d5e6c78fa98f98a08046549a6dea4f97e167bd1bf1c2b120a5501f5b558acb06

Sharing

Copy URL Twitter E-mail

General

Target

d5e6c78fa98f98a08046549a6dea4f97e167bd1bf1c2b120a5501f5b558acb06
Size

1.4MB
MD5

a9ba7df397e7470822e7e9895df0bf5a
SHA1

24f20edffac1d3d4cd64460edb4c3444ea9ab6e0
SHA256

d5e6c78fa98f98a08046549a6dea4f97e167bd1bf1c2b120a5501f5b558acb06
SHA512

aea7bbce18d69503472487cb4e731f3bb34bc0ef18113e59af4c5c166622d3c8a3ae250158b39cd00720c58e752b666a0defeeb97e58670ec340269d788c6eff
SSDEEP

24576:IKqZOfM6QhBVBfiv2CBv71VVMyuuO7HDKU9NxaMwuhl28QHRMU25XXZl0m:IjZu7QLB47Bv71Njojcuh08QH2HXJum

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SKY5/Sky.VATInvoiceAssistance.ComprehensiveInvoiceService.dll

Files

d5e6c78fa98f98a08046549a6dea4f97e167bd1bf1c2b120a5501f5b558acb06
.zip
SKY5/Sky.VATInvoiceAssistance.ComprehensiveInvoiceService.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SKY5/Sky.VATInvoiceAssistance.InvoiceService.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

19/04/2021, 09:20

Not After

18/04/2024, 09:20

Subject

CN=南京擎天全税通信息科技有限公司,O=南京擎天全税通信息科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:89:79:d4:06:d9:4a:4a:dd:02:18:16:93:81:70:91:c8:58:ca:68:09:86:46:07:79:dc:50:2e:8a:2e:3f:74
Signer

Actual PE Digest

50:89:79:d4:06:d9:4a:4a:dd:02:18:16:93:81:70:91:c8:58:ca:68:09:86:46:07:79:dc:50:2e:8a:2e:3f:74

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 403KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SKY5/Sky.VATInvoiceAssistance.Model.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

19/04/2021, 09:20

Not After

18/04/2024, 09:20

Subject

CN=南京擎天全税通信息科技有限公司,O=南京擎天全税通信息科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e6:15:dd:ba:23:68:bd:16:45:c0:b6:9c:3a:9b:50:d7:89:b0:86:74:ce:f6:65:74:34:86:76:a0:5d:58:22:4c
Signer

Actual PE Digest

e6:15:dd:ba:23:68:bd:16:45:c0:b6:9c:3a:9b:50:d7:89:b0:86:74:ce:f6:65:74:34:86:76:a0:5d:58:22:4c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 942KB - Virtual size: 942KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SKY5/Sky.VATInvoiceAssistance.Runtime.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

19/04/2021, 09:20

Not After

18/04/2024, 09:20

Subject

CN=南京擎天全税通信息科技有限公司,O=南京擎天全税通信息科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8c:82:75:8f:b8:db:de:72:ff:54:db:f2:b0:aa:df:0e:d2:f3:b3:bb:a0:13:22:05:1d:fc:c0:b3:48:c0:10:63
Signer

Actual PE Digest

8c:82:75:8f:b8:db:de:72:ff:54:db:f2:b0:aa:df:0e:d2:f3:b3:bb:a0:13:22:05:1d:fc:c0:b3:48:c0:10:63

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SKY5/Sky.VATInvoiceAssistance_V2.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

19/04/2021, 09:20

Not After

18/04/2024, 09:20

Subject

CN=南京擎天全税通信息科技有限公司,O=南京擎天全税通信息科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a5:56:5e:2a:bb:a1:8e:31:45:b4:eb:15:68:a6:7a:6b:a3:64:17:b7:19:39:66:d3:2a:b6:e2:b4:93:0a:5c:be
Signer

Actual PE Digest

a5:56:5e:2a:bb:a1:8e:31:45:b4:eb:15:68:a6:7a:6b:a3:64:17:b7:19:39:66:d3:2a:b6:e2:b4:93:0a:5c:be

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 103KB - Virtual size: 102KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ceCertificate

Extended Key Usages

Key Usages

50:89:79:d4:06:d9:4a:4a:dd:02:18:16:93:81:70:91:c8:58:ca:68:09:86:46:07:79:dc:50:2e:8a:2e:3f:74Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 403KB - Virtual size: 403KB

.sdata Size: 512B - Virtual size: 488B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ceCertificate

Extended Key Usages

Key Usages

e6:15:dd:ba:23:68:bd:16:45:c0:b6:9c:3a:9b:50:d7:89:b0:86:74:ce:f6:65:74:34:86:76:a0:5d:58:22:4cSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 942KB - Virtual size: 942KB

.sdata Size: 512B - Virtual size: 488B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ceCertificate

Extended Key Usages

Key Usages

8c:82:75:8f:b8:db:de:72:ff:54:db:f2:b0:aa:df:0e:d2:f3:b3:bb:a0:13:22:05:1d:fc:c0:b3:48:c0:10:63Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 249KB - Virtual size: 248KB

.sdata Size: 512B - Virtual size: 488B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ceCertificate

Extended Key Usages

Key Usages

.text
Size: 103KB - Virtual size: 102KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

50:89:79:d4:06:d9:4a:4a:dd:02:18:16:93:81:70:91:c8:58:ca:68:09:86:46:07:79:dc:50:2e:8a:2e:3f:74
Signer

.text
Size: 403KB - Virtual size: 403KB

.sdata
Size: 512B - Virtual size: 488B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

e6:15:dd:ba:23:68:bd:16:45:c0:b6:9c:3a:9b:50:d7:89:b0:86:74:ce:f6:65:74:34:86:76:a0:5d:58:22:4c
Signer

.text
Size: 942KB - Virtual size: 942KB

.sdata
Size: 512B - Virtual size: 488B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

8c:82:75:8f:b8:db:de:72:ff:54:db:f2:b0:aa:df:0e:d2:f3:b3:bb:a0:13:22:05:1d:fc:c0:b3:48:c0:10:63
Signer

.text
Size: 249KB - Virtual size: 248KB

.sdata
Size: 512B - Virtual size: 488B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

a5:56:5e:2a:bb:a1:8e:31:45:b4:eb:15:68:a6:7a:6b:a3:64:17:b7:19:39:66:d3:2a:b6:e2:b4:93:0a:5c:be
Signer

.text
Size: 331KB - Virtual size: 330KB

.sdata
Size: 512B - Virtual size: 488B

.rsrc
Size: 70KB - Virtual size: 70KB

.reloc
Size: 512B - Virtual size: 12B