Forger Utility-42-2-10-0-1606267233.zip
- SHA256 bea10a1564a8fea7ecfa877f68d9b3f9d8059220e559ca1103d9bedd1ff95c32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Forger.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
Newtonsoft.Json.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
oo2core_7_win64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target Forger Utility-42-2-10-0-1606267233.zip
- Size 759KB
- Sample261003-1bdbfaff48
- SHA256 bea10a1564a8fea7ecfa877f68d9b3f9d8059220e559ca1103d9bedd1ff95c32
- MD5 7ad752abcb28e4761a85aa74d83f65e9
- SHA1 f0ceaa88adb2da9605bf9f6947c0172e7b01713b
- SHA512 51bec374d5eabff7cd5edc2d989c33deb94043780ff0e115871ef6e04899cf42a6826ec6852a76218baac354bed2a2371b98a6f3500c9d7ee21a91269a0d8fa6
- SSDEEP 12288:GjOIVIvli/pQf+2bkGpixHcAi6oWw97ngqwXwuwKJZUklMcUt9VsMNobO4d3WJIf:sOIVIv0twkHxHcH6oXrzwXwtuUzj9yMQ
- TLSH T149F43327BAD007A812366A83A5CFAD38C115B831567F1F967A0F4684D677DA3C9B4FC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Forger.exe
File Explorer
-
Forger Utility-42-2-10-0-1606267233.zip.zip 759KB
-
Forger.exe.exe 359KB
-
Newtonsoft.Json.dll.dll 659KB
-
oo2core_7_win64.dll.dll 999KB
Forger.exe
- SHA256 04e905fe523eea46f107d347784d67cb474c733614337448b25e068dd09a814c
- MD5 3f0203107ec7cd4143a5d22f1edc7eab
- SHA1 fa7fa429abb860d05dbdd0f0cbe71e6740da0770
- SHA512 5ad9059625bd0797b623c3b9db99bb7b88b27c774578bcf8b9a3f2d7c50e70ceb75ace44909f2e80df762abe1c7b256b3ceca345707823bcf7c387cb9be825b8
- SSDEEP 3072:Uby20ZmoDxe197CJIjvu65p73QDDDDmDDaDKDEbg9mprFOXx:ZDxe1XP9O
- TLSH T1C87480C83EAFCD16E9697DB418A0C17016E06F0A5B31DA966CF87ECB37736D14911293
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\jlv\source\repos\Forger2\Forger\obj\Release\Forger.pdb
Name
.text
Size
214KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
- MD5 4df6c8781e70c3a4912b5be796e6d337
- SHA1 cbc510520fcd85dbc1c82b02e82040702aca9b79
- SHA512 964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c
- SSDEEP 12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn
- TLSH T177E4395133F89E1AE1DFA774B4708A2943F2F40AE2BAE74F5A45A5F92C937504C047A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a7:cc:fe:41:40:99:65:07:53:c6:c7:f4:1c:e3:22:5f:f1:9e:7a:db:83:aa:c0:1c:bd:9b:44:a1:54:ff:58:a1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Apr 22, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
672442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
649KB
Virtual Size
649KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
oo2core_7_win64.dll
- IMPHASH 0ebd80e4346a04c764266e0237b94619
- SHA256 c968942fecda4e94ba95a8f17572884f8cc6a6351ceefaf5131e0b46dc149c55
- MD5 265150f4a61c2bc174ac2dc36c385aa8
- SHA1 5e7fa7350ca3f9d15999846405c9577c807a1cce
- SHA512 50b8c724ddd0a3aa81d09a2d3d8fcbdada19ad05df358a8a1d993e9075e0e6628cfdd75c9f865ab9bffa68f970c4db4b075f3eaa59adf910c08cba82fd1dea19
- SSDEEP 24576:fuiV9ciSx1dNB++b8A/7/9hC9uyVCnHDeIkFK7:ctB++b8A/DUuyVZIR
- TLSH T12F258E52B3D555ECD27780388AAB9213F2B0345D07609AEB5BA4A9753F67FE0173E302
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
6d:1d:fc:f6:35:76:ea:4c:74:9c:8b:38:56:73:b7:98:55:46:06:a6:51:28:34:11:35:47:ea:ef:2d:54:fb:76
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA
Chains
Sep 18, 2019
CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Subject
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
04:00:00:00:00:01:2f:4e:e1:52:d7
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Jan 28, 2028
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG
Serial Number
11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Issuer
CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 24, 2016 - Jun 24, 2027
Subject
CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA
Serial Number
21:de:b5:e6:9e:e9:32:c2:7a:38:24:9a:55:be:88:63
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 4, 2019 - Jul 14, 2022
Minor OS version
0
Major OS version
6
Entry point
787628
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
v:\devel\projects\oodle2\cdepbuild\win64_release_dll\oo2core_7_win64.pdb
kernel32
OutputDebugStringA
HeapAlloc
HeapFree
GetProcessHeap
RtlLookupFunctionEntry
RtlUnwindEx
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
GetLastError
SetLastError
RtlPcToFileHeader
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapReAlloc
GetStringTypeW
LCMapStringW
OutputDebugStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
OodleCore_Plugin_DisplayAssertion_Default
OodleCore_Plugin_Free_Default
OodleCore_Plugin_MallocAligned_Default
OodleCore_Plugin_Printf_Default
OodleCore_Plugin_Printf_Verbose
OodleCore_Plugins_SetAllocators
OodleCore_Plugins_SetAssertion
OodleCore_Plugins_SetPrintf
OodleKraken_Decode_Headerless
OodleLZDecoder_Create
OodleLZDecoder_DecodeSome
OodleLZDecoder_Destroy
OodleLZDecoder_MakeValidCircularWindowSize
OodleLZDecoder_MemorySizeNeeded
OodleLZDecoder_Reset
OodleLZ_CheckSeekTableCRCs
OodleLZ_Compress
OodleLZ_CompressContext_Alloc
OodleLZ_CompressContext_Free
OodleLZ_CompressContext_Reset
OodleLZ_CompressOptions_GetDefault
OodleLZ_CompressOptions_Validate
OodleLZ_CompressWithContext
OodleLZ_CompressionLevel_GetName
OodleLZ_Compressor_GetName
OodleLZ_CreateSeekTable
OodleLZ_Decompress
OodleLZ_FillSeekTable
OodleLZ_FindSeekEntry
OodleLZ_FreeSeekTable
OodleLZ_GetChunkCompressor
OodleLZ_GetCompressedBufferSizeNeeded
OodleLZ_GetCompressedStepForRawStep
OodleLZ_GetDecodeBufferSize
OodleLZ_GetInPlaceDecodeBufferSize
OodleLZ_GetNumSeekChunks
OodleLZ_GetSeekEntryPackedPos
OodleLZ_GetSeekTableMemorySizeNeeded
OodleLZ_GetZipLikeCompressionSettings
OodleLZ_MakeSeekChunkLen
OodleLZ_ThreadPhased_BlockDecoderMemorySizeNeeded
Oodle_CheckVersion
Oodle_GetConfigValues
Oodle_LogHeader
Oodle_SetConfigValues
Oodle_SetUsageWarnings
Name
.text
Size
815KB
Virtual Size
814KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=41, id=225, version=20806,
count=109, id=224, version=20806,
count=11, id=223, version=20806,
count=3, id=203, version=65501,
count=81, id=1, productName=Unmarked objects,
count=83, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=9, productName=Unmarked objects (old),
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,