c:\home\dvlp\ManagedXLL-branches-4_0\MetroFramework\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fn_external.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
fn_external.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
fn_external.exe
Resource
win11-20240709-en
General
-
Target
softaim 2024 upd.zip
-
Size
2.6MB
-
MD5
0af3633f58fec54c4b58c7fbdfcbc32c
-
SHA1
52c1dbbc2c6af049568ba707b5dc6883c30fcb0b
-
SHA256
ffb40a06e1abee04f8ff386ad676035e22d5411fa3550d3465cafccfb517e43b
-
SHA512
7458f06191f7ff299dacd801e1a8433b374c2f097516579333ae6858081bfd543d18a944bfffc4249b29ed9f4eb91269bb77814f10c5f3914cd9fd12288a7a50
-
SSDEEP
49152:S3E5VbE+6L7MHpMZhYUN8LbeRo3UU9YBynzqz6Ziv9zPNUyEEl4qfpLe7MvW:S32VbN6LYHAhNWbsKl9myzPZMI4lRpC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/eac_bypass.dll
Files
-
softaim 2024 upd.zip.zip
-
eac_bypass.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 654KB - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
fn_external.exe.exe windows:4 windows x86 arch:x86
Code Sign
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before29/04/2021, 00:00Not After28/04/2036, 23:59SubjectCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5Certificate
IssuerCN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=USNot Before02/07/2021, 00:00Not After10/07/2024, 23:59SubjectCN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
01Certificate
IssuerCN=Dummy issuerNot Before01/01/2013, 10:00Not After01/04/2013, 10:00SubjectCN=Dummy certificate05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14/07/2023, 00:00Not After13/10/2034, 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
a8:b9:58:c3:b7:b7:bf:79:29:ef:e3:c8:d2:97:9c:41:fd:17:40:95:18:49:f1:dc:b7:a3:87:4c:f2:f4:76:f6Signer
Actual PE Digesta8:b9:58:c3:b7:b7:bf:79:29:ef:e3:c8:d2:97:9c:41:fd:17:40:95:18:49:f1:dc:b7:a3:87:4c:f2:f4:76:f6Digest Algorithmsha256PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
�÷1.�s��yN�M��imWh������QQq�c�����RB������-����g9[v&�0猏�����*&��=�(>�A%DT.�}�����(n��r�e��/Х�$�P�� J��H�"'�_;~���za������9���u8���P����58�����&#��R���߈�ť,��Խ������8e =�5�k����w���o�y�vq��5⛣r�9fmB�'! K��0�9]*g!Zr�i0���hecݺ�A�� �O���� k���Q�^:��~q����2���R^����������Z0�n��E���i�w��7j����2MW*��tz.$3� �����f4-�:������[P�����߄ܓ����Z�|!6Պ's�P�Nޥ�� 1��F�H� g�홝��<������BtQ�]�� ���#!\������^ϥ���Bwc;/d��IZǶ̚���������������3�;�� ,©�~���D�]���S���<H^�R6+ѧX]!��5��}_pv�R�EV���@+�Zh�BI��`��O��[�ͷ��~��ǚ��9yVe��蝔�2lz���+����+�XS2���Ά��fwʜtQ�e�lz�K]�1����������d��z��.�ɲ+�D���4cP�(%[΅�6[�]8��To^����<�0��|[:O�@"/>,�� '!Q�����H}�!��M^��K���s�m;Z{��U�6��FO��)^��s��#y��� ���J�e�f�"������Z� f����p?�����V�$�X�e��\�NoRGC�XÀ��{�'(^�QO�3��M,���]��I��_�����/8S��h*mH����v�^bҤ+ɪ��VtZ�{u���J<�7 Zh8_��0ZtWU���ǣ�a�o4;r<h�����K}6k�W�&_L-ٴ�ɓ^��'�a7�5�GR7X�-Ns���<�}s�ټ������O�� ���ft�;�Hj���'���P�\���3�9;-���IK���[���%���3R��%�+�Da�aC\��v4�)Яgя)����"Lʱ2��#��;<ׇ�s\/myb�?�#����ũA�dxF�.q���<���Yױ�E��u̼��� ��ȏ���G�I�Me@�sT��A^Ǔ�Mi���8m�~δg-�q^Q��|5W���d�Ж��fP�����Z�>�z���$�U̔�~���]�W�+��O&݀�X���\ʃVol���TO��D��!F������?��[�i���l�����S]��$�_��>.an� �����!�,X'յVx-fu;������/��%ɛȊh��fۛ���[�lK������]f�jrK��yUm�����ŕ�@�s:���U�jA�] ��k%��cE�6�Ӥ��d�E�U�k��4;�Fߓ���}���rg��,�a8۔�"�s�&�J�|������]�&}M�OH��J�F6��{��\]J���y,�Qa\y]�=�X�v���M�_�f�b�z���ow��{��Eވ���ߒ��^\��`��K���ߦ[0m�t4D�BR���w#��m�����kxؘH��R9\���A�j ��*��@�,�~���F�' ��r�Q��:iE����E~�w�H��#$2���;��G�)��c�E���Q��i��W;J ��mB=��t7��!���w�n�c��� �Z�����"��@+ �y��M��.�(g���70C{t>�)��8�^��� �J��%Ĝ�/�Z�&����+�r��Xj4wf�^v!C+��T6#A"l��5�2MǙ �x;ہl��j��!�1�5�t)d5i���U�z��4�{?Cb�Z50:V�dt㤱l��tz��ʪ ������$�y��:��c`O>h��e#�θ(���_��o� �gd�J���Ŭ����~LU]���yf�3d"�w�k$�Ƌzo���y�";� ��:ـ�,jmĿ�azDd��Qg����nf)5�VlϒET}�2�v�ZLj&��9��V�<ǜ�FB�~4�0��D&� b�ּ�$/�&bC�B8�O�e2f̶O�2�/�G�icE�'V�1 FUU�m����*�I5�'�V��.5�X�ie,f��]"�z��D�/�I҈��+Q���T�xp�FM-��4���{�G�I��QQ�K�_��q�lZ���n~b��1e]GKM���_@6��g03���8�@�KXi��HE�.%5,p}*֮Sw��kS�-�}:�7l�Y�S{h�q0��M�b;���O'^��#�����hjb�[Z0Gbuꀩ����x)����ZP�J����u`��cC�^6{1��;L�P��ݱ��Xhr��NdM?�ox��l��(bK>���� ��g�����ET��o�80v8�ܴ����N�2iQ����c�x,~W���kܻ��N�f+)�V �L��,�xXB�y�������n3Չ�����+�֪�~weS3W�q�W� �$�v�@�h��H�́8k���<��8��S�Q���Wq�3$]�]��!�v���PN�mb]S��p�\6x���}O�k�G�h�j����ȃ�6o�$�v@ˤރ����*w����zUg�AɊX:�zK�Q��/5r��+�~�� �"LwkE�� � ��jO�E�-���`}Vx�L`�,:6/���1���C>���/�$p��}�z�AХ2[l"���D�<���@g�幡>���E��=\���V��mm��G�������R����,�吋X��z�Df�R�<HlX��)�E��ye�b95"P��Tm�]ͤa����U.�{L�T�����W���s0Y�u Ւ�g���l�yΚ�y/�u��.��h/L}�VV�ۊ��T�N˻w(��H~8�����9R����Nm��C�~��@��&���Bo7��9�BFMp2o���=C�?����"�A��)�l��'؛}�P����7�ˢ,�C���\8a�̉W6���B[a��:w�'W_�8t߁vK�9�J�k���\�c��~wKBf凚��xF�frݹ;/������,����E(@��UoZ?!םfys��;�2L ��w��:V�����c��Rƒ�|y���� �j�Ӝ�Uz�Ku�a�q���9�����Ql� '�H� �E1�7����*�/itJ����6��--��z蟴�fȄ�a�A���~Õj�S�9�?r^������e�B�5�H�O~���T��o �.mf�1?�ޓ|Yij 24��e���Aމ�M���io�b�#�{�4�̩a� n�%��;���tc�֟ �9�Π_���}rY���3��@G]�k12�8A�_}��=��s������[ ��F��/ \G��� <���4rh6�i�'=D_��C��Ą.��L��;Y�.��&[ �@�A3(ZݙJ�Kۯ *�j��K'ԏM���T��1+�X�_��~�>�"��t~Bh�s%͝^�n��1��?
Sections
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE