Malware Analysis - 3CX SmoothOperator Authenticode Abuse
Channel: MalwareAnalysisForHedgehogs
Date: 2023-04-05

SmoothOperator abuses Microsoft Authenticode signatures to seem valid. Here is an explanation how it works and how to detect it in files.

My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

AnalysePESig: https://blog.didierstevens.com/programs/authenticode-tools/

SigFlip: https://github.com/med0x2e/SigFlip

Sysinternals: https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

Using unauthenticated data inside authenticode signed binaries: https://web.archive.org/web/20150426192725/http://blogs.msdn.com/b/ieinternals/archive/2014/09/04/personalizing-installers-using-unauthenticated-data-inside-authenticode-signed-binaries.aspx

Samples:
3CXDesktopApp.msi: https://tria.ge/230330-3nzfjshc2s
ffmpeg: https://bazaar.abuse.ch/sample/7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896
d3dcompiler_47.dll: https://bazaar.abuse.ch/sample/11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03

00:00 Intro
00:37 Signature verification
02:09 SigFlip and SigLoader
03:05 Ways to hide data in authenticode structures
06:00 Detecting hidden authenticode data
08:11 Why this still works
09:05 Outro

#malware #malwareanalysis #reverseengineering #3cx #authenticode