SATUP.zip
- SHA256 4f6681ace6a9e711c8bf2072fa7b34e82d38af3edc730da7fe582eb25dcca8ca
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20251016-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10ltsc2021-20251017-en
hijackloader
%APPDATA%\gateway_grpc_rel
%windir%\SysWOW64\rasapi32.dll
| resource | yara_rule |
|---|---|
| static1/unpack001/Aidhalaend.vvce | family_hijackloader |
| resource | yara_rule |
|---|---|
| static1/unpack001/Library/asprlib.dll | aspack_v212_v242 |
File was altered after it was signed.
| resource |
|---|
| unpack001/libeay32.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Library/ImBatchContextMenuHandler-X64.dll |
| unpack001/Library/PocoZip.dll |
| unpack001/Library/VGX.dll |
| unpack001/Library/libp11-kit-0.dll |
| unpack001/Library/msys-svn_client-1-0.dll |
| unpack001/Library/zlib1.dll |
| unpack001/Updates/InkDiv.dll |
| unpack001/Updates/bin/blocked-file-util.exe |
| unpack001/ssleay32.dll |
Codesigned binary was signed by an untrusted entity.
| resource |
|---|
| unpack001/Library/ASLFoundation.dll |
| unpack001/Library/AdbePM.dll |
| unpack001/Library/VideoFrame.dll |
| unpack001/Library/XIMAGE3B.DLL |
| unpack001/Library/dvatransport.dll |
| unpack001/Library/mc_dec_aac.dll |
| unpack001/Updates/bin/kcpytkt.exe |
| unpack001/setup.exe |
Detects HijackLoader (aka IDAT Loader)
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
May 29, 2015
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 build 30319, version=30319,
count=11, id=170, productName=VS2010 build 30319, version=30319,
count=4, id=156, productName=VS2010 build 30319, version=30319,
count=7, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=461, id=1, productName=Unmarked objects,
count=69, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
May 29, 2015
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=1, id=199, version=41118,
count=2, id=223, version=20806,
count=13, id=224, version=20806,
count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,
count=4, id=221, version=20806,
count=6, id=225, version=20806,
count=33, productName=Unmarked objects (old),
count=3, id=203, version=65501,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=183, id=1, productName=Unmarked objects,
count=1, id=223, productName=VS2013 UPD4 build 31101, version=31101,
count=55, id=229, version=31101,
count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
Sep 23, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, version=32533,
count=8, id=260, version=32533,
count=4, id=259, version=32533,
count=40, id=261, version=32533,
count=7, id=257, version=29395,
count=256, id=1, productName=Unmarked objects,
count=32, id=265, version=32533,
count=1, id=256, version=32533,
count=1, id=255, version=32533,
count=2, id=151,
count=1, id=258, version=32533,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=26213,
count=18, id=260, version=26213,
count=177, id=261, version=26213,
count=9, id=259, version=26706,
count=57, id=261, version=26706,
count=30, id=260, version=26706,
count=15, id=257, version=26213,
count=129, id=1, productName=Unmarked objects,
count=4, id=265, version=27045,
count=1, id=256, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Sep 6, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Aug 13, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Aug 13, 2018
Sep 19, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Apr 6, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Aug 21, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 6, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 17, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 6, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 25, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Aug 22, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2018
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2018
count=28, id=257, version=26213,
count=17, id=260, version=26213,
count=6, id=259, version=26213,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=322, id=1, productName=Unmarked objects,
count=42, id=261, version=26213,
count=1, id=256, version=26213,
count=84, id=270, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
Mar 25, 2024
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Jul 6, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 25, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 9, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=22, id=261, version=32420,
count=8, id=260, version=32420,
count=3, id=259, version=32420,
count=6, id=257, version=32420,
count=2, id=257, version=30795,
count=3, id=257, version=32532,
count=192, id=1, productName=Unmarked objects,
count=22, id=261, version=32532,
count=1, id=256, version=32532,
count=1, id=255, version=32532,
count=1, id=151,
count=1, id=258, version=32532,
Oct 1, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=260, version=26213,
count=3, id=259, version=26213,
count=384, id=1, productName=Unmarked objects,
count=23, id=257, version=26213,
count=3, id=261, version=26213,
count=1, id=256, version=26213,
count=155, id=265, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
May 29, 2015
count=1, id=152, version=20115,
count=2, id=158, productName=VS2010 build 30319, version=30319,
count=12, id=170, productName=VS2010 build 30319, version=30319,
count=4, id=156, productName=VS2010 build 30319, version=30319,
count=8, id=171, productName=VS2010 build 30319, version=30319,
count=22, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=22, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=324, id=1, productName=Unmarked objects,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=24, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Mar 3, 2022
CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Mar 3, 2022
CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=150, version=20413,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=129, version=50727,
count=12, id=123, productName=VS2005 build 50727, version=50727,
count=105, id=1, productName=Unmarked objects,
count=20, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Jan 10, 2010
count=1, id=150, version=20413,
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=88, id=1, productName=Unmarked objects,
count=205, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=43, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Jul 6, 2023
SERIALNUMBER=B09921982,CN=BURNAWARE SL,O=BURNAWARE SL,L=Marbella,ST=Málaga,C=ES,1.3.6.1.4.1.311.60.2.1.3=#13024553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Sep 28, 2023
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=30795,
count=102, id=1, productName=Unmarked objects,
count=43, id=261, version=32420,
count=11, id=260, version=32420,
count=8, id=259, version=32420,
count=26, id=265, version=32537,
count=1, id=256, version=32537,
count=1, id=255, version=32537,
count=1, id=258, version=32537,
Sep 23, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=32533,
count=8, id=260, version=32533,
count=4, id=259, version=32533,
count=36, id=261, version=32533,
count=9, id=257, version=29395,
count=373, id=1, productName=Unmarked objects,
count=18, id=265, version=32533,
count=1, id=256, version=32533,
count=1, id=255, version=32533,
count=1, id=258, version=32533,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
May 29, 2015
count=2, id=199, version=41118,
count=2, id=205, version=50929,
count=12, id=206, version=50929,
count=4, id=203, version=50929,
count=6, id=207, version=50929,
count=6, id=185, version=30716,
count=9, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=180, id=1, productName=Unmarked objects,
count=7, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Oct 30, 2023
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Oct 30, 2023
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Oct 30, 2023
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Oct 30, 2023
CN=VideoLAN,O=VideoLAN,L=Paris,C=FR
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Apr 12, 2021
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=239, version=40116,
count=6, id=199, version=41118,
count=2, id=259, version=24123,
count=11, id=260, version=24123,
count=4, id=257, version=24123,
count=30, id=261, version=24123,
count=2, id=257, productName=VS2015 UPD3 build 24213, version=24213,
count=3, id=203, version=65501,
count=593, id=1, productName=Unmarked objects,
count=93, id=261, productName=VS2015 UPD3 build 24213, version=24213,
count=1, id=256, productName=VS2015 UPD3 build 24213, version=24213,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3 build 24213, version=24213,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
May 29, 2015
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=80, id=1, productName=Unmarked objects,
count=15, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=134, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=61, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Dec 19, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 1, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=6, id=206, version=65501,
count=8, id=260, version=31940,
count=11, id=261, version=31940,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=31823,
count=27, id=261, version=31823,
count=8, id=260, version=31823,
count=4, id=259, version=31823,
count=21, id=203, version=65501,
count=349, id=1, productName=Unmarked objects,
count=99, id=265, version=31940,
count=1, id=256, version=31940,
count=1, id=255, version=31940,
count=1, id=258, version=31940,
Unsigned PE
Checks for missing Authenticode signature.
Oct 19, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=30795,
count=195, id=1, productName=Unmarked objects,
count=9, id=257, version=30795,
count=13, id=261, version=30795,
count=21, id=260, version=30795,
count=1, id=256, version=30795,
count=20, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=260, version=26213,
count=5, id=259, version=26213,
count=143, id=261, version=26213,
count=4, id=199, version=41118,
count=31, id=261, version=26706,
count=14, id=260, version=26706,
count=9, id=259, version=26706,
count=3, id=257, version=26213,
count=85, id=1, productName=Unmarked objects,
count=15, id=260, version=27032,
count=1, id=256, version=27032,
count=1, id=255, version=27032,
count=1, id=258, version=27032,
Unsigned PE
Checks for missing Authenticode signature.
count=44, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=260, version=26213,
count=162, id=1, productName=Unmarked objects,
count=5, id=257, version=26213,
count=4, id=259, version=26213,
count=1, id=256, version=26213,
count=68, id=265, version=26213,
count=8, id=261, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,
Jul 6, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 1, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 25, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 25, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Mar 5, 2024
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=257, version=30795,
count=10, id=260, version=33030,
count=4, id=259, version=33030,
count=34, id=261, version=33030,
count=8, id=257, version=33030,
count=423, id=1, productName=Unmarked objects,
count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=265, version=33130,
count=1, id=255, version=33130,
count=1, id=151,
count=1, id=258, version=33130,
Aug 21, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=31823,
count=5, id=262, version=24610,
count=21, id=257, version=24610,
count=384, id=1, productName=Unmarked objects,
count=4, id=260, version=25025,
count=30, id=261, version=31823,
count=8, id=260, version=31823,
count=4, id=259, version=31823,
count=100, id=265, version=31940,
count=1, id=256, version=31940,
count=1, id=255, version=31940,
count=1, id=258, version=31940,
Feb 15, 2024
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 30, 2020
SERIALNUMBER=23638777,CN=ASUSTeK Computer Inc.,O=ASUSTeK Computer Inc.,L=Taipei City,C=TW,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025457
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=10, id=260, version=26213,
count=5, id=259, version=26213,
count=136, id=261, version=26213,
count=37, id=261, version=26706,
count=17, id=260, version=26706,
count=8, id=259, version=26706,
count=7, id=257, version=26213,
count=91, id=1, productName=Unmarked objects,
count=1, id=265, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
Mar 25, 2024
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=10, id=259, version=26715,
count=139, id=261, version=26715,
count=18, id=260, version=26715,
count=17, id=260, version=26706,
count=17, id=259, version=26706,
count=39, id=261, version=26706,
count=9, id=257, version=26715,
count=105, id=1, productName=Unmarked objects,
count=1, id=265, version=27049,
count=1, id=255, version=27049,
count=1, id=151,
count=1, id=258, version=27049,
Unsigned PE
Checks for missing Authenticode signature.
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Jun 19, 2013
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=52, id=1, productName=Unmarked objects,
count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Sep 4, 2024
SERIALNUMBER=CHE-113.666.835,CN=Acronis International GmbH,O=Acronis International GmbH,L=Schaffhausen,C=CH,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130c53636861666668617573656e,1.3.6.1.4.1.311.60.2.1.3=#13024348
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=CHE-113.666.835,CN=Acronis International GmbH,O=Acronis International GmbH,L=Schaffhausen,C=CH,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130c53636861666668617573656e,1.3.6.1.4.1.311.60.2.1.3=#13024348
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=225, version=20806,
count=3, id=199, version=41118,
count=4, id=221, productName=VS2013 build 21005, version=21005,
count=10, id=223, productName=VS2013 build 21005, version=21005,
count=22, id=224, productName=VS2013 build 21005, version=21005,
count=6, id=225, productName=VS2013 build 21005, version=21005,
count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=714, id=1, productName=Unmarked objects,
count=258, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Sep 23, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=257, version=32533,
count=8, id=260, version=32533,
count=4, id=259, version=32533,
count=36, id=261, version=32533,
count=9, id=257, version=29395,
count=375, id=1, productName=Unmarked objects,
count=18, id=265, version=32533,
count=1, id=256, version=32533,
count=1, id=255, version=32533,
count=1, id=258, version=32533,
Oct 19, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=30795,
count=195, id=1, productName=Unmarked objects,
count=9, id=257, version=30795,
count=13, id=261, version=30795,
count=21, id=260, version=30795,
count=1, id=256, version=30795,
count=20, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
May 30, 2023
SERIALNUMBER=2770852,CN=ORANGE VIEW LIMITED,O=ORANGE VIEW LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
May 30, 2023
SERIALNUMBER=2770852,CN=ORANGE VIEW LIMITED,O=ORANGE VIEW LIMITED,L=Kowloon,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=128, version=50727,
count=11, id=123, productName=VS2005 build 50727, version=50727,
count=198, id=1, productName=Unmarked objects,
count=148, id=132, productName=VS2008 build 21022, version=21022,
count=172, id=131, productName=VS2008 build 21022, version=21022,
count=3, id=138, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Mar 2, 2022
CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Mar 2, 2022
CN=Corel Corporation,OU=IT Infrastructure,O=Corel Corporation,L=Ottawa,ST=Ontario,C=CA
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=11, id=260, version=27412,
count=6, id=259, version=27412,
count=177, id=261, version=27412,
count=3, id=261, productName=VS2017 v15.7.3 build 26430, version=26430,
count=1, id=262, version=27412,
count=13, id=257, version=27412,
count=195, id=1, productName=Unmarked objects,
count=47, id=261, version=29118,
count=15, id=260, version=29118,
count=10, id=259, version=29118,
count=20, id=261, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=255, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=256, productName=VS2019 v16.8.4 build 29336, version=29336,
count=1, id=258, productName=VS2019 v16.8.4 build 29336, version=29336,
Codesign digest Mismatch
File was altered after it was signed.
Oct 27, 2025
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Oct 27, 2025
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=7, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=413, id=1, productName=Unmarked objects,
count=58, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=122, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=124, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=1, id=120, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,