Fortilogger-4.4.2.zip
- SHA256 9234d4bbb928e0d5f2772704a68b9f82d464a6ba0cdc7364bda548d5d0873115
Behavioral task
behavioral1
Sample
Fortilogger-4.4.2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Fortilogger-4.4.2.zip
- Size 37.3MB
- Sample261104-xf68jay14n
- SHA256 9234d4bbb928e0d5f2772704a68b9f82d464a6ba0cdc7364bda548d5d0873115
- MD5 e6af5fd380daf77a2f177563b6be530a
- SHA1 c973faff5ed773a4461bcc9f6b27d111b723cc5a
- SHA512 42dc52fe0cfc03880a50ccdd34518856cdb1aa6e5cf1059c9ce367a507930d09088a475f7722352572318ec50076540c1e2bf7fd2afb3330728a306146a7cfbb
- SSDEEP 786432:tNZrg6ToP0aeL4/YrdJAId00y+TF/tsGLFpT3Sdhz9AQ6DC7:3dgPsaeL4M0z0y8/2gP+bZAFe7
- TLSH T1A3873334773C069B5C83B37345B74F8AC950E0DA9D0DD8AACE8E829ABADC46358D750D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/Fortilogger-4.4.2.exe - Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
resource yara_rule static1/unpack001/Fortilogger-4.4.2.exe innosetup
File Explorer
-
Fortilogger-4.4.2.zip.zip 37.3MB
-
Fortilogger-4.4.2.exe.exe 38.2MB
Fortilogger-4.4.2.exe
- IMPHASH eb5bc6ff6263b364dfbfb78bdb48ed59
- SHA256 9c7fc3a1b2fdb0ca9d14cb561843abe8ab9e8e5cb5a08e9b3f160c498db0632a
- MD5 5a30eb9cf2c1e5c281480b73c9815900
- SHA1 ea767ced43c86f24d193b9b42a86b6a506febe2c
- SHA512 e849425ecdccc1231c08a96c2bb12da6e1e9ead50ad18c7448d4135041c29a9b224034c3e08c2bc5b129cdf7cbd9a3fcc4f2674bef6eb0b44f9b904851df6917
- SSDEEP 786432:sBDBy69eDaye5DxTSQzzTo2MCoXMAghuAf12MTYp+DVyl/KYQ:yty1eyelxl3JzoXMAghXd2lcJydvQ
- TLSH T16D973367F10881FED48A733605B74C44E0FE719AB90DAD8A2DD9C1DDCB690936DB2638
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Digest
1c:4a:ad:10:47:b0:71:6e:0a:f9:3d:84:cb:d5:d4:32:d9:bc:c0:74
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=RZK MUHENDISLIK ve BILGISAYAR SISTEMLERI LTD. STI.,O=RZK MUHENDISLIK ve BILGISAYAR SISTEMLERI LTD. STI.,POSTALCODE=06530,STREET=NO:3/48-49-50-51+STREET=KIZILIRMAK MAHALLESI+STREET=ANKARA TICARET MERKEZI A BLOK,L=Ankara,ST=Ankara,C=TR
Chains
Aug 12, 2020
CN=RZK MUHENDISLIK ve BILGISAYAR SISTEMLERI LTD. STI.,O=RZK MUHENDISLIK ve BILGISAYAR SISTEMLERI LTD. STI.,POSTALCODE=06530,STREET=NO:3/48-49-50-51+STREET=KIZILIRMAK MAHALLESI+STREET=ANKARA TICARET MERKEZI A BLOK,L=Ankara,ST=Ankara,C=TR
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Subject
CN=RZK MUHENDISLIK ve BILGISAYAR SISTEMLERI LTD. STI.,O=RZK MUHENDISLIK ve BILGISAYAR SISTEMLERI LTD. STI.,POSTALCODE=06530,STREET=NO:3/48-49-50-51+STREET=KIZILIRMAK MAHALLESI+STREET=ANKARA TICARET MERKEZI A BLOK,L=Ankara,ST=Ankara,C=TR
Serial Number
47:e3:df:25:f9:a4:f2:cc:7e:e5:62:0a:ac:82:cd:37
Issuer
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2019 - Apr 28, 2022
Subject
CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Issuer
CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 2, 2018 - Dec 31, 2030
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
6
Entry point
687824
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
660KB
Virtual Size
660KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ