{
  "content": "Search Free Trial Get Demo PEMPEMPEM  Hiding Behind Fake Certificates! August 3, 2020 Over the years, enterprise security teams and threat actors have been involved in a never-ending game of cat and mouse. Organizations pour millions of dollars to stop advanced threats, but threat actors continue finding ways to evade detection by either enhancing their code or simply repackaging malware in more ways than one. This blog discusses the use of multiple components, including the use of legitimate software and encryption to deliver malware in a new manner. A few days ago, we received samples, which contained components that include a file that looked like Privacy Enhanced Mail PEM certificates. PEM certificates are Base64 encoded Distinguished Encoding Rules DER certificates and are frequently used for web servers because they can easily be translated into readable data with the use of a text editor. A PEM certificate can be identified by the presence of a header and footer, which envelopes a Base64 encoded data, just as the sample below Figure 1.0 PEM Certificate Sample This component, however, although enveloped with the PEM header and footer, includes a large amount of Base64 encoded data, which the main executable decodes using Windows cerutil.exe command line utility. Figure 2.0 Fake PEM Sample The decoded data reveals a heavily obfuscated AutoIt script containing encrypted x86 code used as a loader module to decrypt the main malware payload  in this case tempvFaqy.com  from the main executable, which is finally injected to another host process. Figure 3.0 Decoded Fake PEM revealing heavily obfuscated AutoIt script Figure 3.1 Deobfuscated Autoit Script With this information, we can use Autoit Script Debugger together with Win32dbg to extract the main payload. The script checks if the Windows platform is 32bit or 64bit. It will then use a specific set of shellcode for the determined platform to decrypt the payload. Figure 3.2 Function containing the platform and shellcode Then it will use a second shellcode to inject the payload to dllhost.exe. Figure 3.3 Code snippet of 2 nd shellcode Analysis of the injected code reveals that this payload is a variant of Vidar , a supposed copyfork of the Arkei family of Stealer Trojans. This malware family has existed since late 2018, and this variant does not have distinguishable changes from its v4.1 functionality which was analyzed and documented 2 years ago. Looking into other samples that we have detected with AU3Injector.A.gen!Camelot, we saw at least 2 types of malware packages, one using NSIS and another using CABSFX . These samples are from different malware families, indicating of a new attempt of packaging malware to evade detection with the use of multiple components and supposedly benignlegitimate applications. Shown below is the execution tree to show the overview of how the malware payload is installed into a system. We did a little digging to see which malware families are packaged with this multi-component obfuscation and below is a histogram of samples seen over the month of July. And below is the distribution of malware families using this obfuscation and a list of extracted IOCs. Indicators of Compromise IOCs SHA256 Cyren Detection Remarks 3dd24bfc6728959f084de536645e2bd20318e4a709b41cddb9245147922da1d0 AU3Injector.A.gen!Camelot Vidar Malware Package a23bb96f26b3c9f3fd5e3bcde7bd3281316ff75ead540e5f337e3967db1159bf W32Agent.BRT.gen!Eldorado Injected Vidar executable 971df5d381b1745f50b3b0a06daefe6cf96744c57f2fb9582840a4d02842f755 AU3Injector.A.gen!Camelot Agent Malware Package Like what you read in this blog? Cyren gathers actionable intelligence  like the IOCs above  by analyzing and processing billions of daily transactions in Cyren GlobalView Threat Intelligence cloud. By correlating insights gathered across email content, web traffic, and suspicious files Cyren provides security teams with a multi-dimensional presentation of critical threat characteristics. Powered by GlobalView, Cyren Threat InDepths contextualized threat intelligence allows enterprise security teams to gain unique visibility into evolving email-borne threats and make meaningful decisions to combat them. Learn more . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Microsoft Finally Acknowledges COVID-19-Related Cybercrimes Anatomy of a Phishing Attack Stolen Microsoft 365 Credentials Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_results": {
    "metadata": {
      "timestamp": "2025-02-05T22:42:14.305988",
      "model": "deepseek/deepseek-r1-distill-llama-70b",
      "categories": [
        "product_security_features",
        "threat_prevention",
        "incident_response",
        "technical_documentation"
      ],
      "content_length": 4551,
      "analyses_included": {
        "product_analysis": true,
        "user_guidance": false
      }
    },
    "analyses": {
      "comprehensive": "### Comprehensive Analysis of the Provided Security-Related Content\n\n#### 1. **Key Security Features and Their Benefits to Users**\n   - **Advanced Threat Detection and Analysis**: The blog highlights the use of tools like **AutoIt Script Debugger** and **Win32dbg** to analyze obfuscated scripts and extract malware payloads. This demonstrates the ability to identify and unpack sophisticated threats, providing users with insights into how malware operates.\n   - **Threat Intelligence and Indicators of Compromise (IOCs)**: The content provides specific SHA256 hashes and malware family identifiers (e.g., `AU3Injector.A.gen!Camelot`, `Vidar`), which are critical for organizations to detect and block known threats. This helps users improve their threat detection capabilities.\n   - **Multi-Layered Malware Analysis**: The analysis breaks down the malware execution process, from initial delivery using fake PEM certificates to payload injection into legitimate processes (e.g., `dllhost.exe`). This multi-layered approach helps users understand the attack chain and improve their defenses.\n   - **Threat Intelligence Cloud (GlobalView)**: The blog mentions Cyren's GlobalView Threat Intelligence Cloud, which processes billions of transactions to correlate insights from email, web traffic, and suspicious files. This provides users with a comprehensive view of threats and enables proactive security measures.\n\n#### 2. **Compliance Certifications and Regulatory Adherence**\n   - The provided content does not explicitly mention compliance certifications or regulatory adherence (e.g., GDPR, HIPAA, ISO 27001). However, the emphasis on actionable threat intelligence and indicators of compromise suggests alignment with industry best practices for threat detection and response.\n   - To strengthen this area, the content could include references to specific compliance frameworks or standards followed by the organization, ensuring that users understand how the solutions meet regulatory requirements.\n\n#### 3. **User-Focused Security Recommendations**\n   - **Monitor for Suspicious Activity**: Users should monitor for unexpected Base64-encoded files or unusual activity related to legitimate system utilities like `cerutil.exe`.\n   - **Block Known IOCs**: Use the provided SHA256 hashes and malware identifiers to update security systems and block known malicious files and processes.\n   - **Use Advanced Antivirus Solutions**: Employ antivirus software that can detect obfuscated scripts and multi-component malware packages.\n   - **Regular System Audits**: Conduct regular audits to identify and remove malicious files or processes that may have evaded detection.\n   - **Employee Training**: Educate users about the risks of phishing and malicious files, as many advanced threats rely on social engineering to gain initial access.\n\n#### 4. **Technical Security Implementation Details**\n   - **Malware Delivery Mechanism**: The blog explains how attackers use fake PEM certificates to deliver malware. These certificates are structured like legitimate ones but contain obfuscated scripts instead of valid encryption data.\n   - **Decoding and Execution**: The malware uses the Windows `cerutil.exe` utility to decode Base64 data, which is then executed as an obfuscated AutoIt script. This script acts as a loader to decrypt and inject the main payload into a legitimate process.\n   - **Platform-Specific Shellcode**: The script checks the system architecture (32-bit or 64-bit) and uses corresponding shellcode to decrypt and inject the payload, demonstrating advanced evasion techniques.\n   - **Injecting into Legitimate Processes**: The payload is injected into `dllhost.exe`, a legitimate Windows process, to blend in with normal system activity and avoid detection.\n\n#### 5. **Data Protection Measures**\n   - **Encryption Awareness**: The blog highlights the misuse of encryption by attackers to hide malicious payloads. Organizations should ensure that encryption is used appropriately and that encrypted data is scanned for malicious content.\n   - **Secure Certificate Handling**: Users should verify the legitimacy of PEM certificates and other encryption-related files before trusting them.\n   - **Behavioral Analysis**: Implement solutions that monitor process behavior to detect anomalies, such as legitimate processes executing unexpected or malicious code.\n   - **Network Traffic Monitoring**: Monitor web traffic for suspicious downloads or communications, especially those involving known malicious domains or URLs.\n\n#### 6. **Best Practices for End Users**\n   - **Avoid Unsolicited Downloads**: Do not open or execute files from untrusted sources, as they may contain hidden malicious components.\n   - **Keep Software Updated**: Ensure all software, including operating systems and security tools, is up to date to protect against known vulnerabilities.\n   - **Use Strong Antivirus**: Employ antivirus solutions that can detect and block obfuscated scripts and multi-component malware.\n   - **Enable Advanced Security Features**: Turn on features like script blocking, process monitoring, and behavioral analysis in security software.\n   - **Regular Backups**: Maintain regular backups of critical data to ensure recovery in case of a malware attack.\n\n### Conclusion\nThe blog provides a detailed analysis of how attackers use legitimate tools and encryption to deliver sophisticated malware. It emphasizes the importance of threat intelligence, advanced detection mechanisms, and user education. While the content is technically rich, it would benefit from additional information on compliance certifications and regulatory adherence to provide a more comprehensive security overview. By following the recommendations and best practices outlined, users can significantly enhance their cybersecurity posture and reduce the risk of falling victim to similar attacks.",
      "product": "**Analysis of Product Security Features Based on Threat Detection and Response Solution**\n\n**1. Key Security Features:**\n\n- **Threat Detection:** The product excels in identifying hidden malware, such as those using fake PEM certificates, through advanced detection mechanisms.\n- **Behavioral Analysis:** Monitors system activities to detect abnormal behavior indicative of malicious intent.\n- **Threat Intelligence:** Leveraging global threat data to recognize known threats andstay updated on emerging ones.\n- **Sandboxing and Analysis:** Isolates suspicious files for in-depth analysis, crucial for identifying obfuscated scripts.\n- **Deep Packet Inspection (DPI):** Inspects traffic to detect encrypted malicious payloads.\n- **Encryption Detection:** Identifies legitimate tool misuse for malicious purposes.\n- **Integration Capabilities:** Connects with various security tools for comprehensive protection.\n- **Incident Response:** Offers tools and insights to combat detected threats effectively.\n- **Metadata Analysis:** Examines file attributes to uncover hidden threats.\n\n**2. User Benefits:**\n\n- **Real-Time Threat Detection:** Provides immediate alerts and blocking of suspicious activities.\n- **Data Breach Prevention:** Protects sensitive data from exfiltration through continuous monitoring.\n- **Actionable Intelligence:** Delivers specific IOCs and insights for informed security decisions.\n- **Compatibility:** Seamlessly integrates with existing security infrastructure.\n- **Proactive Defense:** Stays ahead of evolving threats with intelligence-driven strategies.\n- **Compliance Support:** Ensures adherence to regulations, simplifying compliance efforts.\n\n**3. Integration with Existing Systems:**\n\n- **SIEM/SOAR Compatibility:** Enhances incident response and threat hunting with these platforms.\n- **Firewalls and Email Gateways:** Blocks malicious traffic and emails based on threat intelligence.\n- **Endpoint Solutions:** Bolsters endpoint protection with shared intelligence.\n- **MDR Services:** Works alongside managed services for ongoing threat monitoring.\n\n**4. Compliance and Certification:**\n\n- **Regulatory Compliance:** Supports GDPR, CCPA, and HIPAA with data protection features.\n- **Industry Certifications:** Adheres to standards like SOC 2 and ISO 27001.\n- **Data Handling:** Ensures secure processing of sensitive data, crucial for compliance.\n\n**5. Security Best Practices:**\n\n- **Regular Updates:** Keep software updated to protect against new threats.\n- **Monitoring:** Continuously monitor for suspicious activities.\n- **Training:** Educate users on phishing and safe computing.\n- **RBAC:** Limit access to sensitive data.\n- **Patches and MFA:** Apply patches and use multi-factor authentication to enhance security.\n- **Backups:** Regular data backups to mitigate ransomware impact.\n\n**6. Technical Specifications:**\n\n- **OS Support:** Compatible with Windows, Linux, and macOS.\n- **Virtual Environments:** Supports virtualization for comprehensive protection.\n- **API Integration:**Facilitates integration with security tools through APIs.\n- **Deployment Flexibility:** Available for on-premises and cloud environments.\n- **Scalability:** Adapts to varying organizational sizes and needs.\n- **Log Analysis and Threat Hunting:** Provides tools for deeper investigation and proactive threat seeking.\n\nThis structured approach ensures clarity and effectiveness in understanding how the product addresses security needs, offering both technical prowess and user-friendly benefits.",
      "user_guidance": null
    }
  },
  "metadata": {
    "timestamp": "2025-02-05T22:42:14.305988",
    "model": "deepseek/deepseek-r1-distill-llama-70b",
    "categories": [
      "product_security_features",
      "threat_prevention",
      "incident_response",
      "technical_documentation"
    ],
    "content_length": 4551,
    "analyses_included": {
      "product_analysis": true,
      "user_guidance": false
    }
  }
}