reWASDCommon[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
reWASDCommon.dll
Size 3.8MB
Sample260719-2exd6aes4j
SHA256 2578e951c8e861908ec3941b491d10fb2e577736a71977ef4581f708d867ab26
MD5 be8a27f3b8dfdcecf0f2e607aed18e50
SHA1 203c5e021927119a95cefe647116926bbaecc757
SHA512 c7614b3db2600dd75f88e988b29dc6facb86ad5dc76079fd048fe3287aa6ee46ab767b66fb93195f9fc8c1c8ad337e17d47c6bfff741e78889bf87ee6be04ea9
SSDEEP 49152:BRREfAteVuuYm/oXloBtqeA/AP4u+VRbg4UvsFF8:BLE4teVuuYRMtVA//uERd8
TLSH
T14F068D40BFAC5E69D1AF0B3EB0760116C6F1E96B6792DD19386DA4BC3F523808E44277
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

costura packer

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
reWASDCommon.dll

Costura .NET executable packer 2 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura
static1/unpack001/jitex.dll	costura

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/costura.dll
unpack001/jitex.builder.dll
unpack001/jitex.dll

File Explorer

reWASDCommon.dll

.dll 3.8MB
costura.dll

.dll 4KB
costura.pdb

2KB
jitex.builder.dll

.dll 34KB
jitex.dll

.dll 825KB

reWASDCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2578e951c8e861908ec3941b491d10fb2e577736a71977ef4581f708d867ab26
MD5 be8a27f3b8dfdcecf0f2e607aed18e50
SHA1 203c5e021927119a95cefe647116926bbaecc757
SHA512 c7614b3db2600dd75f88e988b29dc6facb86ad5dc76079fd048fe3287aa6ee46ab767b66fb93195f9fc8c1c8ad337e17d47c6bfff741e78889bf87ee6be04ea9
SSDEEP 49152:BRREfAteVuuYm/oXloBtqeA/AP4u+VRbg4UvsFF8:BLE4teVuuYRMtVA//uERd8
TLSH
T14F068D40BFAC5E69D1AF0B3EB0760116C6F1E96B6792DD19386DA4BC3F523808E44277
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

PE Signature issue

Digest

19:ef:f0:f2:25:76:54:fe:66:e3:26:60:69:dd:b7:0b:e6:90:06:7a:b0:89:4c:d1:4a:64:0d:66:9f:7c:4c:41

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SIA AVB Disc Soft,O=SIA AVB Disc Soft,L=Jurmala,C=LV

Chains

Dec 7, 2023

CN=SIA AVB Disc Soft,O=SIA AVB Disc Soft,L=Jurmala,C=LV

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=SIA AVB Disc Soft,O=SIA AVB Disc Soft,L=Jurmala,C=LV

Serial Number

0d:bb:b5:26:4f:90:92:7c:71:bf:c4:13:54:09:36:c5

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 18, 2021 - Jun 14, 2024

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 6, 2022 - May 8, 2033

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

3934190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
TLSH
T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

jitex.builder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2bba8d02b22e06468392d2b4fb55f4ce77fbb18f891ddc1d2bb8c3084e59444a
MD5 6e9f2098898f7acfd747c1357cbe424c
SHA1 e5ff552f4f07b5b1068fa6e5da4f5592d131cd0e
SHA512 6275923d7341e797aaf3c41a47267234233d3962066fdb0bef720c95efaef447c49e219f8f7c745b15c849b276d356c927bcff8a8c3597f11cb36950e7985785
SSDEEP 768:bOQ0xsPxPGQjLYouYosYoSYovMbDriw5v/EqvWgxvUaVjbSHmBKNr:UUxriwN/zW6vUi6HVr
TLSH
T1C0F23B0DA3EA776BC98D4BFA94F1121003B4F147BA17F74E8DCDA1B66A233910941B76
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Repos\Jitex\src\Jitex.Builder\obj\x86\Debug\net7\Jitex.Builder.pdb

jitex.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e2f85314081f86b2a0607aad1f662fb30b180754315f2c5f3cf9ae090e462072
MD5 2dd299d8af472bd16234f6318f967e92
SHA1 8e6836cee6030e08cd2d7d8e97085b0c126b941d
SHA512 21c9ac6e18ba74080c555d976e238d13d3f2b0cd7cb01ffc91835fcbe25877225f563fd1083ae8dc729e80c93c1f2a42f56e6948a0c4c859ed29a8e2abe8122b
SSDEEP 12288:NIgiZ4sciA1UTzSqtLL/qpkh5YIIRJiwgHd+X2NC0eG3lFegCkbJVLeWCog9okb:NHJ1Zq1LiUInsHdVY0eG3++JV6/95
TLSH
T1E105126413BC5B1AD6AF5B3EE0B043124F79E5079003DB8E6E8854EE18A37F58A547F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

850782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Repos\Jitex\src\Jitex\obj\Debug\net7.0-windows\Jitex.pdb

reWASDCommon.dll

PE Signature issue

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

jitex.builder.dll

mscoree

dotnet

jitex.dll

mscoree

dotnet