R-Loader.zip
- SHA256 e7e0371c6a371c43e2bb8623b00787c19263078c83c56fff2e127c9ace6eb4ca
Behavioral task
behavioral1
Sample
Executor/Executor.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Executor/Executor.exe
Resource
win10v2004-20240508-en
| resource | yara_rule |
|---|---|
| static1/unpack001/Executor/Executor.exe | pyinstaller |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Executor/Executor.exe |
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=259, version=30795,
count=187, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=31935,
count=40, id=261, version=31935,
count=17, id=260, version=31935,
count=9, id=259, version=31935,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32217,
count=1, id=258, version=32217,
Jun 7, 2024
Jun 7, 2024
count=2, id=257, version=29395,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=1, productName=Unmarked objects,
count=13, id=259, version=31823,
count=16, id=260, version=31823,
count=31, id=261, version=31823,
count=1, id=256, version=31823,
count=1, id=255, version=31823,
count=1, id=258, version=31823,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=3, id=253, version=31935,
count=13, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=3, id=257, version=32217,
count=2, id=257, version=30795,
count=95, id=1, productName=Unmarked objects,
count=8, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=13, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=3, id=257, version=32217,
count=2, id=257, version=30795,
count=156, id=1, productName=Unmarked objects,
count=1, id=259, version=32217,
count=15, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=12, id=261, version=31935,
count=8, id=260, version=31935,
count=3, id=259, version=31935,
count=2, id=257, version=30795,
count=5, id=257, version=32217,
count=136, id=1, productName=Unmarked objects,
count=1, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=12, id=261, version=31935,
count=8, id=260, version=31935,
count=3, id=259, version=31935,
count=3, id=257, version=32217,
count=2, id=257, version=30795,
count=102, id=1, productName=Unmarked objects,
count=58, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=13, id=261, version=31935,
count=8, id=260, version=31935,
count=3, id=259, version=31935,
count=2, id=257, version=32217,
count=184, id=1, productName=Unmarked objects,
count=7, id=257, version=30795,
count=1, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=13, id=261, version=31935,
count=8, id=260, version=31935,
count=3, id=259, version=31935,
count=2, id=257, version=32217,
count=2, id=257, version=30795,
count=5, id=257, productName=VS2019 v16.11.9 build 30139, version=30139,
count=210, id=1, productName=Unmarked objects,
count=2, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Sep 27, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=12, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=179, id=1, productName=Unmarked objects,
count=11, id=257, version=30795,
count=32, id=259, version=32217,
count=872, id=260, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=257, version=31935,
count=14, id=253, version=31935,
count=12, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=257, version=30795,
count=357, id=1, productName=Unmarked objects,
count=198, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=12, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=2, id=257, version=32217,
count=66, id=1, productName=Unmarked objects,
count=5, id=257, version=30795,
count=1, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Feb 28, 2022
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=257, version=30034,
count=3, id=253, version=28518,
count=12, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=260, version=29395,
count=13, id=257, version=29395,
count=281, id=1, productName=Unmarked objects,
count=173, id=264, version=30139,
count=1, id=256, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=255, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,
Feb 28, 2022
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=257, version=30034,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=3, id=260, version=29395,
count=1, id=260, productName=VS2019 v16.11.9 build 30139, version=30139,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=257, version=29395,
count=329, id=1, productName=Unmarked objects,
count=142, id=264, version=30139,
count=1, id=256, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=255, productName=VS2019 v16.11.9 build 30139, version=30139,
count=1, id=258, productName=VS2019 v16.11.9 build 30139, version=30139,
Oct 2, 2023
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=13, id=261, version=31935,
count=8, id=260, version=31935,
count=3, id=259, version=31935,
count=3, id=257, version=32217,
count=2, id=257, version=30795,
count=81, id=1, productName=Unmarked objects,
count=1, id=269, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,