General

Malware Config

Signatures

Files

• d659e03354a9657001d5136308449d5c.bin

  .zip

  Password: infected

• 1e2aaed890f3a5e5657d6806bcf6756bbdef9baeca203330ad862dcf47ddf885.exe

  .exe windows x64

  Password: infected

  8a3f45460aa7178128f660fb37ed69e5

  
  

  Code Sign

  62:f8:12:a3:5f:52:bd:74:b7:18:d6:10:ac:4b:47:83

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  11-09-2018 09:28

  Not After

  11-09-2023 09:28

  Subject

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2

  Certificate

  Issuer

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  17-03-2023 13:56

  Not After

  16-03-2024 13:56

  Subject

  SERIALNUMBER=4613074,CN=1105 SOFTWARE LLC,O=1105 SOFTWARE LLC,L=Dublin,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  26-03-2019 17:44

  Not After

  22-03-2034 17:44

  Subject

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1a:d6:08:a7:d6:34:b5:cd:de:97:cb:a3:cc:f0:d0:4b

  Certificate

  Issuer

  CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  09-12-2022 18:30

  Not After

  06-12-2032 18:30

  Subject

  CN=SSL.com Timestamping Unit 2022,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c

  Certificate

  Issuer

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Not Before

  11-09-2018 09:26

  Not After

  11-09-2023 09:26

  Subject

  CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

  Certificate

  Issuer

  CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  13-11-2019 18:50

  Not After

  12-11-2034 18:50

  Subject

  CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  47:e4:65:89:70:fb:de:83:b2:8b:3d:0c:f8:32:13:26:db:56:dd:3f:c5:e7:67:64:9c:14:ef:9a:f0:b0:d4:b8

  Signer

  Actual PE Digest

  47:e4:65:89:70:fb:de:83:b2:8b:3d:0c:f8:32:13:26:db:56:dd:3f:c5:e7:67:64:9c:14:ef:9a:f0:b0:d4:b8

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Signature Validations

  Trusted

  true

  Verification

  Signing Certificate

  SERIALNUMBER=4613074,CN=1105 SOFTWARE LLC,O=1105 SOFTWARE LLC,L=Dublin,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  24-03-2023 13:23

  Valid: true

  Chain 1

  SERIALNUMBER=4613074,CN=1105 SOFTWARE LLC,O=1105 SOFTWARE LLC,L=Dublin,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Chain 2

  SERIALNUMBER=4613074,CN=1105 SOFTWARE LLC,O=1105 SOFTWARE LLC,L=Dublin,ST=Ohio,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  CloseHandle

  GetLastError

  TryEnterCriticalSection

  CreateActCtxA

  ActivateActCtx

  CreateThread

  ResumeThread

  FindFirstFileA

  FindNextFileA

  GetCurrentProcessId

  GetStdHandle

  CreateFileMappingA

  OpenFileMappingA

  CreateNamedPipeA

  ConnectNamedPipe

  ExitProcess

  VirtualAlloc

  Sections

  .text

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 144KB - Virtual size: 144KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 447KB - Virtual size: 447KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 240B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ