A signed “Funding Application Form” that hands your desktop to a plugin RAT

About this post: Thanks to MalwareHunterTeam for flagging this sample. This analysis and write-up were produced by Claude (Opus 5.5), working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat, KesaKode, Python (pefile, cryptography, lz4), speakeasy, Ghidra, capa, ANY.RUN, Deception Pro, Triage and tshark.

TL;DR

Funding Application Form.exe poses as a business form. It carries a valid Extended Validation (EV) signature from 松原市球记网络科技有限公司 (a Songyuan, Jilin company). When opened, it shows a convincing bilingual “Merchant Order and Funding Details Form” PDF, and behind it starts a chain of four stages that ends in a remote-access trojan (RAT) with plugins. The server was live in both of our sandbox runs. In a short public run it sent four plugins within a minute. In a longer run in a deception sandbox, a human operator came back, pushed four more plugins, watched the screen, listed the browsers, browsed the user’s files and closed the decoy PDF.

• Signed: Certum EV certificate, serial 3538cc642d4c910e8ebb661b9b4fe253, file built on 1 November 2026.
• Borrowed trust: the dropper runs a genuine 2012 Ubisoft-signed DirectX tool, which loads a malicious DLL placed next to it.
• Small stager, big payload: 21 KB of shellcode downloads a 710 KB RAT core from 192[.]238[.]177[.]20:7720.
• Plugins on demand: eight plugins in total: keylogging, clipboard replacement, screen viewing, a hidden desktop, browser-data theft, a file manager, system management with a UAC bypass, webcam capture and a stealthy scheduled task.
• Unattributed: the code doesn’t match a known family closely enough to name it. A sandbox “DanaBot” label turned out to be a false match.

But it’s signed!

A brand-new certificate that is immediately used to sign someone else’s product is a pattern we see again and again with signed malware. Code signing is like a sealed envelope with the sender’s name on it: it tells you who sent the file and that nobody changed it afterwards. It says nothing about whether what’s inside is safe.

This certificate was issued in March 2026 to a Jilin company whose name has nothing to do with funding forms. It has been reported to the CA and added to the CertGraveyard.

A form that unpacks itself

The program itself is tiny, about 24 KB of code. Almost all of its 3.6 MB is a resource that looks like random noise. That resource is an encrypted package: the dropper decrypts it with ChaCha20, decompresses it with LZ4, and finds three files inside plus about 3 MB of random padding that is never used. Padding like this mostly serves to make the file bigger and its contents harder to scan.

The developer left function names in the file, which made the job easier. They also show what the dropper can do beyond what this build uses. It has five ways to start its payload, including registering a fake COM object in the registry and asking Explorer to open it, so the payload appears to be started by Explorer instead of by the dropper. This build simply uses the plain option: “open this file”.

The three files it writes:

• a decoy PDF in a randomly named folder under %LOCALAPPDATA%, which it opens right away;
• worksvc.exe and GameuxInstallHelper.dll in %LOCALAPPDATA%\hvyfyg1i\.

The decoy is a clean, two-language (English and Chinese) form asking for company details, bank name, IBAN, SWIFT code and deposit amounts. It contains no scripts or links. Its job is to give the victim something to look at while the rest happens.

The Ubisoft tool that loads the wrong DLL

worksvc.exe isn’t malware. It is GDFInstall, a sample program from Microsoft’s DirectX SDK, signed by Ubisoft in 2012. It expects to find a helper library named GameuxInstallHelper.dll in its folder and loads whatever file has that name.

That’s DLL side-loading: the attacker puts a legitimate, signed program next to a malicious DLL with the name it expects. Think of a trusted courier who picks up whatever parcel has the right label on it. Security tools see a signed Ubisoft program starting up; the malicious code runs inside it.

The fake DLL first runs a few checks before it does anything:

• If Windows is in test-signing mode (common on analysis machines), it shows a fake “Initialization failed. Please reinstall.” error.
• If memory load is above 94 % and the machine booted less than 10 minutes ago, it does the same.
• If the program wasn’t started with the argument -Embedding, it shows a Chinese message: “缺少必要的参数。请通过命令行启动。” (“Missing required parameter. Please start from the command line.”) The dropper always passes that argument, so this mainly stops someone who double-clicks the file by itself.

When everything passes, it decrypts 21 KB of shellcode (raw machine instructions that run straight from memory, with no file on disk) by reversing the bytes and XORing them with the key kk2lUX0BrlxOnSFs. It doesn’t start the shellcode the usual way. Instead it hands it to the Windows function that lists installed locales, which calls it back as if it were a normal helper function.

A stager that phones home

The shellcode is a stager: its only job is to fetch the real program. Its configuration sits after the marker mark_start and a quote from Hamlet (“There are more things in heaven and earth, Horatio…”). It holds three server slots, all pointing to 192[.]238[.]177[.]20:7720, a campaign tag 150826 and a bot ID.

It sends the server a 97-byte hello that includes the version of any module it already has. The server answers either “use what you have” or “here is a new module” with its size. The module is saved to C:\ProgramData\s_x86_<ID>_<n>.dat with its version in a matching h_x86_…dat file, so a later start can skip the download.

The RAT and its plugins

In the sandbox, the server sent a 710 KB module. It’s a set of nesting dolls: a small loader, then ReflectionDllLoad_x86.dll, which loads a DLL straight from memory, and finally x86Server.dll, the RAT core.

The core talks to the same server over its own simple protocol. Every message has a 25-byte header followed by data XORed with a 16-byte key and compressed with LZ4. With that key we decrypted the RAT sessions in the sandbox traffic, which showed what the server actually did.

The core does very little alone. Its real features come as plugins, each a DLL with a CreatePluginServer function:

• MainBussinessServer (sic): a keylogger with key names written in pinyin, like [shanchu] for delete; clipboard replacement, the trick crypto stealers use to swap a copied wallet address for the attacker’s own; and a list of running security products (360, Huorong, Kingsoft, Tencent, McAfee, Norton) and messengers (QQ, Skype). The code is there; we didn’t see the keylogger or clipboard swap used in the traffic.
• StartupItemServer: persistence, covered below.
• RemoteScreenServer: a live view of the victim’s screen.
• HiddenDesktopServer: a hidden desktop, often called HVNC: a second, invisible Windows desktop where the operator can open programs, such as a browser with the victim’s logged-in sessions, without the victim seeing anything. When a session opens, the RAT starts a new explorer.exe to serve as that desktop.

In the short public run, all four arrived within a minute of the first check-in, which looks like an automatic welcome package for new victims. The other four plugins only showed up once a person took over, as described below.

The internal names, the pinyin key labels and the Chinese error message point to a Chinese-speaking developer, but that is about all we can say. Malcat’s KesaKode found a 22.5 % code overlap between the core and PseudoManuscrypt, which is too low to call it that family.

Persistence via a hidden schedule and LuaJIT

The persistence plugin works hard to stay out of sight. Its first choice is a scheduled task created through a lesser-known part of Windows Task Scheduler that fires on internal system events (WNF notifications) and is stored under …\Schedule\WP\TaskScheduler\Schedules\ in the registry. Normal boot-time tasks and a Startup-folder shortcut are kept as backups.

In the sandbox, the chain it built was:

1. The plugin downloads hxxp://192[.]238[.]177[.]20:7858/dcd, adds a few random bytes so every copy has a different hash, and saves it as a DLL in C:\ProgramData\F6D9F4FE\, together with a file named goufu.txt and a small LuaJIT kit it carries inside itself.
2. The task runs wscript.exe C:\ProgramData\F6D9F4FE\12226198.vbs.
3. The VBS starts 12226198.exe, a LuaJIT runner, with a Lua script disguised as 12226198.jpg. The script runs the DLL with rundll32 … ,#1 MyCustomParam123; it can also download a fresh copy itself.
4. That DLL refuses to run without the argument MyCustomParam123. It reads shellcode from goufu.txt and runs it, which most likely starts the RAT again.

The LuaJIT runner and its library carry a valid signature from Sangfor Technologies, a Chinese security vendor. They appear to be genuine Sangfor files: like the Ubisoft tool earlier, the attacker borrows someone else’s trusted program to run their code.

Folder and file names such as F6D9F4FE and 12226198 are generated for each install, so don’t rely on them as indicators.

The operator comes back

A public sandbox gives you a few minutes. To see what happens after that, we also ran the sample for much longer in a deception sandbox: a realistic-looking machine with a user, documents and browsers, where the attacker is free to act. For this, we use Deception.Pro.

The server answered right away and sent the same core and the same first plugins, byte for byte, plus the same persistence DLL. Then it went quiet. Within the hour, a person took over. Over the next half hour they:

• opened the live screen view several times and watched the desktop;
• sent WebDataServer and got back a list of the user’s browser profiles (Edge and Chrome), including whether Telegram or WhatsApp Desktop was present;
• sent FileMgrServer, listed the drives and browsed the user’s Recent files and Desktop. We saw only folder listings go back, no file contents;
• sent SystemMgrServer, pulled the list of running programs and open windows, and then closed the window showing the decoy PDF;
• sent CameraServer, which loads Windows’ video-capture library to read from a webcam.

Closing the decoy is a small but telling step: it’s someone tidying up so the victim doesn’t keep staring at a strange form.

What the four new plugins can do, from their code:

• WebDataServer steals browser data. It packs the profile folders of Chrome, Edge, Brave, Firefox and the Chinese 360 browsers into a zip. Files the browser keeps locked are copied through a Volume Shadow Copy, a Windows backup snapshot, and if anything is still missing it simply kills the browsers and tries again. It can also read and plant cookies, which lets the operator take over logged-in sessions without a password.
• FileMgrServer is a file manager that can also run files. It contains a UAC bypass: a trick to get administrator or SYSTEM rights without the usual “Do you want to allow…” prompt, here by abusing a built-in Windows component that is allowed to elevate itself, and SystemSettingsAdminFlows.exe.
• SystemMgrServer lists running programs and open windows, can close windows, manages Windows services (start, stop, delete), and carries the same UAC bypass.
• CameraServer records from the webcam through DirectShow.

Not DanaBot

ANY.RUN tagged the run as DanaBot. We checked why: the tag came from two generic rules, a mutex rule that matched Global\CreateWorld_150826 and a file-path rule for hex-named DLLs in C:\ProgramData. 150826 is this kit’s own campaign tag from the stager config. Nothing in the decrypted code or traffic looks like DanaBot, so we treat this as unattributed. Sandbox family tags are a useful lead, but they’re worth checking against the code.

What we couldn’t see

• We didn’t get the contents of goufu.txt. It wasn’t in either network capture, and in the longer run the persistence task hadn’t fired yet when this post was written. Given the loader around it, it is most likely the shellcode stager again.
• The RAT core has many more commands than the traffic used. We decoded the plugin traffic instead of mapping every command.
• Two smaller 64-bit programs are embedded in the hidden-desktop plugin. We extracted and hashed them but didn’t reverse them.
• The four new plugins are described from their strings and the traffic we saw; we haven’t fully reversed them yet.

Advice

For everyone: a “funding form”, “invoice” or “order form” that arrives as an .exe isn’t a document, even when a real PDF opens afterwards. Documents don’t need to be programs. A valid signature with a company name isn’t a safety stamp either. If you did run something like this, assume your browser sessions are compromised: sign out everywhere and change your passwords from a clean device.

For defenders:

• Block 192[.]238[.]177[.]20.
• Hunt for GameuxInstallHelper.dll loaded by a Ubisoft-signed GDFInstall program from a user folder, and for worksvc.exe -Embedding.
• Look for rundll32 with ,#1 MyCustomParam123, wscript.exe started by Task Scheduler from C:\ProgramData\<8 hex>\, and files named C:\ProgramData\h_x86_*.dat / s_x86_*.dat.
• Check HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\WP\TaskScheduler\Schedules\ for entries that launch scripts.
• Watch for PowerShell creating shadow copies (Win32_ShadowCopy) from a user process, and for qcap.dll loaded by an unexpected program.
• Treat files signed with serial 3538cc642d4c910e8ebb661b9b4fe253 as malicious.

Indicators of compromise

Public sandbox run: ANY.RUN.

That’s it for this one. A signed form, a borrowed Ubisoft signature and a RAT whose features arrive one plugin at a time show how much can hide behind one double-click, and how much more a patient operator does once the sandbox clock stops ticking. Stay safe, and if you have other samples signed by this company, we’d love to see them.