VoidPup64-22[.]02-240907[.]iso

Sharing

Copy URL Twitter E-mail

General

Target

VoidPup64-22.02-240907.iso
Size

51.4MB
MD5

14b4ba63577d23be3be687c1d75399e5
SHA1

4d03f9b31546bf504710e61ee2208e67a06333b1
SHA256

2e652e5f421aaca0c936d760bec2b1f7b94dfd6391c075f0b44c578a338aa161
SHA512

b843fad02f927d964e6c4eb08302501c77a37b91fc98fca5a5f47b05031b9519bc2a7f5a9ab44113772c533aac80010cf072c390ab564342b394fcde150ac8d1
SSDEEP

786432:ePzKINnqIvdQbZOFZFOC6XAZKcd39uZMnTplu3VADElJJJVf1RYRa8xfxiqRh:erXdqIKkFjOMKcJ9uZMTpolgmJ1R+RT

Score

1^/10

Malware Config

Signatures

Files

VoidPup64-22.02-240907.iso
.dmg .iso macos polyglot

Password: infected
DISTRO_SPECS
EFI/boot/bootx64.efi
.exe windows:0 windows x64 arch:x64

Password: infected

Code Sign

33:00:00:00:2b:4b:79:b3:69:4d:12:11:87:00:01:00:00:00:2b
Certificate

Issuer

CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:53

Not After

26/07/2019, 20:53

Subject

CN=Microsoft Windows UEFI Driver Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:08:d3:c4:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Corporation Third Party Marketplace Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/06/2011, 21:22

Not After

27/06/2026, 21:32

Subject

CN=Microsoft Corporation UEFI CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:79:b1:40:64:60:1b:c0:98:7d:47:47:af:1e:91:4a:22:8c:05:d6:22:ce:da:03:b7:a4:f6:70:14:fe:e7:67
Signer

Actual PE Digest

af:79:b1:40:64:60:1b:c0:98:7d:47:47:af:1e:91:4a:22:8c:05:d6:22:ce:da:03:b7:a4:f6:70:14:fe:e7:67

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Sections

/4
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 640KB - Virtual size: 639KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 512B - Virtual size: 105B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/26
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dynamic
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rela
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dynsym
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EFI/boot/grubx64.efi
.exe windows:0 windows x64 arch:x64

Password: infected

Code Sign

e4:eb:99:03:dd:50:94:f3
Certificate

Issuer

CN=Puppy Linux

Not Before

07/01/2020, 15:34

Not After

04/01/2030, 15:34

Subject

CN=Puppy Linux

e2:43:95:fa:d6:94:6f:60:0c:44:44:1d:97:26:48:db:44:14:d8:53:bc:45:59:ce:4c:07:e6:7f:3a:14:9d:16
Signer

Actual PE Digest

e2:43:95:fa:d6:94:6f:60:0c:44:44:1d:97:26:48:db:44:14:d8:53:bc:45:59:ce:4c:07:e6:7f:3a:14:9d:16

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mods
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EFI/boot/mmx64.efi
.exe windows:0 windows x64 arch:x64

Password: infected

Code Sign

a7:46:8d:ef
Certificate

Issuer

CN=Debian Secure Boot CA

Not Before

16/08/2016, 18:22

Not After

16/08/2026, 18:22

Subject

CN=Debian Secure Boot Signer

Key Usages

KeyUsageDigitalSignature

30:e8:ba:d0:18:a6:4d:7c:bd:6b:e1:e3:23:e7:03:84:47:c2:b9:c4:d2:84:22:57:9f:17:b2:64:3b:45:55:fc
Signer

Actual PE Digest

30:e8:ba:d0:18:a6:4d:7c:bd:6b:e1:e3:23:e7:03:84:47:c2:b9:c4:d2:84:22:57:9f:17:b2:64:3b:45:55:fc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Sections

/4
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 611KB - Virtual size: 610KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.data
Size: 175KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dynamic
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rela
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.dynsym
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EFI/boot/puppy.cer
[BOOT]/1-Boot-NoEmul.img
[BOOT]/2-Boot-NoEmul.img
adrv_vpup64_22.02.sfs
boot/boot.catalog
boot/efi.img
boot/grub/font.pf2
boot/grub/grldr
boot/grub/grub.cfg
boot/grub/loopback.cfg
boot/grub/menu.lst
boot/grub/menu_phelp.lst
boot/isolinux/chain.c32
.elf linux x86
boot/isolinux/isolinux.bin
boot/isolinux/isolinux.cfg
boot/isolinux/ldlinux.c32
.elf linux x86
boot/isolinux/libcom32.c32
.elf linux x86
boot/isolinux/libutil.c32
.elf linux x86
boot/splash.jpg
.jpg

Password: infected
boot/splash.png
.png

Password: infected
fdrv_vpup64_22.02.sfs
isolinux.bin

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Code Sign

33:00:00:00:2b:4b:79:b3:69:4d:12:11:87:00:01:00:00:00:2bCertificate

Extended Key Usages

61:08:d3:c4:00:00:00:00:00:04Certificate

Key Usages

af:79:b1:40:64:60:1b:c0:98:7d:47:47:af:1e:91:4a:22:8c:05:d6:22:ce:da:03:b7:a4:f6:70:14:fe:e7:67Signer

Headers

File Characteristics

Sections

/4 Size: 124KB - Virtual size: 124KB

.text Size: 640KB - Virtual size: 639KB

.reloc Size: 512B - Virtual size: 10B

/14 Size: 512B - Virtual size: 105B

.data Size: 180KB - Virtual size: 180KB

/26 Size: 1KB - Virtual size: 1KB

.dynamic Size: 512B - Virtual size: 256B

.rela Size: 114KB - Virtual size: 113KB

.dynsym Size: 61KB - Virtual size: 60KB

Password: infected

Code Sign

e4:eb:99:03:dd:50:94:f3Certificate

e2:43:95:fa:d6:94:6f:60:0c:44:44:1d:97:26:48:db:44:14:d8:53:bc:45:59:ce:4c:07:e6:7f:3a:14:9d:16Signer

Headers

File Characteristics

Sections

.text Size: 48KB - Virtual size: 48KB

.data Size: 61KB - Virtual size: 61KB

mods Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 4KB - Virtual size: 4KB

Password: infected

Code Sign

a7:46:8d:efCertificate

Key Usages

30:e8:ba:d0:18:a6:4d:7c:bd:6b:e1:e3:23:e7:03:84:47:c2:b9:c4:d2:84:22:57:9f:17:b2:64:3b:45:55:fcSigner

Headers

File Characteristics

Sections

/4 Size: 118KB - Virtual size: 118KB

.text Size: 611KB - Virtual size: 610KB

.reloc Size: 512B - Virtual size: 10B

.data Size: 175KB - Virtual size: 175KB

.dynamic Size: 512B - Virtual size: 256B

.rela Size: 113KB - Virtual size: 112KB

.dynsym Size: 59KB - Virtual size: 58KB

Password: infected

Password: infected

33:00:00:00:2b:4b:79:b3:69:4d:12:11:87:00:01:00:00:00:2b
Certificate

61:08:d3:c4:00:00:00:00:00:04
Certificate

af:79:b1:40:64:60:1b:c0:98:7d:47:47:af:1e:91:4a:22:8c:05:d6:22:ce:da:03:b7:a4:f6:70:14:fe:e7:67
Signer

/4
Size: 124KB - Virtual size: 124KB

.text
Size: 640KB - Virtual size: 639KB

.reloc
Size: 512B - Virtual size: 10B

/14
Size: 512B - Virtual size: 105B

.data
Size: 180KB - Virtual size: 180KB

/26
Size: 1KB - Virtual size: 1KB

.dynamic
Size: 512B - Virtual size: 256B

.rela
Size: 114KB - Virtual size: 113KB

.dynsym
Size: 61KB - Virtual size: 60KB

e4:eb:99:03:dd:50:94:f3
Certificate

e2:43:95:fa:d6:94:6f:60:0c:44:44:1d:97:26:48:db:44:14:d8:53:bc:45:59:ce:4c:07:e6:7f:3a:14:9d:16
Signer

.text
Size: 48KB - Virtual size: 48KB

.data
Size: 61KB - Virtual size: 61KB

mods
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 4KB - Virtual size: 4KB

a7:46:8d:ef
Certificate

30:e8:ba:d0:18:a6:4d:7c:bd:6b:e1:e3:23:e7:03:84:47:c2:b9:c4:d2:84:22:57:9f:17:b2:64:3b:45:55:fc
Signer

/4
Size: 118KB - Virtual size: 118KB

.text
Size: 611KB - Virtual size: 610KB

.reloc
Size: 512B - Virtual size: 10B

.data
Size: 175KB - Virtual size: 175KB

.dynamic
Size: 512B - Virtual size: 256B

.rela
Size: 113KB - Virtual size: 112KB

.dynsym
Size: 59KB - Virtual size: 58KB