pdf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

pdf
Size

4.4MB
MD5

d76d58b0ea46b1c5f62ca579f2187c26
SHA1

78c47aec4db076bad6e3b07ce4f859cc091e4196
SHA256

a4b2f903e8350c670c341e7a1282af81e2f574053cd0e8e48024ed9357216a97
SHA512

c32f661c2477eb24567e7b36b04624d665184f823a00c92a3a424d8c6acfec5548c8b8ac70fb91f90b4c5a108087d4af9de020d857286c03de2cbb3302839744
SSDEEP

98304:ZlG4rNPBh3sqPiJYvO76RNOPDOrhMINLTAJmI+BvzbagnqXQP4TXZN:lFP3s3Jo+wk4hMqAJmtBbKXQP4TXf

Score

1^/10

Malware Config

Signatures

Files

pdf
.dll windows:4 windows x86

7092032ffa4d22e645b2455f0221ca3c

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:16:16:75:19:b2:4b:5b:24:10:b9:01:6d:5e:07:82
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

30/05/2022, 00:00

Not After

30/05/2023, 23:59

Subject

SERIALNUMBER=91450500MAA7H9NJ04,CN=Guangxi Yunao Network Technology Co.\, Ltd.,O=Guangxi Yunao Network Technology Co.\, Ltd.,L=Beihai,ST=Guangxi,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#131642656968616920496e647573747269616c205061726b,1.3.6.1.4.1.311.60.2.1.2=#13074775616e677869,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:f1:85:53:48:70:68:38:2e:a1:7d:30:be:45:8c:5d:56:60:71:87:e9:cd:c8:cf:2e:2c:61:11:54:da:d7:6a
Signer

Actual PE Digest

78:f1:85:53:48:70:68:38:2e:a1:7d:30:be:45:8c:5d:56:60:71:87:e9:cd:c8:cf:2e:2c:61:11:54:da:d7:6a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
GetLastError
CreateMutexA
MapViewOfFile
CreateFileMappingA
CreateFileA
OpenFileMappingA
WaitForSingleObject
ReleaseMutex
FlushViewOfFile
CloseHandle
UnmapViewOfFile
OutputDebugStringA
GetExitCodeProcess
Sleep
ReadFile
PeekNamedPipe
CreateProcessA
CreatePipe
GetFileAttributesA
GetModuleFileNameA
GetCommandLineW
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
GetTempFileNameW
GetTempPathW
FindClose
FindNextFileW
GetFileAttributesW
FindFirstFileW
CopyFileW
SetFilePointer
SystemTimeToFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
CreateDirectoryA
SetFileTime
WriteFile
DebugBreak
VirtualQuery
GetModuleHandleA
lstrcmpA
InterlockedExchange
CompareStringW
CompareStringA
SetStdHandle
FlushFileBuffers
LoadLibraryA
GetProcAddress
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
InterlockedDecrement
InterlockedIncrement
RtlUnwind
HeapAlloc
HeapFree
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetEnvironmentVariableW
SetEnvironmentVariableA
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
FlushInstructionCache

user32

wsprintfA

msvcrt

??1type_info@@UAE@XZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
fgetwc
ungetwc
setvbuf
fsetpos
fseek
fgetpos
fgetc
ungetc
fputc
fwrite
_EH_prolog
free
malloc

Exports

Exports

VeryPDFPDF2AnyConverter
VeryPDFPDF2AnySetCode

Sections

.text
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7092032ffa4d22e645b2455f0221ca3c

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:16:16:75:19:b2:4b:5b:24:10:b9:01:6d:5e:07:82Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

78:f1:85:53:48:70:68:38:2e:a1:7d:30:be:45:8c:5d:56:60:71:87:e9:cd:c8:cf:2e:2c:61:11:54:da:d7:6aSigner

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 101KB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 4.3MB - Virtual size: 4.3MB

.reloc Size: 20KB - Virtual size: 19KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:16:16:75:19:b2:4b:5b:24:10:b9:01:6d:5e:07:82
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

78:f1:85:53:48:70:68:38:2e:a1:7d:30:be:45:8c:5d:56:60:71:87:e9:cd:c8:cf:2e:2c:61:11:54:da:d7:6a
Signer

.text
Size: 104KB - Virtual size: 101KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 4.3MB - Virtual size: 4.3MB

.reloc
Size: 20KB - Virtual size: 19KB