250602-2hkjrsymt2.bin
- SHA256 bd5ee1f6ebe18c36a0168c43f459f54fd133d35244b269e4ecef5bd2a484c72b
Overview
overview
10Static
static
10uploaded/0...de.exe
windows10-2004-x64
7uploaded/0...03.exe
windows10-2004-x64
7uploaded/0...74.exe
windows10-2004-x64
5uploaded/1.exe
windows10-2004-x64
6uploaded/123.exe
windows10-2004-x64
10uploaded/1...f7.exe
windows10-2004-x64
5uploaded/1...7b.exe
windows10-2004-x64
6uploaded/1...1e.exe
windows10-2004-x64
1Archivo_20...87.doc
windows10-2004-x64
10Refusal-21...1.xlsm
windows10-2004-x64
10uploaded/222.exe
windows10-2004-x64
10uploaded/2...29.doc
windows10-2004-x64
10uploaded/2...34.exe
windows10-2004-x64
3uploaded/2...47.exe
windows10-2004-x64
7uploaded/2...b2.exe
windows10-2004-x64
5uploaded/3...92.exe
windows10-2004-x64
3uploaded/3...a4.exe
windows10-2004-x64
8uploaded/3...02.exe
windows10-2004-x64
5uploaded/4...41.exe
windows10-2004-x64
7uploaded/5...38.exe
windows10-2004-x64
6uploaded/6...08.xls
windows10-2004-x64
10uploaded/6...bb.exe
windows10-2004-x64
5uploaded/7...77.exe
windows10-2004-x64
7uploaded/7...4d.exe
windows10-2004-x64
7uploaded/8...46.exe
windows10-2004-x64
5uploaded/8...e0.exe
windows10-2004-x64
7uploaded/8...70.exe
windows10-2004-x64
7uploaded/8...33.exe
windows10-2004-x64
3uploaded/9...ty.exe
windows10-2004-x64
3uploaded/9...5z.exe
windows10-2004-x64
8uploaded/A...-K.exe
windows10-2004-x64
6uploaded/A....0.exe
windows10-2004-x64
7Static task
static1
Behavioral task
behavioral1
Sample
uploaded/057c3508b21674c3ab95c4c0f26a7195a6aba8d35464dfc97d96452479d430de.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
uploaded/0f0d2abea57c5403fb538eef2e42d5003.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
uploaded/0fec46875e62cf4c572c4cc4cc7e84374.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
uploaded/1.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
uploaded/123.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
uploaded/1546d38e814b5348b877ade61fa7cc0f7.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
uploaded/1812b1b80810a47d68157ec25c3a44e7b.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
uploaded/19a972ce0137c326e9a800096bc442276468096ad02c6dec2aba37564d0e441e.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
Archivo_2001_2021_49-381887.doc
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
Refusal-217432546-01212021.xlsm
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
uploaded/222.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
uploaded/2531 2212 2020 QG-826729.doc
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
uploaded/25f2c4054d0680fd51f2cf860055f2234.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
uploaded/2bb792ea1927ddd3a5a245eaf96c06ca2598191f670750c24d5b9ed47f20e147.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
uploaded/2e5473aa5ebf01ac5ce00c7ad537ddcb2.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
uploaded/387812ee2820cbf49812b1b229b7d8721ee37296f7b6018332a56e30a99e1092.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
uploaded/3c8ec4a8a8c3b1fbabc577576da5b70f5ddf3460b68775f3fbfa4fc07b6a7fa4.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral18
Sample
uploaded/3ca0877ae8c3c628acfe78c6847f770fe20f02790f69749216cc703ab0618002.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral19
Sample
uploaded/4c6265723661653d2fdab12a0d5d7e841.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral20
Sample
uploaded/5b518173a571366bfdce5cdd282738a38.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral21
Sample
uploaded/6a4af3ace8066e79a1020e27b2c1cc3f81d6cd8d68d1329e67b93e44b9d3d008.xls
Resource
win10v2004-20250502-en
Behavioral task
behavioral22
Sample
uploaded/6fecc453c515bb03d82132650d3d4c6bb.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral23
Sample
uploaded/70730f33f4db9f15399c6e4a510a5c4eec3bf100206535155001a2b3adbb3077.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
uploaded/70e835f3140dc2fbc211273727a8a8b4d.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral25
Sample
uploaded/83682a6a473ca2135d14cbc52c584fb46.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral26
Sample
uploaded/882f4c1313d37351d72004caa3ef1aee0.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral27
Sample
uploaded/8e751b8765f733f3f7682fd1247a27a70.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral28
Sample
uploaded/8f6b416bb42a3f168bf083c67687bd533.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral29
Sample
uploaded/93h9j2xi5z-safety.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral30
Sample
uploaded/93h9j2xi5z.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral31
Sample
uploaded/AC27_Build3001-UP7-K.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral32
Sample
uploaded/ATR Tool 2.0.exe
Resource
win10v2004-20250502-en
orcus
192.168.171.129:10134
pont9245.ddns.net:7777
147.185.221.16:18244
hostip00.duckdns.org:10134
91.218.65.24:10134
s7vety-27063.portmap.host:27063
kissmyasshole.myddns.me:1012
186d21ec80e143edb3384fa80d4ee7f8
Disable
false
%programfiles%\Orcus\Orcus.exe
10000
Orcus
Orcus
AppData\OrcusWatchdog.exe
orcus
Roblox script injector
youcantfindmelol.ddns.net:10134
de0e17d469cc46849280a8cd4d643763
Registry
true
%programfiles%\Java\Java.exe
10000
Java
Java Updater
Temp\Java Updater.exe
orcus
NEW
122.186.23.243:10134
c7798e5973374c92859ce651077d0576
Registry
true
%windir%\Desktop Window Manager.exe
10000
Program
Windows
AppData\OrcusWatchdog.exe
orcus
EMVLATEST
3.tcp.eu.ngrok.io:22028
699ea505fbd445a7924b6888db7a5f2a
Registry
true
%programfiles%\Windows Security\Microsoft Defender.exe
10000
javaservice
win10service
AppData\javaforwin.exe
asyncrat
0.5.7B
Default
friendlyman69.ddns.net:55042
AsyncMutex_6SI8OkPnk
3
true
lsass.exe
%AppData%
darkcomet
false
false
false
xworm
5.0
127.0.0.1:5555
hostz.hopto.org:5555
172.65.175.19:443
127.0.0.1:7000
council-amp.gl.at.ply.gg:59436
28.ip.gl.ply.gg:65453
Nyv6QFoXtqKjtLri
%Userprofile%
DMA Driver.exe
nanocore
1.2.2.0
90.120.50.244:2518
127.0.0.1:2518
6baeca53-6eec-4a83-8679-c479f2f1a649
true
127.0.0.1
8.8.4.4
65535
2020-11-20T17:31:41.353489336Z
false
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
true
false
4000
2518
Default
true
1.048576e+07
30000
false
2500
1.048576e+07
6baeca53-6eec-4a83-8679-c479f2f1a649
5000
false
90.120.50.244
8.8.8.8
false
5000
0
false
false
5000
false
1.2.2.0
8000
xworm
studies-license.gl.at.ply.gg:48057
dpwekwpd-58261.portmap.io:58261
127.0.0.1:7000
127.0.0.1:2321
133.23.21.222:2321
28.ip.gl.ply.gg:65453
%ProgramData%
USB.exe
umbral
https://discord.com/api/webhooks/1367163929452613703/0Ot4VsdGUKWdMg4T-pgsrzxgFAOyvGEFGDEYD7_CrEfiWkjJTQFitsIjIZavpL8rfypz
orcus
NOOB NONAME
26.223.23.213:25565
378fcdd4ef824c7db5946dd1cf8ec64f
Registry
true
%programfiles%\Orcus\Orcus.exe
10000
Orcus
Orcus
Temp\OrcusWatchdog.exe
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/FNAF 1.exe | family_asyncrat |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/Firewall.exe | family_neshta |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/__-___-___-_____-____-__.exe | family_umbral |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/Loader.exe | family_xworm |
| static1/unpack001/uploaded/Wiz.exe | family_xworm |
| static1/unpack001/uploaded/XClient (1).exe | family_xworm |
| static1/unpack001/uploaded/XClient (2).exe | family_xworm |
| static1/unpack001/uploaded/XClient (3).exe | family_xworm |
| static1/unpack001/uploaded/XClient (4).exe | family_xworm |
| static1/unpack001/uploaded/XClient.exe | family_xworm |
| static1/unpack001/uploaded/XWormClient.exe | family_xworm |
| static1/unpack001/uploaded/graveyardshiftatfreddysdemo1-0-1.exe | family_xworm |
| static1/unpack001/uploaded/ss.exe | family_xworm |
| static1/unpack001/uploaded/test.exe | family_xworm |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/Furious-Fist.exe | modiloader_stage2 |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/1.exe | orcus |
| static1/unpack001/uploaded/123.exe | orcus |
| static1/unpack001/uploaded/222.exe | orcus |
| static1/unpack001/uploaded/DLSS Roblox injector.exe | orcus |
| static1/unpack001/uploaded/Desktop Window Manager.exe | orcus |
| static1/unpack001/uploaded/EMV.exe | orcus |
| static1/unpack001/uploaded/Orcus.exe | orcus |
| static1/unpack001/uploaded/Paysafecard_bekommen.exe | orcus |
| static1/unpack001/uploaded/sex.exe | orcus |
| static1/unpack001/uploaded/test build orcus.exe | orcus |
| static1/unpack001/uploaded/virus.exe | orcus |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/1.exe | family_orcus |
| static1/unpack001/uploaded/123.exe | family_orcus |
| static1/unpack001/uploaded/222.exe | family_orcus |
| static1/unpack001/uploaded/DLSS Roblox injector.exe | family_orcus |
| static1/unpack001/uploaded/Desktop Window Manager.exe | family_orcus |
| static1/unpack001/uploaded/EMV.exe | family_orcus |
| static1/unpack001/uploaded/Orcus.exe | family_orcus |
| static1/unpack001/uploaded/Paysafecard_bekommen.exe | family_orcus |
| static1/unpack001/uploaded/sex.exe | family_orcus |
| static1/unpack001/uploaded/virus.exe | family_orcus |
Office document macro which triggers in special circumstances - often malicious.
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/CL09302021_00137.xls | office_macro_on_action |
| resource | yara_rule |
|---|---|
| static1/unpack006/Archivo_2001_2021_49-381887.doc | |
| static1/unpack008/Refusal-217432546-01212021.xlsm | office_xlm_macros |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/Firewall.exe | aspack_v212_v242 |
| description | ioc |
|---|---|
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/0fec46875e62cf4c572c4cc4cc7e84374.exe | upx |
| static1/unpack001/uploaded/1546d38e814b5348b877ade61fa7cc0f7.exe | upx |
| static1/unpack001/uploaded/1812b1b80810a47d68157ec25c3a44e7b.exe | upx |
| static1/unpack001/uploaded/2e5473aa5ebf01ac5ce00c7ad537ddcb2.exe | upx |
| static1/unpack001/uploaded/5b518173a571366bfdce5cdd282738a38.exe | upx |
| static1/unpack001/uploaded/6fecc453c515bb03d82132650d3d4c6bb.exe | upx |
| static1/unpack001/uploaded/83682a6a473ca2135d14cbc52c584fb46.exe | upx |
| static1/unpack001/uploaded/Synapse X (Remake).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller (1).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller (11).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller (23).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller (24).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller (25).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller (4).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller (5).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller (8).exe | upx |
| static1/unpack001/uploaded/ZangoInstaller.exe | upx |
| static1/unpack001/uploaded/ac68bf4e33c8bea4d3408c0f51b8b52ba.exe | upx |
| static1/unpack001/uploaded/b861dd12101f3f6dc3ea7270bffd6ef57.exe | upx |
| static1/unpack001/uploaded/c06a3ad3c1d18ea200bf00e06f63bb6af.exe | upx |
| static1/unpack001/uploaded/eafbcc1435331b5bd4271cfc8d628a687.exe | upx |
| static1/unpack001/uploaded/fb51c334a6844c56dfe300b1414f06503.exe | upx |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/uploaded/057c3508b21674c3ab95c4c0f26a7195a6aba8d35464dfc97d96452479d430de.exe |
| unpack002/out.upx |
| unpack001/uploaded/1.exe |
| unpack001/uploaded/123.exe |
| unpack003/out.upx |
| unpack001/uploaded/19a972ce0137c326e9a800096bc442276468096ad02c6dec2aba37564d0e441e.exe |
| unpack001/uploaded/222.exe |
| unpack001/uploaded/2bb792ea1927ddd3a5a245eaf96c06ca2598191f670750c24d5b9ed47f20e147.exe |
| unpack001/uploaded/387812ee2820cbf49812b1b229b7d8721ee37296f7b6018332a56e30a99e1092.exe |
| unpack001/uploaded/3c8ec4a8a8c3b1fbabc577576da5b70f5ddf3460b68775f3fbfa4fc07b6a7fa4.exe |
| unpack001/uploaded/3ca0877ae8c3c628acfe78c6847f770fe20f02790f69749216cc703ab0618002.exe |
| unpack001/uploaded/70730f33f4db9f15399c6e4a510a5c4eec3bf100206535155001a2b3adbb3077.exe |
| unpack001/uploaded/93h9j2xi5z-safety.exe |
| unpack001/uploaded/93h9j2xi5z.exe |
| unpack001/uploaded/AC27_Build3001-UP7-K.exe |
| unpack001/uploaded/ATR Tool 2.0.exe |
| unpack001/uploaded/AsylumJam2015.exe |
| unpack001/uploaded/BootstrapperNew.exe |
| unpack001/uploaded/Coffee-Rampage!.exe |
| unpack001/uploaded/DLSS Roblox injector.exe |
| unpack001/uploaded/Desktop Window Manager.exe |
| unpack001/uploaded/DownloadSetup.exe |
| unpack001/uploaded/DrShutdownComputer.exe |
| unpack001/uploaded/EMV.exe |
| unpack001/uploaded/Endorphin.exe |
| unpack001/uploaded/EternalPink.exe |
| unpack001/uploaded/FNAF 1.exe |
| unpack001/uploaded/FNAF Engine.exe |
| unpack001/uploaded/FREE SOLARIS.exe |
| unpack001/uploaded/Firewall.exe |
| unpack001/uploaded/Fnaf 1-4 JumpScare.exe |
| unpack001/uploaded/Furious-Fist.exe |
| unpack001/uploaded/Google.exe Demo.exe |
| unpack001/uploaded/Hexoxide.exe |
| unpack001/uploaded/HexoxideROWDESTRUCTIVE.exe |
| unpack001/uploaded/HexoxideROWSAFETY.exe |
| unpack001/uploaded/HexoxideSAFETY.exe |
| unpack001/uploaded/Left-4-Food-Level-Editor.exe |
| unpack001/uploaded/Left4Food.exe |
| unpack001/uploaded/Loader.exe |
| unpack001/uploaded/MBRKiller.exe |
| unpack001/uploaded/MLG-Simulator.exe |
| unpack001/uploaded/ModifYX.exe |
| unpack001/uploaded/Orcus RAT v1.3.1 Cracked by Wardow.exe |
| unpack001/uploaded/Orcus.exe |
| unpack001/uploaded/Paysafecard_bekommen.exe |
| unpack001/uploaded/Phosgene-Safety.exe |
| unpack001/uploaded/PrankCobaka.exe |
| unpack001/uploaded/Salmonium1.2.exe |
| unpack001/uploaded/Set-up.exe |
| unpack001/uploaded/Setup_02024.exe |
| unpack001/uploaded/Synapse X (Remake).exe |
| unpack001/uploaded/Synapse X 1.0.0 Cracked.exe |
| unpack001/uploaded/Synapse X Local Auth crack.exe |
| unpack001/uploaded/Synapse X.exe |
| unpack001/uploaded/THEG_sjwjwieidk_82919-safety.exe |
| unpack001/uploaded/THEG_sjwjwieidk_82919.exe |
| unpack001/uploaded/TITAN_PRIVAT.exe |
| unpack001/uploaded/Wiz.exe |
| unpack001/uploaded/XClient (1).exe |
| unpack001/uploaded/XClient (2).exe |
| unpack001/uploaded/XClient (3).exe |
| unpack001/uploaded/XClient (4).exe |
| unpack001/uploaded/XClient.exe |
| unpack001/uploaded/XWormClient.exe |
| unpack001/uploaded/__-___-___-_____-____-__.exe |
| unpack001/uploaded/build.exe |
| unpack001/uploaded/cf3e683e5b490a3edbc878c93197772ca55affb5f36626f8f093b57be8f00f07.exe |
| unpack001/uploaded/crack.exe |
| unpack001/uploaded/default.exe |
| unpack001/uploaded/finale.exe |
| unpack001/uploaded/fnf-skid.exe |
| unpack001/uploaded/graveyardshiftatfreddysdemo1-0-1.exe |
| unpack001/uploaded/h3f7b2k0a6-safety.exe |
| unpack001/uploaded/h3f7b2k0a6.exe |
| unpack001/uploaded/jli.dll |
| unpack001/uploaded/nlchecker.exe |
| unpack001/uploaded/numismatography.exe |
| unpack001/uploaded/oiabzwmvbmzqbqa.exe |
| unpack001/uploaded/pc-wizard_2012-2-11-setup.exe |
| unpack001/uploaded/setup.exe |
| unpack001/uploaded/setup_x86_x64_install (2).exe |
| unpack001/uploaded/setup_x86_x64_install.exe |
| unpack001/uploaded/sex.exe |
| unpack001/uploaded/software.exe |
| unpack001/uploaded/ss.exe |
| unpack001/uploaded/stub.exe |
| unpack001/uploaded/sus.exe |
| unpack001/uploaded/test build orcus.exe |
| unpack001/uploaded/test.exe |
| unpack001/uploaded/vinda-simulyator.exe |
| unpack001/uploaded/virus.exe |
| unpack001/uploaded/youtuber-clicker.exe |
| resource | yara_rule |
|---|---|
| static1/unpack001/uploaded/DownloadSetup.exe | nsis_installer_1 |
| static1/unpack001/uploaded/DownloadSetup.exe | nsis_installer_2 |
| static1/unpack001/uploaded/MLG-Simulator.exe | nsis_installer_1 |
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=261, version=24610,
count=2, id=259, version=24610,
count=20, id=260, version=24610,
count=17, id=257, version=24610,
count=159, id=1, productName=Unmarked objects,
count=9, id=264, version=24610,
count=1, id=255, version=24610,
count=1, id=258, version=24610,
Jun 2, 2025
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=100, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=16, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=11, id=93, version=2179,
count=133, id=1, productName=Unmarked objects,
count=7, id=100, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=1, id=105, version=2067,
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=7, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=13, id=93, version=2179,
count=294, id=1, productName=Unmarked objects,
count=55, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=131, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
file http://www.dental.xiaoxiao.media/css/https://1BVGtiTWDy6Wj6SD7lA/
file https://aka.ms/ghei36
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=199, version=41118,
count=63, id=205, version=50929,
count=166, id=206, version=50929,
count=61, id=207, version=50929,
count=5, id=206, productName=VS2012 UPD3 build 60610, version=60610,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=616, id=1, productName=Unmarked objects,
count=8, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=36, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Jun 2, 2025
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=100, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=16, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=11, id=93, version=2179,
count=133, id=1, productName=Unmarked objects,
count=7, id=100, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=1, id=105, version=2067,
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=7, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=13, id=93, version=2179,
count=294, id=1, productName=Unmarked objects,
count=55, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=131, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=199, version=41118,
count=63, id=205, version=50929,
count=166, id=206, version=50929,
count=61, id=207, version=50929,
count=5, id=206, productName=VS2012 UPD3 build 60610, version=60610,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=616, id=1, productName=Unmarked objects,
count=8, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=36, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=100, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=16, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=11, id=93, version=2179,
count=133, id=1, productName=Unmarked objects,
count=7, id=100, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34918,
count=2, id=259, version=34918,
count=12, id=260, version=34918,
count=20, id=261, version=34918,
count=11, id=257, version=33140,
count=88, id=1, productName=Unmarked objects,
count=1, id=265, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34918,
count=3, id=259, version=34918,
count=12, id=260, version=34918,
count=22, id=261, version=34918,
count=15, id=257, version=33140,
count=105, id=1, productName=Unmarked objects,
count=1, id=265, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=11, version=8047,
count=4, id=12, version=7291,
count=37, id=19, version=8022,
count=49, id=14, version=7299,
count=1, id=28, version=8830,
count=1, id=29, version=8830,
count=217, productName=Unmarked objects (old),
count=25, id=19, version=8034,
count=252, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=604, id=1, productName=Unmarked objects,
count=161, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=205, version=65501,
count=14, id=207, version=65501,
count=69, id=206, version=65501,
count=17, id=203, version=65501,
count=199, id=1, productName=Unmarked objects,
count=9, id=210, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
Unsigned PE
Checks for missing Authenticode signature.
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=205, version=65501,
count=14, id=207, version=65501,
count=69, id=206, version=65501,
count=17, id=203, version=65501,
count=199, id=1, productName=Unmarked objects,
count=9, id=210, version=65501,
count=1, id=126, version=50727,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
NSIS installer
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=26, id=223, productName=VS2013 build 21005, version=21005,
count=66, id=225, productName=VS2013 build 21005, version=21005,
count=189, id=224, productName=VS2013 build 21005, version=21005,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=83, id=1, productName=Unmarked objects,
count=1, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Async RAT payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=46, id=241, version=40116,
count=139, id=243, version=40116,
count=35, id=242, version=40116,
count=20, id=259, version=26706,
count=20, id=260, version=26706,
count=43, id=261, version=26706,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=609, id=1, productName=Unmarked objects,
count=43, id=265, version=27044,
count=1, id=256, version=27044,
count=1, id=255, version=27044,
count=1, id=258, version=27044,
Unsigned PE
Checks for missing Authenticode signature.
Detect Neshta payload
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=14, version=7299,
count=1, id=9, version=8041,
count=1, id=13, version=8169,
Jun 2, 2025
Unsigned PE
Checks for missing Authenticode signature.
count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=144, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=248, id=1, productName=Unmarked objects,
count=106, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
ModiLoader Second Stage
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=241, version=40116,
count=133, id=243, version=40116,
count=31, id=242, version=40116,
count=18, id=259, version=24237,
count=40, id=261, version=24237,
count=17, id=260, version=24237,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=133, id=1, productName=Unmarked objects,
count=1, id=261, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=241, version=40116,
count=133, id=243, version=40116,
count=31, id=242, version=40116,
count=18, id=259, version=24237,
count=40, id=261, version=24237,
count=17, id=260, version=24237,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=133, id=1, productName=Unmarked objects,
count=1, id=261, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=241, version=40116,
count=133, id=243, version=40116,
count=31, id=242, version=40116,
count=18, id=259, version=24237,
count=40, id=261, version=24237,
count=17, id=260, version=24237,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=126, id=1, productName=Unmarked objects,
count=1, id=261, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=241, version=40116,
count=133, id=243, version=40116,
count=31, id=242, version=40116,
count=18, id=259, version=24237,
count=40, id=261, version=24237,
count=17, id=260, version=24237,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=133, id=1, productName=Unmarked objects,
count=1, id=261, version=24247,
count=1, id=255, version=24247,
count=1, id=151,
count=1, id=258, version=24247,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=199, version=41118,
count=63, id=205, version=50929,
count=166, id=206, version=50929,
count=61, id=207, version=50929,
count=5, id=206, productName=VS2012 UPD3 build 60610, version=60610,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=626, id=1, productName=Unmarked objects,
count=8, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=36, id=211, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=199, version=41118,
count=63, id=205, version=50929,
count=166, id=206, version=50929,
count=61, id=207, version=50929,
count=5, id=206, productName=VS2012 UPD3 build 60610, version=60610,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=626, id=1, productName=Unmarked objects,
count=8, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=36, id=211, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=19, id=261, version=30034,
count=12, id=260, version=30034,
count=1, id=259, version=30034,
count=5, id=257, version=27412,
count=51, id=1, productName=Unmarked objects,
count=1, id=264, version=30159,
count=1, id=255, version=30159,
count=1, id=258, version=30159,
Unsigned PE
Checks for missing Authenticode signature.
NSIS installer
count=2, id=95, version=2190,
count=154, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=54, id=259, version=30795,
count=206, id=261, version=30795,
count=28, id=260, version=30795,
count=26, id=259, version=34321,
count=19, id=260, version=34321,
count=39, id=261, version=34321,
count=2, id=257, version=30795,
count=194, id=1, productName=Unmarked objects,
count=67, id=260, version=34809,
count=119, productName=Unmarked objects (old),
count=1, id=256, version=34809,
count=1, id=258, version=34809,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=241, version=40116,
count=139, id=243, version=40116,
count=24, id=242, version=40116,
count=1, id=199, version=41118,
count=22, id=259, version=24123,
count=19, id=260, version=24123,
count=44, id=261, version=24123,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=267, id=1, productName=Unmarked objects,
count=48, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Jun 2, 2025
count=2, id=12, version=7291,
count=32, id=14, version=7299,
count=135, id=10, version=8047,
count=15, id=11, version=8047,
count=2, id=37, version=8755,
count=1, id=10, version=8966,
count=307, id=1, productName=Unmarked objects,
count=19, id=25, version=9210,
count=44, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
May 19, 2025
SERIALNUMBER=516201381,CN=STAR LANDING LTD,O=STAR LANDING LTD,L=Ra'anana,ST=Central District,C=IL,1.2.840.113549.1.9.1=#0c186c6567616c40737461726c616e64696e676c74642e636f6d,1.3.6.1.4.1.311.60.2.1.3=#1302494c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=257, version=34918,
count=3, id=259, version=34918,
count=11, id=260, version=34918,
count=23, id=261, version=34918,
count=7, id=257, version=33140,
count=75, id=1, productName=Unmarked objects,
count=1, id=261, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Jun 25, 2013
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=172, id=1, productName=Unmarked objects,
count=12, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Jul 11, 2015
CN=Unity Technologies SF,O=Unity Technologies SF,L=San Francisco,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=2, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=42, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=24, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=29, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=38, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=571, id=1, productName=Unmarked objects,
count=8, id=152, version=20115,
count=70, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=182, productName=Unmarked objects (old),
count=903, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1933, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
May 6, 2014
count=3, productName=Unmarked objects (old),
count=4, id=19, version=8022,
count=131, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=9, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Jan 12, 2015
count=128, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=9, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34918,
count=2, id=259, version=34918,
count=12, id=260, version=34918,
count=20, id=261, version=34918,
count=9, id=257, version=33140,
count=88, id=1, productName=Unmarked objects,
count=1, id=265, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=125, productName=VS2005 build 50727, version=50727,
count=21, id=126, version=50327,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=271, id=1, productName=Unmarked objects,
count=21, id=109, productName=VS2005 build 50727, version=50727,
count=10, id=114, version=50727,
count=6, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=29, version=9037,
count=2, id=25, version=9043,
count=12, productName=Unmarked objects (old),
count=1, id=12, version=7291,
count=3, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=4, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=15, id=19, version=8034,
count=304, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=23, id=11, productName=VS98 (6.0) build 8168, version=8168,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, version=2190,
count=152, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Apr 5, 2025
CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Oracle America\, Inc.,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=17, id=123, productName=VS2005 build 50727, version=50727,
count=168, id=1, productName=Unmarked objects,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Mar 7, 2025
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Connectwise\, LLC,O=Connectwise\, LLC,L=Tampa,ST=Florida,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=10, id=241, version=40116,
count=122, id=243, version=40116,
count=24, id=242, version=40116,
count=37, id=261, version=31616,
count=17, id=260, version=31616,
count=20, id=259, version=31616,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=96, id=1, productName=Unmarked objects,
count=1, id=265, version=31630,
count=1, id=255, version=31630,
count=1, id=258, version=31630,
Detect Umbral payload
Unsigned PE
Checks for missing Authenticode signature.
Jun 2, 2025
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=100, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=16, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=11, id=93, version=2179,
count=133, id=1, productName=Unmarked objects,
count=7, id=100, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=1, id=105, version=2067,
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=7, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=13, id=93, version=2179,
count=294, id=1, productName=Unmarked objects,
count=55, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=131, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=4, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=19, id=93, version=2179,
count=277, id=1, productName=Unmarked objects,
count=47, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
Oct 2, 2012
count=2, id=150, version=20413,
count=53, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=31, productName=Unmarked objects (old),
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=31, id=123, productName=VS2005 build 50727, version=50727,
count=589, id=1, productName=Unmarked objects,
count=12, id=109, productName=VS2005 build 50727, version=50727,
count=366, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=986, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34918,
count=3, id=259, version=34918,
count=10, id=260, version=34918,
count=18, id=261, version=34918,
count=11, id=257, version=33140,
count=65, id=1, productName=Unmarked objects,
count=1, id=265, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Jun 2, 2025
count=25, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=100, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=25, version=9210,
count=16, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=2, id=93, version=2067,
count=11, id=93, version=2179,
count=133, id=1, productName=Unmarked objects,
count=7, id=100, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Jun 2, 2025
count=18, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=8, id=95, version=2179,
count=2, id=25, version=9210,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=9, id=10, version=8447,
count=15, id=93, version=2179,
count=296, id=1, productName=Unmarked objects,
count=53, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=10, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=47, id=241, version=40116,
count=142, id=243, version=40116,
count=35, id=242, version=40116,
count=2, id=199, version=41118,
count=20, id=259, version=26706,
count=20, id=260, version=26706,
count=43, id=261, version=26706,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=663, id=1, productName=Unmarked objects,
count=8, id=261, version=27034,
count=38, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=258, version=27034,
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34918,
count=2, id=259, version=34918,
count=12, id=260, version=34918,
count=20, id=261, version=34918,
count=11, id=257, version=33140,
count=86, id=1, productName=Unmarked objects,
count=1, id=265, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34918,
count=2, id=259, version=34918,
count=12, id=260, version=34918,
count=20, id=261, version=34918,
count=15, id=257, version=33140,
count=97, id=1, productName=Unmarked objects,
count=1, id=265, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=259, version=34321,
count=11, id=260, version=34321,
count=39, id=261, version=34321,
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=257, version=30795,
count=338, id=1, productName=Unmarked objects,
count=9, id=259, version=34435,
count=2, id=260, version=34435,
count=1, productName=Unmarked objects (old),
count=74, id=261, version=34435,
count=1, id=256, version=34438,
count=1, id=258, version=34438,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, version=2190,
count=152, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=26, id=223, productName=VS2013 build 21005, version=21005,
count=69, id=225, productName=VS2013 build 21005, version=21005,
count=196, id=224, productName=VS2013 build 21005, version=21005,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=133, id=1, productName=Unmarked objects,
count=1, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Nov 3, 2010
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33731,
count=10, id=260, version=33731,
count=27, id=261, version=33731,
count=6, id=257, version=33731,
count=13, id=257, version=33140,
count=181, id=1, productName=Unmarked objects,
count=3, id=265, version=33820,
count=1, id=255, version=33820,
count=1, id=258, version=33820,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=14, version=7299,
count=77, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=9, id=19, version=8034,
count=55, id=1, productName=Unmarked objects,
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
Orcurs Rat Executable
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=109, productName=VS2005 build 50727, version=50727,
count=32, id=123, productName=VS2005 build 50727, version=50727,
count=61, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=180, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=359, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=132, productName=VS2008 build 21022, version=21022,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=763, id=1, productName=Unmarked objects,
count=20, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Orcurs Rat Executable
Orcus main payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=199, version=41118,
count=63, id=205, version=50929,
count=166, id=206, version=50929,
count=61, id=207, version=50929,
count=5, id=206, productName=VS2012 UPD3 build 60610, version=60610,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=626, id=1, productName=Unmarked objects,
count=8, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=36, id=211, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,