My_DocuSign_10229302930[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
My_DocuSign_10229302930.exe
Size 1.6MB
Sample260808-bkr4hsba39
SHA256 a10b500459eb73f6963efe2dc0851682d35a777f921f17be9e5500d8af1e6072
MD5 e47df5dcd628335b82f7b868ca0d0d34
SHA1 700359f6f5ec1e66c2e83e28c180ef4d512d56c3
SHA512 4c781409b4be37ab68c03281b6ba92fe067808075aa53fede1c5d999db6ec1c144edff70e60cd10ccd046b2a24a5b2b0712ad0fa4423d9e047db361be1f37403
SSDEEP 49152:0aHqbMGOOMRjiornbPOBrwIt2OwihPJSfkKIxVs:lTdZiJrRDwIBSMKIxVs
TLSH
T15385016AF7A658F1D9A7D838C6928363FFB17168031462D707A08D666F733E06A3D305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign backdoor rat

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
My_DocuSign_10229302930.exe

SimpleHelp remote administration tool 1 IoCs

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat

resource	yara_rule
sample	rat_simplehelp

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
My_DocuSign_10229302930.exe

File Explorer

My_DocuSign_10229302930.exe

.exe 1.6MB

My_DocuSign_10229302930.exe

IMPHASH 4dcdd102066c792bcf91dce0ad10afac
SHA256 a10b500459eb73f6963efe2dc0851682d35a777f921f17be9e5500d8af1e6072
MD5 e47df5dcd628335b82f7b868ca0d0d34
SHA1 700359f6f5ec1e66c2e83e28c180ef4d512d56c3
SHA512 4c781409b4be37ab68c03281b6ba92fe067808075aa53fede1c5d999db6ec1c144edff70e60cd10ccd046b2a24a5b2b0712ad0fa4423d9e047db361be1f37403
SSDEEP 49152:0aHqbMGOOMRjiornbPOBrwIt2OwihPJSfkKIxVs:lTdZiJrRDwIBSMKIxVs
TLSH
T15385016AF7A658F1D9A7D838C6928363FFB17168031462D707A08D666F733E06A3D305
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
SimpleHelp remote administration tool

SimpleHelp is a remote administration tool that can be used as a backdoor

backdoor rat
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ae:11:32:5e:67:50:e6:86:86:b3:c9:c0:37:27:d1:e4:fa:79:f4:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Broughton,ST=Scottish Borders,C=GB

Chains

Jul 7, 2017

CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Broughton,ST=Scottish Borders,C=GB

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=SimpleHelp Ltd,O=SimpleHelp Ltd,L=Broughton,ST=Scottish Borders,C=GB

Serial Number

02:da:67:2a:66:e8:20:15:7d:3e:a3:c0:2d:8e:dd:0d

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Nov 19, 2015

Timespan

Nov 19, 2015 - Jan 14, 2018

Minor OS version

Major OS version

Entry point

118080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

timeGetTime

wininet

InternetQueryOptionA InternetCloseHandle InternetOpenA HttpSendRequestA InternetErrorDlg HttpOpenRequestA InternetSetOptionA InternetReadFile InternetCrackUrlA InternetConnectA InternetOpenUrlA HttpQueryInfoA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpOpen WinHttpGetProxyForUrl

comctl32

InitCommonControlsEx

kernel32

GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA CreateFileA WriteConsoleW WriteConsoleA SetStdHandle HeapReAlloc GetLocaleInfoA RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetConsoleOutputCP CompareStringA MoveFileExA FreeLibrary Sleep GetProcAddress LoadLibraryA GetVersion WaitForSingleObject SetEvent TerminateThread CreateEventA GetLastError GetModuleHandleA CloseHandle CreateMutexA ReleaseMutex CreateThread SetCurrentDirectoryA CompareStringW GlobalFree DeleteFileA InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetExitCodeProcess CreateProcessA lstrlenA FormatMessageA GetShortPathNameA LocalAlloc GetVersionExA LocalFree GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer HeapSize GetOEMCP GetACP GetCPInfo ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount FlsAlloc TlsSetValue SetLastError FlsFree TlsFree FlsSetValue GetCurrentDirectoryA HeapAlloc RaiseException HeapFree SetEndOfFile FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FindNextFileA FindClose MoveFileA ExitProcess GetCurrentProcess GetDateFormatA GetTimeFormatA GetDriveTypeA GetFullPathNameA GetTimeZoneInformation GetSystemTimeAsFileTime ExitThread GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte SetEnvironmentVariableA GetFileAttributesA CreateDirectoryA RemoveDirectoryA GetCommandLineA GetProcessHeap HeapSetInformation HeapCreate WriteFile GetStdHandle GetModuleFileNameA RtlUnwindEx TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlCaptureContext FlsGetValue

user32

SetTimer GetWindowRect KillTimer SetWindowPos GetDesktopWindow DestroyWindow GetMessageA GetWindowLongPtrA PostThreadMessageA MonitorFromPoint LoadIconA SendMessageA GetMonitorInfoA TranslateMessage CreateWindowExA PeekMessageA DefWindowProcA GetCursorPos ShowWindow SetWindowLongPtrA DispatchMessageA SystemParametersInfoA LoadCursorA ValidateRect RegisterClassA

advapi32

GetUserNameA

Sharing

General

Malware Config

Signatures

File Explorer

My_DocuSign_10229302930.exe

PE Signature issue

winmm

wininet

version

winhttp

comctl32

kernel32

user32

advapi32

generic