anypdf | DiagnosticDriver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DiagnosticDriver.exe
Size 160KB
Sample260403-e7vdyadv5v
SHA256 459c5374a9c6b6109a19bda99e4ab4b81239a53fbd0b9915cb1a51b34e2ccb4d
MD5 0eab14dcf7350531acc409be8bc70def
SHA1 3f64b7ce830187d018e9d37c2f2a99bb220c1a14
SHA512 60b0d9db3caddfff52a48f1167ab7291ca14d4691c469886456cfddb2ee521f587fa65c2e53cef83a53a1caa6c536abb53f4263b25d483437c76e31c76a0a290
SSDEEP 3072:WgHfu812B4gcFxxPxE9ZS797Bwze2iIcevlEX4dTlpB0DNohSqs+DgZZOHVxJEii:Wm2HcFPxE9K976zeFlevIkT0DNoBs+Dk
TLSH
T128F34D3E274A9E77CA6C86F0C0DB512017F2968B5B33C7492DC016DD1E42786BE5768E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

anypdf

Malware Config

Signatures

Anypdf family
anypdf

Detects AnyPdf backdoor 1 IoCs

resource	yara_rule
sample	family_anypdf

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
DiagnosticDriver.exe

File Explorer

DiagnosticDriver.exe

.exe 160KB

DiagnosticDriver.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 459c5374a9c6b6109a19bda99e4ab4b81239a53fbd0b9915cb1a51b34e2ccb4d
MD5 0eab14dcf7350531acc409be8bc70def
SHA1 3f64b7ce830187d018e9d37c2f2a99bb220c1a14
SHA512 60b0d9db3caddfff52a48f1167ab7291ca14d4691c469886456cfddb2ee521f587fa65c2e53cef83a53a1caa6c536abb53f4263b25d483437c76e31c76a0a290
SSDEEP 3072:WgHfu812B4gcFxxPxE9ZS797Bwze2iIcevlEX4dTlpB0DNohSqs+DgZZOHVxJEii:Wm2HcFPxE9K976zeFlevIkT0DNoBs+Dk
TLSH
T128F34D3E274A9E77CA6C86F0C0DB512017F2968B5B33C7492DC016DD1E42786BE5768E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects AnyPdf backdoor
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

70:52:dd:b2:63:88:ee:f0:62:96:d4:5f:cd:c1:da:86:42:43:b8:58:77:17:fd:06:2e:d9:9e:6a:71:c0:08:1a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=12577470,CN=Sol Digital Solutions Limited,O=Sol Digital Solutions Limited,STREET=71-75 Shelton Street,L=London,ST=Greater London,C=GB,1.2.840.113549.1.9.1=#0c1e6d61696c40736f6c2d6469676974616c2d736f6c7574696f6e732e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 14, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

44:cd:ca:81:39:7d:ea:af:fd:2d:05:2a

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jan 29, 2026

Timespan

Jul 14, 2022 - Jul 14, 2025

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

157326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

DiagnosticDriver.exe

PE Signature issue

mscoree

dotnet