win.zip
- SHA256 ffe70f693fc24323068922045e8a8923866c37abdbc960e6649d29664760c6d9
Static task
static1
Behavioral task
behavioral1
Sample
ICQLiteShell.dll
Resource
macos-20240214-en
Behavioral task
behavioral2
Sample
ICQRT.dll
Resource
macos-20240214-en
Behavioral task
behavioral3
Sample
Language/WinRar.exe
Resource
macos-20240214-en
Behavioral task
behavioral4
Sample
LiteRes.dll
Resource
macos-20240214-en
Behavioral task
behavioral5
Sample
LiteSkinUtils.dll
Resource
macos-20240214-en
Behavioral task
behavioral6
Sample
setup.exe
Resource
macos-20240214-en
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/ICQLiteShell.dll |
| unpack001/ICQRT.dll |
| unpack001/LiteRes.dll |
| unpack001/LiteSkinUtils.dll |
| unpack001/setup.exe |
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=12, version=7291,
count=2, id=37, version=8755,
count=3, id=28, version=9178,
count=14, id=25, version=9210,
count=3, id=14, version=7299,
count=2, id=11, version=8047,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, version=8569,
count=3, id=4, version=8569,
count=169, id=1, productName=Unmarked objects,
count=3, id=11, version=8966,
count=1, id=10, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=14, version=7299,
count=2, id=11, version=8047,
count=8, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=25, version=9210,
count=33, id=1, productName=Unmarked objects,
count=1, id=10, version=8966,
count=4, id=11, version=8966,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Mar 1, 2019
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
Mar 1, 2019
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE
count=6, id=241, version=40116,
count=138, id=243, version=40116,
count=13, id=242, version=40116,
count=1, id=199, version=41118,
count=8, id=259, version=24123,
count=19, id=260, version=24123,
count=43, id=261, version=24123,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=135, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=272, id=1, productName=Unmarked objects,
count=48, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, version=8569,
count=11, id=1, productName=Unmarked objects,
count=3, id=4, version=8569,
count=2, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=12, version=7291,
count=3, id=11, version=8798,
count=2, id=37, version=8755,
count=1, id=28, version=9178,
count=14, id=25, version=9210,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=14, version=7299,
count=2, id=11, version=8047,
count=2, id=11, version=8569,
count=3, id=4, version=8569,
count=207, id=1, productName=Unmarked objects,
count=18, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.