2018 09:26

  Not After

  11-09-2023 09:26

  Subject

  CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

  Certificate

  Issuer

  CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  13-11-2019 18:50

  Not After

  12-11-2034 18:50

  Subject

  CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  a4:23:b9:82:5e:d7:70:a8:6b:64:31:6d:8e:5c:62:87:cd:b8:04:34:23:68:22:5b:1d:9a:3f:9c:09:38:32:40

  Signer

  Actual PE Digest

  a4:23:b9:82:5e:d7:70:a8:6b:64:31:6d:8e:5c:62:87:cd:b8:04:34:23:68:22:5b:1d:9a:3f:9c:09:38:32:40

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=4613074,CN=1105 SOFTWARE LLC,O=1105 SOFTWARE LLC,L=Dublin,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  23-03-2023 15:01

  Valid: true

  Chain 1

  SERIALNUMBER=4613074,CN=1105 SOFTWARE LLC,O=1105 SOFTWARE LLC,L=Dublin,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Chain 2

  SERIALNUMBER=4613074,CN=1105 SOFTWARE LLC,O=1105 SOFTWARE LLC,L=Dublin,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  CreateFileA

  WriteFile

  CloseHandle

  GetLastError

  HeapWalk

  TryEnterCriticalSection

  CreateThread

  SuspendThread

  OpenThread

  GetModuleHandleA

  GetStdHandle

  DeleteFileA

  OpenFileMappingA

  ExitProcess

  VirtualAlloc

  Sections

  .text

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 238KB - Virtual size: 238KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 119KB - Virtual size: 119KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 192B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ