Fake Chinese PDF App Delivers ValleyRAT to Jordan's Food Sector
A 1.6 MB Windows executable posing as '极光PDF' (Aurora PDF) uses an expired DigiCert-rooted code-signing certificate to slip past trust checks before staging ValleyRAT shellcode in memory. The campaign targets food and beverage organisations in Jordan and beacons to a Hong Kong Cogent Communications server hiding behind an OpenSSL placeholder certificate.
A Fake Chinese PDF App Carries ValleyRAT Into Jordan's Food Sector
A 1,649-kilobyte Windows executable named kvipgui.exe — dressed as "极光PDF" (Aurora PDF), a plausible Chinese productivity application — has been circulating as a ValleyRAT shellcode runner targeting food and beverage organisations in Jordan, according to CTX Team analysis. The binary's most immediate deception is structural: it carries a DigiCert-rooted code-signing certificate issued to Shanghai entity 茉柏枘（上海）软件科技有限公司 that expired on 30 May 2024, yet the PE timestamp reads 29 April 2024 and the actual signing date was 28 March 2023 — placing the act of signing squarely within the certificate's validity window while ensuring the chain would fail verification by the time the sample reached its targets. The combination of a plausible Chinese software identity, an expired-but-authentic-looking certificate, and a layered anti-analysis stack designed to defeat automated sandboxing marks this as a disciplined, operationally deliberate intrusion effort — one whose C2 node, a Hong Kong-geolocated Cogent Communications server presenting an OpenSSL installation-default placeholder certificate, is itself engineered to resist reputation-based detection.
The Expired-Certificate Masquerade: How the Trust Illusion Is Constructed
The evasion story begins at the file's outer shell. kvipgui.exe (SHA-256: d208b80a6608c72c3c590f86d93b074533c0c4ef8a46b6d36ed52cc2b4c179d5) presents a complete, structurally valid code-signing chain rooted in DigiCert — a certificate authority whose name alone carries significant trust weight in enterprise Windows environments. The leaf certificate was issued to 茉柏枘（上海）软件科技有限公司, a Shanghai-registered software entity, under DigiCert SHA2 Assured ID Code Signing CA (serial 01 7E F8 2E 32 31 A5 BB 49 77 B5 63 C4 DD 25 43). The certificate's validity window ran from 26 May 2021 to 30 May 2024 — a three-year span that encompasses the 28 March 2023 signing date. The intermediate and root certificates in the chain remain valid well beyond 2024.
What makes this a deliberate masquerade rather than an oversight is the timing geometry. The PE timestamp of 29 April 2024 places the binary's apparent build date one month before the leaf certificate expired. The first submission to threat-intelligence platforms was recorded on 12 May 2024 — twelve days before expiry. An operator who simply reused an old signing key carelessly would not produce this pattern; the narrow gap between the PE timestamp, the certificate expiry, and the first submission suggests the binary was built and deployed in a window calculated to maximise the period during which the certificate would still appear valid to cursory inspection, while accepting that the chain would fail strict validation after 30 May 2024.
VirusTotal's tag set captures the contradiction precisely: both signed and invalid-signature are present on the same sample. The signing verdict reads: "The digital signature of the object did not verify." — specifically because the leaf certificate is no longer time-valid. Yet the presence of a DigiCert-rooted chain, a recognisable Chinese software publisher name, and a product version string (2023.3.28.685) consistent with a real software release cycle creates exactly the kind of superficial legitimacy that passes in environments relying on allowlist logic rather than full chain validation. The masquerade technique maps directly to T1036.001 (Masquerading: Invalid Code Signature), and the operator's choice of a Chinese-language product identity — "极光PDF", copyright 茉柏枘（上海）软件科技有限公司 — is calibrated for environments where Chinese-language productivity software is expected and unremarkable.
The product metadata reinforces the lure. The file version string, the copyright notice, and the original filename kvipgui.exe collectively present as a versioned software release from a named Chinese company. In a food and beverage organisation with Chinese-language software in its supply chain or employee base, this binary would attract little immediate suspicion from a user who encountered it as an installer or update package.
Detection across the broader engine landscape is strong but not universal: 53 of 77 engines flag the sample as malicious. Among those still missing it are SentinelOne, Webroot, Gridinsoft, Xcitium, and ZoneAlarm — a gap that matters operationally, since any of these could be the primary endpoint control in a targeted organisation's stack. The 19 engines returning clean verdicts represent a meaningful residual blind spot, particularly given that the sample has been in circulation since May 2024.
Three Layers of Anti-Analysis: Defeating the Sandbox Before the Payload Runs
Before executing its primary payload, the binary runs a systematic anti-analysis gauntlet that CTX Team's tradecraft analysis labels as one of the campaign's defining operational characteristics. The three layers — debugger detection, WMI-based environment probing, and long-sleep timing delays — are documented directly in the sample's VirusTotal tag set: detect-debug-environment, calls-wmi, and long-sleeps all appear alongside the malicious classification tags.
The first layer, debugger detection [T1622], is a standard but effective control: the binary checks for the presence of a debugging environment before proceeding, abandoning or altering its execution path if one is detected. This alone would defeat a significant proportion of interactive analysis sessions. The second layer uses Windows Management Instrumentation queries [T1497.003] to probe the execution environment — querying system properties, hardware identifiers, or installed software in ways that allow the binary to distinguish a real workstation from a virtualised analysis sandbox. WMI-based environment fingerprinting is harder to defeat than simple debugger checks because it queries the host's hardware and configuration fabric rather than process-level indicators.
The third layer — long sleep intervals inserted into the execution flow — is the most effective against time-bounded automated sandboxes. Most automated analysis environments impose a maximum execution window, typically measured in minutes. A binary that sleeps for longer than that window will appear to do nothing and receive a clean or inconclusive verdict. The practical result is visible in the sandbox consensus data: of two sandbox environments that processed this sample, only one — Dr.Web vxCube — returned a malicious verdict. The C2AE sandbox returned UNKNOWN_VERDICT, consistent with the long-sleep evasion succeeding against its time limit. A 50% sandbox evasion rate on a sample that 53 of 77 static engines flag as malicious is a meaningful operational advantage: it undermines the dynamic analysis layer that many organisations rely on to catch threats that evade signature-based detection.
The combination of these three techniques reflects a threat actor that understands the architecture of automated malware analysis pipelines and has tuned its evasion stack accordingly. This is not a commodity dropper that happens to use one evasion technique; it is a binary where the anti-analysis logic appears to have received deliberate engineering attention. The partial sandbox evasion outcome — one environment fooled, one not — is consistent with a real-world deployment scenario where the operator accepts imperfect evasion against the full range of analysis environments in exchange for defeating the specific tooling most likely to be deployed in the target sector.
The Sigma rule set also registered hits against this sample: three Sigma rules fired, two at medium severity and one at low severity, indicating that the behavioural patterns the binary exhibits are sufficiently anomalous to trigger heuristic detection logic even when the specific malware family is not directly identified.
In-Memory Shellcode Staging and the ValleyRAT YARA Confirmation
Once the binary has satisfied itself that it is running on a real host, the execution stage begins. The popular name shellcoderunner recorded for this sample describes the mechanism accurately: the binary stages and executes shellcode in memory [T1055], avoiding the creation of secondary files on disk that would generate filesystem artefacts. This in-memory execution model is characteristic of ValleyRAT's loader stage, and the connection to ValleyRAT is confirmed directly by the YARA rule malware_valleyrat_strings_config, authored by Sekoia.io and described as matching "ValleyRAT strings based on HIVE KEYS and config." This rule fires on the sample, establishing that the binary contains configuration strings and registry key references consistent with ValleyRAT's operational framework.
The structural features of the PE support the embedded-payload interpretation. The .rdata section is unusually large at 796 kilobytes with an entropy of 4.33 — a profile consistent with a section carrying encoded or compressed embedded data rather than conventional read-only data. The .text section (433 kilobytes, entropy 5.93) and the presence of an overlay in the file structure further suggest that the binary is not simply a standalone executable but a staging vehicle for a secondary payload. The imphash (0c1313ad8ab15eb759879eee181c252e) is recorded, but current evidence is too thin to compare it against peer samples for cross-file clustering.
ValleyRAT is a Windows remote access trojan whose loader architecture separates the initial delivery vehicle from the implant payload, with the loader responsible for environment validation, anti-analysis evasion, and in-memory shellcode staging before handing off to the RAT component. The threat label trojan.lazy/xkcp applied by the detection consensus reflects the multi-name nature of this family — lazy and xkcp appear alongside shellcoderunner in the popular names list, indicating that different analysis pipelines have characterised different aspects of the binary's behaviour.
The YARA rule hit is the single most precise analytical anchor in this dataset. malware_valleyrat_strings_config is a community rule maintained by Sekoia.io in their public GitHub repository, written specifically to match ValleyRAT's characteristic HIVE registry key references and configuration string patterns. Its firing on this sample is not a generic heuristic match but a targeted signature hit against known ValleyRAT artefacts. This places the binary firmly within the ValleyRAT family regardless of the variation in popular names across detection engines.
The threat record for this campaign (CTX ID: CTXjixkimmxy5) attributes the activity to Void Arachne, also tracked under the aliases Silver Fox and "The Great Thief of the Valley," with espionage listed as the sole motivation and Jordan's food and beverage sector as the targeted region and industry. The use of a Shanghai-registered code-signing entity, Chinese-language product metadata, and a ValleyRAT payload is consistent with a China-aligned operator, though current evidence does not establish formal state sponsorship — that inference carries medium confidence and should be read as an analytical assessment rather than a confirmed attribution.
The C2 Node: A Cogent Hong Kong Server Behind an OpenSSL Placeholder Certificate
The command-and-control infrastructure is minimal — a single IP address — but its configuration is analytically rich. The C2 node 154.39.255.141 sits on ASN 174 (Cogent Communications, LLC), geolocated to Hong Kong, within the network block 154.39.192.0/18. Cogent Communications is a major global transit provider, and its Hong Kong presence offers the operator a geographically and jurisdictionally convenient hosting point for infrastructure targeting the Middle East.
The TLS certificate presented by this server is the detail that most clearly signals deliberate operational security through obscurity. The certificate's issuer and subject are both listed as "Internet Widgits Pty Ltd" — the default placeholder identity generated by OpenSSL's certificate creation tooling when no real organisation information is provided. The certificate was valid from 23 February 2020 to 22 February 2023, meaning it expired more than two years before it was last observed active on this IP on 29 January 2025. Serial number f14b4bc3b2c38e58 identifies this specific certificate instance.
The "Internet Widgits Pty Ltd" identity is a well-known OpenSSL artefact: it appears in the default openssl req output when an operator generates a self-signed certificate without customising the subject fields. Its presence on a C2 node is not accidental — it is either the product of a hasty provisioning process where the operator did not bother to configure a convincing certificate identity, or a deliberate choice to use a certificate that is maximally generic and therefore maximally resistant to fingerprinting by certificate-subject-based threat intelligence. Either interpretation points to an operator who understands that TLS certificate metadata is a detection surface and has chosen to minimise its distinctiveness.
The detection ratio for this IP — 5 of 91 engines — is strikingly low given the anomalous certificate configuration. An expired self-signed certificate with an OpenSSL placeholder identity on a server with no legitimate business purpose should, in principle, attract significant threat intelligence attention. The low detection rate suggests the IP is either relatively recent to threat-intelligence feeds, has been actively rotated to avoid reputation accumulation, or benefits from the general under-reporting of Hong Kong-geolocated Cogent infrastructure in some feed sources. The last observed certificate date of 29 January 2025 confirms the node was active well into 2025, more than a year after the certificate it presents expired.
The IDS rule hits against the sample provide the clearest picture of how the C2 channel operates. The Snort registered user ruleset fired on "PROTOCOL-ICMP Unusual PING detected" (medium severity, category successful-recon-limited) and "(http_inspect) invalid request line" (low severity) — two signatures that together indicate the malware uses both non-standard HTTP framing and ICMP as communication mechanisms [T1571]. The ICMP-based component is particularly notable: using ICMP for C2 communication is an established technique for evading network controls that focus on TCP/UDP traffic, and the "Unusual PING" designation in the IDS rule suggests the ICMP packets deviate from standard ping behaviour in ways that triggered the signature. Additional ICMP-related rules — "PROTOCOL-ICMP PING Windows", "PROTOCOL-ICMP PING", and "PROTOCOL-ICMP Echo Reply" — also fired, indicating a pattern of ICMP activity consistent with a C2 beacon rather than routine network diagnostics.
The combination of malformed HTTP and ICMP C2 channels, routed through a Cogent Hong Kong node presenting an expired OpenSSL-default certificate, constitutes what CTX Team's infrastructure analysis labels the "Cogent HK node with self-signed placeholder TLS cert" fingerprint. This fingerprint — ASN 174, TLS issuer/subject "Internet Widgits Pty Ltd", serial f14b4bc3b2c38e58 — is the highest-value hunting pivot in the current dataset, more durable than the file hash alone because infrastructure is slower to rotate than individual binaries.
Host Profiling as Selective Targeting: The Discovery Phase
Following successful execution and C2 establishment, the implant conducts a broad and systematic host profiling operation whose scope suggests the operator is making deliberate decisions about which compromised hosts merit further investment. The discovery technique set documented in the threat record — T1016 (System Network Configuration Discovery), T1012 (Query Registry), T1057 (Process Discovery), T1518 (Software Discovery), and T1518.001 (Security Software Discovery) — collectively describe an implant that is building a comprehensive picture of the host's network position, installed software, running processes, and registry configuration.
Two specific behavioural tags stand out as operationally significant. The clipboard tag indicates the implant is monitoring clipboard content — a technique that can capture credentials, authentication tokens, cryptocurrency addresses, or sensitive business data that passes through the clipboard during normal user activity. In a food and beverage sector context, clipboard monitoring could capture supply chain data, pricing information, procurement credentials, or communications with trading partners. The checks-network-adapters tag indicates enumeration of network interface configuration [T1016], which provides the operator with the host's IP addressing, network topology, and potentially VPN or proxy configuration — information that informs whether the compromised host is a useful pivot point into a broader network.
The spreader tag on the sample is also notable, though its precise meaning in this context requires careful reading: it may indicate the binary contains functionality for lateral movement or self-propagation, or it may reflect a detection heuristic applied by one or more engines based on behavioural patterns. Without additional sandbox detail, this tag should be treated as a signal of potential lateral movement capability rather than confirmed spreading behaviour.
The registry query activity [T1012] and software discovery [T1518] components of the profiling phase are consistent with ValleyRAT's documented operational pattern of enumerating installed security software — the T1518.001 sub-technique specifically covers security software discovery, which would allow the operator to assess whether the target's endpoint protection is likely to detect subsequent stages. This intelligence-gathering function at the discovery stage is characteristic of an operator running a selective, high-value targeting operation rather than a mass-deployment campaign: the profiling data informs a human decision about whether to proceed with full espionage tasking or to abandon the target and move on.
The MITRE technique list for this campaign also includes T1485 (Data Destruction), T1489 (Service Stop), T1070.004 (File Deletion), and T1053.005 (Scheduled Task/Job: Scheduled Task). These techniques are documented in the threat record but are not directly evidenced in the behavioural data from this specific sample — no sandbox output confirms their activation, and they should be read as indicators of the operator's broader toolkit rather than confirmed activity in this intrusion. Their presence in the technique profile means the operator's capability set extends well beyond espionage: if tasked to do so, the same infrastructure and tooling could be redirected toward disruptive impact with minimal retooling. The gap between the espionage posture currently evidenced and the destructive capability latent in the technique set is itself an analytical signal about the operator's intent flexibility.
What the Operational Discipline Signals About This Intrusion Set
The picture assembled from this evidence is of an operator that has invested meaningfully in operational tradecraft at every layer of the kill chain — not just in the payload itself, but in the delivery mechanism, the evasion stack, and the C2 infrastructure configuration. Each layer reflects a specific choice about how to balance operational effectiveness against detection risk.
The expired-certificate masquerade is the most revealing of these choices. Obtaining a fresh, valid code-signing certificate from a legitimate CA for a malicious binary is operationally expensive — it requires either compromising a legitimate certificate holder or establishing a fraudulent entity capable of passing CA vetting. Using an expired certificate that was legitimately obtained during its validity window is cheaper and, crucially, more durable: the certificate's legitimate provenance means it will not appear in CA revocation lists as a known-bad certificate, only as an expired one. In environments that enforce strict chain validation, this distinction matters little. In environments that check for the presence of a recognisable CA name without validating the full chain — a common configuration in organisations that have not hardened their code-signing policy — the expired DigiCert-rooted certificate provides meaningful cover.
The choice of a Chinese-language software identity for the lure is similarly calibrated. "极光PDF" as a product name is plausible, professional-sounding, and consistent with the kind of productivity software a Chinese-language user or an organisation with Chinese business relationships might legitimately install. The version string 2023.3.28.685 follows a date-based versioning convention common in Chinese software products. The copyright notice and signing entity name are consistent with each other and with the product identity. This is not a crude fake; it is a constructed identity designed to withstand casual inspection.
The C2 infrastructure choice — a Cogent Communications node in Hong Kong presenting an OpenSSL placeholder certificate — reflects a different kind of operational calculation. Hong Kong's jurisdictional position, combined with Cogent's status as a major transit provider, makes the IP difficult to block without collateral impact. The placeholder certificate is, paradoxically, a form of operational security through genericness: a certificate with a distinctive subject (a real company name, a specific domain) creates a fingerprint that threat intelligence can track across infrastructure rotations. "Internet Widgits Pty Ltd" creates no such fingerprint — it is the same on every server where an operator has run openssl req without customising the defaults.
The targeting profile — Jordan's food and beverage sector — is the most analytically opaque element of this campaign. Food and beverage organisations are not typical primary targets for sophisticated espionage operations, which raises two possibilities. The first is that the targeting reflects a supply-chain intelligence objective: understanding procurement networks, pricing, trade relationships, or logistics infrastructure in the Middle East region. The second is that a food and beverage organisation in Jordan represents a stepping-stone — a less-defended network with connectivity to more valuable targets in the region, whether government, financial, or critical infrastructure. The broad host-profiling behaviour documented in the discovery phase, particularly the network adapter enumeration and security software discovery, is consistent with an operator assessing whether a compromised host offers useful lateral movement opportunities.
The sparsity of the current IOC set is itself an operational signal. Either this campaign is in an early-exposure phase where collection has captured only the initial delivery artefact, or the operator is rotating infrastructure at a pace that outstrips current collection visibility. The absence of domain indicators is particularly notable: most C2 frameworks use domain-based addressing to allow infrastructure rotation without recompiling implants. The direct IP-based C2 configuration documented here could indicate a single-use infrastructure deployment, a domain-fronting or proxy layer not yet observed, or a deliberate choice to use IP-direct addressing to reduce the DNS-based detection surface. Using a bare IP directly as C2 with no domain layer leaves no certificate or registration trail, frustrating infrastructure tracking.
For threat hunters and analysts tracking this campaign, the "Cogent HK node with self-signed placeholder TLS cert" fingerprint — ASN 174, TLS issuer/subject "Internet Widgits Pty Ltd", serial f14b4bc3b2c38e58, last observed 29 January 2025 — represents a more persistent hunting anchor than the file hash alone. The YARA rule malware_valleyrat_strings_config from Sekoia.io's public community repository provides a reliable detection surface for the ValleyRAT configuration strings embedded in the binary. The combination of these two pivots — infrastructure certificate fingerprint and YARA rule — offers the most durable basis for expanding the known scope of this campaign beyond the two IOCs currently documented.
The operational maturity visible in this single sample suggests an intrusion set that has iterated on its evasion and delivery methodology over time. The layered anti-analysis stack, the precisely timed certificate deployment, the generic C2 certificate, and the sector-specific lure identity do not emerge from a first-generation operation. Whether the full infrastructure footprint of this campaign is substantially larger than current evidence suggests, or whether the operator's infrastructure discipline has genuinely kept the observable footprint this small, is a question current evidence cannot resolve — and that unresolved question is, in its own way, the most significant finding.