Red-Flaged.7z
- SHA256 54942b5bcfc9add448903934fc61f4e02bf2dc6378a65f0aa4af346e858fe9d3
27/09/2026, 11:54
260927-n3acmsyvez26/09/2026, 22:37
260926-2j7qpatv8r1026/09/2026, 01:02
260926-bd84fs1bnc1026/09/2026, 00:59
260926-bcllrs1y2k1020/09/2026, 10:36
260920-mnczjsab771020/09/2026, 07:07
260920-hx3jcadp5x1008/09/2026, 15:38
260908-s27nzagd9315/08/2026, 21:05
260815-zw6ytat1ez15/08/2026, 20:50
260815-zmxnsatzgs15/08/2026, 20:46
260815-zkklfatcnfStatic task
static1
nanocore
1.2.2.0
computernewb.com:80
discord.horse:80
4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b
true
discord.horse
8.8.4.4
65535
2025-04-03T22:24:52.440913136Z
true
true
false
4000
80
Default
true
1.048576e+07
30000
false
2500
1.048576e+07
4d0a1e0d-08d5-4a14-ba4f-5aa591ac722b
5000
false
computernewb.com
8.8.8.8
true
5000
0
true
true
5000
false
1.2.2.0
8000
zloader
Bing_Mod2
M1
https://adslstickerni.world
redline
LIM
195.3.223.120:25539
nworm
v0.3.8
computernewb.com:80
discord.horse:80
35f629a5
remcos
1.7 Pro
Host
nickman12-46565.portmap.io:46565
nickman12-46565.portmap.io:1735
audio
%AppData%
5
0
5
Userdata.exe
Userdata
true
true
true
true
%WinDir%\System32
true
logs.dat
false
remcos
%WinDir%\System32
false
remcos_vcexssuhap
false
false
Screens
%AppData%
1
remcos
false
5
xred
xred.mooo.com
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
sheetrat
1.7
Bulka
95.181.213.48:7777
umbral
v1.3
https://discord.com/api/webhooks/1437804446846292199/tv-QDaXWpLAuK3kjN19boqVo_x72Y_ECGK_spjWckXHS3OiiDIJpEFcxVz8mUMFPVWeJ
metasploit
metasploit_stager
8.138.101.146:3002
revengerat
MAYO24
karmina113.sytes.net:3333
karmina117.sytes.net:3333
karmina118.sytes.net:3333
karmina119.sytes.net:3333
nibiru3.duckdns.org:3333
nibiru4.duckdns.org:3333
nibiru5.duckdns.org:3333
nibiru6.duckdns.org:3333
WSCollect
warmcookie
170.130.165.112
56c98eb4-723f-4cbd-8b73-862d390eddcb
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
quasar
1.4.1
.
147.185.221.31:65393
06e364dd-71d5-4f0b-bae4-3e4ca9c73aa5
FD9F712FFB55F9983B0F154D69B0813016E50527
realtekconsole.exe
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
Logs
3000
Realtek Audio Console
Realtek
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/uncext.exe | blankgrabber_exe |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a.exe | family_babylonrat |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe | family_blackmoon |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/HermeticWiper.exe | family_hermeticwiper |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe | family_neshta |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/b2e27be69931b678ee13b42f83438dc5.exe | family_salatstealer |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe | family_xclient |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/Xeno.exe | family_xworm |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/Fake ID Cards Creator (NEW 2025).exe | family_amadey_v2 |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe | family_arcane |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/2025-11-12_66b597d27d0554b1504430138369859b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe | family_aura_stealer |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/f2dc218ea8e2caa8668e54bae6561afd9fbf035a40b80ce9e847664ff0809799.exe | family_bert_windows |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d.exe | BlackLock |
Cosmu is a worm written in C++.
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe | family_cosmu |
Dtrack aka Preft TroyRAT is RAT developed by Lazarus group written in C++.T
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe | family_dtrack |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe | family_duplexspyrat |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/6377d2686feb3c4b20e53085a379e9d2381adeaafc698f56373c1548a74a6fa1.exe | flyagent |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe | family_jlocker |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/85699c7180ad77f2ede0b15862bb7b51ad9df0478ed394866ac7fa9362bf5683.exe | family_lynx |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/7335e618043645e7e6c72d24d2ea3a286b8cbddc1afedf963630ab4f24d95782.exe | family_mispadu |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe | family_nighthawk_loader |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe | family_pennywise |
Sheetrat aka NonEuclid RAT is a trojan written in C#.
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/XenoUI.exe | family_sheetrat_v2 |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/Xeno.exe | family_umbral |
| static1/unpack001/Red-Flaged/Xeno.exe | family_umbral_obfuscated |
| static1/unpack001/Red-Flaged/YnGOp-loader.exe | family_umbral |
| static1/unpack001/Red-Flaged/YnGOp-loader.exe | family_umbral_obfuscated |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/a0630e2a81775e8334ea9f8cac73cebf1b9a70507ea3347c0c2eba82c80219a6.exe | family_blacknevas |
| static1/unpack001/Red-Flaged/b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02.exe | family_blacknevas |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe | family_yurei |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe.exe | family_gofing |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/realtek.exe | family_quasar |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/Implosions.exe | family_redline |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe | revengerat |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe | family_lockbit |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/Implosions.exe | family_sectoprat |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe | mimikatz |
| static1/unpack001/Red-Flaged/2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe | mimikatz |
| static1/unpack001/Red-Flaged/9eda7cc4737b03e47696ef02f8b0c687a6b75a08ba3a7e2ee2941ff9cf05d5b7.exe | mimikatz |
Free utilities often used by attackers which can steal passwords, product keys, etc.
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/7335e618043645e7e6c72d24d2ea3a286b8cbddc1afedf963630ab4f24d95782.exe | Nirsoft |
Password recovery tool for various email clients
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/7335e618043645e7e6c72d24d2ea3a286b8cbddc1afedf963630ab4f24d95782.exe | MailPassView |
Password recovery tool for various web browsers
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/7335e618043645e7e6c72d24d2ea3a286b8cbddc1afedf963630ab4f24d95782.exe | WebBrowserPassView |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe | themida |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe | vmprotect |
AutoIT scripts compiled to PE executables.
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/rWaybillNo_4630813235.exe | autoit_exe |
File was altered after it was signed.
| resource |
|---|
| unpack001/Red-Flaged/53fb999c4ef195a5c37e80ad4208f7d3bd02951672462339cafd5c0463a6f2aa.exe |
| unpack001/Red-Flaged/55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe |
| unpack001/Red-Flaged/BadRabbit.exe |
| unpack001/Red-Flaged/HermeticWiper.exe |
| unpack001/Red-Flaged/_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe |
| unpack001/Red-Flaged/setup.exe |
| unpack001/Red-Flaged/uncext.exe |
Detects ConfuserEx .NET packer.
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/5a765351046fea1490d20f25.exe | ConfuserEx |
| static1/unpack001/Red-Flaged/Jigsaw.exe | ConfuserEx |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe | upx |
| static1/unpack001/Red-Flaged/ChileLocker_d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe | upx |
| static1/unpack001/Red-Flaged/DiscordTimerEditor2.1.exe | upx |
| static1/unpack001/Red-Flaged/JaffaCakes118_30f515392358142b507a486d7ab379d2.exe | upx |
| static1/unpack001/Red-Flaged/MyDoom.A.exe | upx |
| static1/unpack001/Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe | upx |
| static1/unpack001/Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe | upx |
| static1/unpack001/Red-Flaged/hive.exe | upx |
| static1/unpack001/Red-Flaged/mCa4SRR.exe | upx |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/DiscordTimerEditor2.1.exe | pyinstaller |
File was codesigned using an insecure algorithm.
| resource |
|---|
| unpack001/Red-Flaged/02WLPQTDGE.msi |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Red-Flaged/028064da75bc36bb36ca2c02744da60fceb33fabcbee02ddae76ff35332208fe.exe |
| unpack001/Red-Flaged/03d34f5a53aa870c9aee05a54c1d258f013f8e86ff71434e8137e747a77f020a.exe |
| unpack001/Red-Flaged/04e768174636f0a5be42e9cee5974a8b9db2832d4e79cc973ad617185ab80595.exe |
| unpack001/Red-Flaged/0e932dd0eb5ac59e3a4a2412ad3424052fd57053923a9006b8a63061b2d9ba78.exe |
| unpack001/Red-Flaged/0eb4708bc1ecc868a3247cea58065db54315a8f30047b6e2c7cfc4ef4fa7f6ff.exe |
| unpack001/Red-Flaged/12bd6f8e298e25c036f3bd4716edcb486d78a3c8f33af1f2d74439ebbcbf5434.exe |
| unpack001/Red-Flaged/1db18d89a636f9d9307e51798c0545664fae38711a2a72139d62c7dbd6f17fe3.exe |
| unpack001/Red-Flaged/1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e.exe |
| unpack001/Red-Flaged/2025-07-15_9fdd329535a395b3287bf94308c76785_elex_stealc_stop_tofsee_upatre.exe |
| unpack001/Red-Flaged/2025-11-05_d1c0f450fd12161c126de8f17a8c1810_cobalt-strike_coinminer_dosia_luca-stealer_njrat_poet-rat_quasar-rat_snatch.exe |
| unpack001/Red-Flaged/2025-11-10_423504692acf78cecd61922d89b87a1d_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe |
| unpack001/Red-Flaged/2025-11-11_895016d46d81fa30da9122e4abab6660_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe |
| unpack001/Red-Flaged/2025-11-12_66b597d27d0554b1504430138369859b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe |
| unpack001/Red-Flaged/2025-11-12_6ab017c1b7d68321880fed7736122a20_cobalt-strike_conti.exe |
| unpack001/Red-Flaged/2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe |
| unpack001/Red-Flaged/2025-11-12_a787c0932def56cc7b85e6888e67bb87_amadey_elex_smoke-loader_stealc_stop_vidar.exe |
| unpack001/Red-Flaged/2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe |
| unpack001/Red-Flaged/2025_Cotizacion Noviembre.exe |
| unpack001/Red-Flaged/2128a68f2140e72e8cf42fae54a66f8eb228a5393744237cf2a04c72d0310188.exe |
| unpack001/Red-Flaged/374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe |
| unpack001/Red-Flaged/3a252ac37d78baad0a81242c0cb2bd68208c12267aa87d3cd3c5d594f1de27a5.exe |
| unpack001/Red-Flaged/3d0edacb6d58c9674119460f71e535a1dd2566845b0f8a6bc97185b1ff9f3bb9.exe |
| unpack001/Red-Flaged/4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe |
| unpack001/Red-Flaged/51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe |
| unpack001/Red-Flaged/556eaf27dd7c9d5b1949766151b83035625e11dabcfe0259f7a927fb80f0145e.exe |
| unpack001/Red-Flaged/57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe |
| unpack001/Red-Flaged/57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d.exe |
| unpack001/Red-Flaged/5a765351046fea1490d20f25.exe |
| unpack001/Red-Flaged/5ec9325b6998e8749bc0465890f201e3d8fddb767b2eeebb4f84fd7cf942930a.exe |
| unpack001/Red-Flaged/6377d2686feb3c4b20e53085a379e9d2381adeaafc698f56373c1548a74a6fa1.exe |
| unpack001/Red-Flaged/6669cfeba5619b6f4d80b1281adfe69c87d845ebaaf9e83c25efa01a8267e751.exe |
| unpack001/Red-Flaged/680a883430e5955b4349ad21e23fc330e74f7c05e1d61ffd25c9970acd303677.exe |
| unpack001/Red-Flaged/7335e618043645e7e6c72d24d2ea3a286b8cbddc1afedf963630ab4f24d95782.exe |
| unpack001/Red-Flaged/85699c7180ad77f2ede0b15862bb7b51ad9df0478ed394866ac7fa9362bf5683.exe |
| unpack001/Red-Flaged/885ef9a1ef4ae7b212628622f6b72e29381a8c8bb5abf667e7da6f537493a0be.exe |
| unpack001/Red-Flaged/8e9a8026a844ae290cfe223e820894324bc2eb12339c04091d97fcdc227fd1f6.exe |
| unpack001/Red-Flaged/9eda7cc4737b03e47696ef02f8b0c687a6b75a08ba3a7e2ee2941ff9cf05d5b7.exe |
| unpack001/Red-Flaged/ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18.exe |
| unpack001/Red-Flaged/Azorult 3.3 Cracked.exe |
| unpack001/Red-Flaged/BQT.exe |
| unpack001/Red-Flaged/BorisFX_v7_0_serial_keygen_by_orion.exe |
| unpack001/Red-Flaged/ChileLocker_d00853e592bccd823027e7e685d88c5a1f76a5a36ec5b7073d49ee633b050cc8.exe |
| unpack001/Red-Flaged/CoronaVirus.exe |
| unpack001/Red-Flaged/CrimsonRAT.exe |
| unpack001/Red-Flaged/CryptoLocker.exe |
| unpack001/Red-Flaged/DanaBot.exe |
| unpack001/Red-Flaged/DiscordTimerEditor2.1.exe |
| unpack001/Red-Flaged/EpsilonApp.exe |
| unpack001/Red-Flaged/FT24249304-Monthly_GST_Invoice-PAYOUT.pdf.bat.exe |
| unpack001/Red-Flaged/Fake ID Cards Creator (NEW 2025).exe |
| unpack001/Red-Flaged/Fantom.exe |
| unpack001/Red-Flaged/Implosions.exe |
| unpack001/Red-Flaged/InfinityCrypt.exe |
| unpack001/Red-Flaged/JaffaCakes118_2363f93331fc792ae9cb5750043bdc89.exe |
| unpack001/Red-Flaged/JaffaCakes118_30f515392358142b507a486d7ab379d2.exe |
| unpack001/Red-Flaged/JaffaCakes118_337dd03f1d287dcdb6471704d14aa3b6.exe |
| unpack001/Red-Flaged/Jigsaw.exe |
| unpack001/Red-Flaged/Locky.exe |
| unpack001/Red-Flaged/MuckModLoaderSetup2.1.1.exe |
| unpack001/Red-Flaged/MyDoom.A.exe |
| unpack001/Red-Flaged/N-W0rm.exe |
| unpack001/Red-Flaged/Petya.A.exe |
| unpack001/Red-Flaged/Product Sample pdf.exe |
| unpack001/Red-Flaged/Remcos.exe |
| unpack001/Red-Flaged/Rensenware.exe |
| unpack001/Red-Flaged/SecuriteInfo.com.Trojan.PackedNET.3443.29781.26666.exe |
| unpack001/Red-Flaged/Synaptics.exe |
| unpack001/Red-Flaged/WannaCrypt0r.exe |
| unpack001/Red-Flaged/WarzoneRAT.exe |
| unpack001/Red-Flaged/Xeno.exe |
| unpack001/Red-Flaged/XenoUI.exe |
| unpack001/Red-Flaged/YnGOp-loader.exe |
| unpack001/Red-Flaged/_13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7.exe |
| unpack001/Red-Flaged/_529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474.exe |
| unpack001/Red-Flaged/_69997b7923fe84358aa11adc4db0862577ac9336c657e771a2244f07c843816a.exe |
| unpack001/Red-Flaged/_aa885d2d8550a5816070d4174a504ae7b4d90e3e50b3dbce7cea17443b6b9080.exe |
| unpack001/Red-Flaged/_efffbda36edcb7d4130f65a57d3966e7694172fb5db37ce48f27849d239066c7.exe |
| unpack001/Red-Flaged/a0630e2a81775e8334ea9f8cac73cebf1b9a70507ea3347c0c2eba82c80219a6.exe |
| unpack001/Red-Flaged/a1730e7aaac4b7283d6ca0741b338955256965ef8804f3454decb7d00c362fea.exe |
| unpack001/Red-Flaged/a2c01011d0a2b5ee0a51fae41109e9ccfe2aae16e6c4212addac7f757f23893b.exe |
| unpack001/Red-Flaged/ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe |
| unpack001/Red-Flaged/aca01073676a7e2003ac7af9b27b9aa54c076ea94cf4c9627828b12955261aeb.exe |
| unpack001/Red-Flaged/b0dfaf509de38749c49afcb3cd34d27126044bb77cc16896b02ebced6f95db02.exe |
| unpack001/Red-Flaged/b2e27be69931b678ee13b42f83438dc5.exe |
| unpack001/Red-Flaged/b3da793a00eebaf8987fe2b759369e3d7ff02d91111c219c707bcb9709357637.exe |
| unpack001/Red-Flaged/b8e71845cc8ccd668a3436d1952a6c57649974bb8399e599dc33afc4c0843be7.exe |
| unpack001/Red-Flaged/bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364.exe |
| unpack001/Red-Flaged/c43a34e78ba6913551af41857fb63a3545acd6a9248e8a4de884988b3ccf895d.exe |
| unpack001/Red-Flaged/c46ec6ea17445880cb2bf0750f76af3f4ccea701d07cf83161ca5ef6dd5e10d6.exe |
| unpack001/Red-Flaged/c5f49c0f566a114b529138f8bd222865c9fa9fa95f96ec1ded50700764a1d4e7.exe |
| unpack001/Red-Flaged/c9fd60a7a3974913a39a4dcdad4b4ccaeb93b614741af2eb7ee0d892130689d8.exe |
| unpack001/Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe |
| unpack001/Red-Flaged/d8c5d04d859189de3321a635abcd5ddf84f28f04119830402c66527ae36ae3bc.exe |
| unpack001/Red-Flaged/dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a.exe |
| unpack001/Red-Flaged/df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7403.exe |
| unpack001/Red-Flaged/e62684a48067d8bf5f219f007bb5908301ca3303b9c57a2f0c3212cf0eb8d7b7.exe |
| unpack001/Red-Flaged/f2dc218ea8e2caa8668e54bae6561afd9fbf035a40b80ce9e847664ff0809799.exe |
| unpack001/Red-Flaged/f3a6d4ccdd0f663269c3909e74d6847608b8632fb2814b0436a4532b8281e617.exe |
| unpack001/Red-Flaged/f56f6b9c3ae43c09b288066f6030c19ee9e014194ce11af015b8847426346a13.exe |
| unpack001/Red-Flaged/fe62016faf3115405dd81353fd9077d183c2c38553a6aa8fe0261da4cf45ff0e.exe |
| unpack001/Red-Flaged/ff14655342e9f2d6c62955f89111bded7e4d1f65237201e502fb9b7fbd75c46b.exe |
| unpack001/Red-Flaged/file.exe |
| unpack001/Red-Flaged/hive.exe |
| unpack001/Red-Flaged/jqqvLru0VAiH3z.exe |
| unpack001/Red-Flaged/mCa4SRR.exe |
| unpack001/Red-Flaged/rPO-25-063.exe |
| unpack001/Red-Flaged/rWaybillNo_4630813235.exe |
| unpack001/Red-Flaged/realtek.exe |
| unpack001/Red-Flaged/李济浙直播助手(32版本以上)V1.2.0.exe |
Codesigned binary was signed by an untrusted entity.
| resource |
|---|
| unpack001/Red-Flaged/ChromeSetup_v1.3.87.370.exe |
| unpack001/Red-Flaged/Uniformitarian.exe |
| unpack001/Red-Flaged/VerifierImGui.exe |
Inno Setup installer
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/Fake ID Cards Creator (NEW 2025).exe | innosetup |
| static1/unpack001/Red-Flaged/_1bb10490d6f13e80d874896428908f6b5758b9722b959841c369c6ddc435230e.exe | innosetup |
| static1/unpack001/Red-Flaged/李济浙直播助手(32版本以上)V1.2.0.exe | innosetup |
| resource | yara_rule |
|---|---|
| static1/unpack001/Red-Flaged/2025-11-12_9e11b0e463c9998ddbf018922648ef7e_amadey_cloudeye_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe | nsis_installer_2 |
| static1/unpack001/Red-Flaged/2025-11-13_5dce91e6d4ecc2af605e2eaf5537cb90_amadey_cloudeye_elex_emotet_glassworm_hacktools_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry.exe | nsis_installer_2 |
| static1/unpack001/Red-Flaged/9eda7cc4737b03e47696ef02f8b0c687a6b75a08ba3a7e2ee2941ff9cf05d5b7.exe | nsis_installer_2 |
Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
Unsigned PE
Checks for missing Authenticode signature.
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Jan 1, 0001
Babylon RAT payload
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=225, version=20806,
count=34, id=223, productName=VS2013 build 21005, version=21005,
count=76, id=225, productName=VS2013 build 21005, version=21005,
count=225, id=224, productName=VS2013 build 21005, version=21005,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=331, id=1, productName=Unmarked objects,
count=1, id=224, productName=VS2013 UPD3 build 30723, version=30723,
count=44, id=225, productName=VS2013 UPD3 build 30723, version=30723,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD3 build 30723, version=30723,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=259, version=30795,
count=143, id=261, version=30795,
count=10, id=260, version=30795,
count=1, id=253, version=33731,
count=9, id=259, version=33731,
count=19, id=260, version=33731,
count=46, id=261, version=33731,
count=1, id=262, version=33136,
count=9, id=257, version=33136,
count=131, id=1, productName=Unmarked objects,
count=2, id=261, version=33811,
count=1, id=260, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
Detect XClient Payload
Unsigned PE
Checks for missing Authenticode signature.
Detects Yurei ransomware
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=259, version=26715,
count=147, id=261, version=26715,
count=19, id=260, version=26715,
count=39, id=261, version=28427,
count=17, id=260, version=28427,
count=17, id=259, version=28427,
count=1, id=262, version=26715,
count=15, id=257, version=26715,
count=121, id=1, productName=Unmarked objects,
count=25, id=265, version=28614,
count=1, id=255, productName=VS2019 v16.5.5 build 28614, version=28614,
count=1, id=258, productName=VS2019 v16.5.5 build 28614, version=28614,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=29395,
count=142, id=261, version=29395,
count=20, id=260, version=29395,
count=38, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=17, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=19, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=7, id=257, version=29395,
count=95, id=1, productName=Unmarked objects,
count=1, id=264, version=31328,
count=1, id=255, version=31328,
count=1, id=258, version=31328,
Detects AuraStealer stealer
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE
Checks for missing Authenticode signature.
NSIS installer
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=44, id=19, version=8022,
count=2, id=93, version=2179,
count=688, id=1, productName=Unmarked objects,
count=27, id=19, version=8034,
count=237, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=98, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=100, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=84, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=150, version=20413,
count=45, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=132, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=29, id=123, productName=VS2005 build 50727, version=50727,
count=180, id=1, productName=Unmarked objects,
count=46, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Detect Blackmoon payload
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE
Checks for missing Authenticode signature.
NSIS installer
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=3, id=12, version=7291,
count=8, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=40, id=14, version=7299,
count=174, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=706, id=1, productName=Unmarked objects,
count=43, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=186, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, productName=Unmarked objects (old),
count=28, id=11, productName=VS98 (6.0) build 8168, version=8168,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=259, version=27412,
count=19, id=260, version=27412,
count=181, id=261, version=27412,
count=1, id=262, version=27412,
count=16, id=260, version=32533,
count=10, id=259, version=32533,
count=3, id=261, version=32822,
count=23, id=260, version=32822,
count=100, id=261, version=32533,
count=19, id=257, version=27412,
count=206, id=1, productName=Unmarked objects,
count=9, id=265, version=32822,
count=1, id=255, version=32822,
count=1, id=258, version=32822,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=14, version=7299,
count=2, id=9, version=8783,
count=1, id=13, version=9782,
Unsigned PE
Checks for missing Authenticode signature.
count=21, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=58, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=145, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=27, id=123, productName=VS2005 build 50727, version=50727,
count=210, id=1, productName=Unmarked objects,
count=1, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Detects PennyWise
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Codesign digest Mismatch
File was altered after it was signed.
Jan 1, 0001
Unsigned PE
Checks for missing Authenticode signature.
Detects Nighthawk C2 framework loader
Codesign digest Mismatch
File was altered after it was signed.
Dec 26, 2025
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=138, id=261, version=27412,
count=37, id=261, version=30034,
count=16, id=260, version=30034,
count=9, id=259, version=30034,
count=3, id=257, version=27412,
count=84, id=1, productName=Unmarked objects,
count=1, id=265, version=30140,
count=1, id=255, version=30140,
count=1, id=258, version=30140,
Unsigned PE
Checks for missing Authenticode signature.
Detects BlackLock ransomware
Unsigned PE
Checks for missing Authenticode signature.
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Detects FlyAgent Backdoor
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=6, id=12, version=7291,
count=44, id=19, version=8022,
count=26, id=19, version=8034,
count=702, id=1, productName=Unmarked objects,
count=3, id=93, version=2179,
count=1, id=18, version=8444,
count=97, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=235, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=106, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=91, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=71, id=132, productName=VS2008 build 21022, version=21022,
count=46, id=149, productName=VS2008 build 21022, version=21022,
count=189, id=131, productName=VS2008 build 21022, version=21022,
count=9, id=150, version=20413,
count=44, id=19, version=8022,
count=21, id=19, version=8034,
count=626, id=1, productName=Unmarked objects,
count=33, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=97, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=84, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=32, productName=Unmarked objects (old),
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Detects Mispadu
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
NirSoft MailPassView
Password recovery tool for various email clients
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
Unsigned PE
Checks for missing Authenticode signature.
Detects Lynx Ransomware
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=30795,
count=141, id=261, version=30795,
count=20, id=260, version=30795,
count=38, id=261, version=32533,
count=17, id=260, version=32533,
count=20, id=259, version=32533,
count=19, id=257, version=30795,
count=174, id=1, productName=Unmarked objects,
count=11, id=265, version=32824,
count=1, id=258, version=32824,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=206, version=65501,
count=1, id=207, version=65501,
count=2, id=208, version=65501,
count=35, id=203, version=65501,
count=757, id=1, productName=Unmarked objects,
count=41, id=223, version=20806,
count=179, id=224, version=20806,
count=382, id=225, version=20806,
count=3, id=229, version=21005,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 build 21005, version=21005,
Unsigned PE
Checks for missing Authenticode signature.
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE
Checks for missing Authenticode signature.
NSIS installer
count=5, id=12, version=7291,
count=9, id=11, version=8047,
count=6, id=10, version=8047,
count=44, id=14, version=7299,
count=44, id=19, version=8022,
count=2, id=93, version=2179,
count=688, id=1, productName=Unmarked objects,
count=27, id=19, version=8034,
count=237, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=98, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=100, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=84, productName=Unmarked objects (old),
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=41, id=1, productName=Unmarked objects,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=14, version=7299,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=5, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Codesign digest Mismatch
File was altered after it was signed.
Sep 8, 2017
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Sep 8, 2017
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=1, productName=Unmarked objects,
count=1, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=157, id=261, version=33140,
count=2, id=253, version=35207,
count=8, id=259, version=35207,
count=17, id=260, version=35207,
count=61, id=261, version=35207,
count=11, id=259, version=33140,
count=24, id=260, version=33140,
count=1, id=262, version=33140,
count=7, id=257, version=33140,
count=299, id=1, productName=Unmarked objects,
count=51, id=261, version=35213,
count=1, id=256, version=35213,
count=1, id=255, version=35213,
count=1, id=258, version=35213,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=259, version=33136,
count=142, id=261, version=33136,
count=19, id=260, version=33136,
count=21, id=259, version=33731,
count=17, id=260, version=33731,
count=38, id=261, version=33731,
count=19, id=257, version=33136,
count=178, id=1, productName=Unmarked objects,
count=12, id=261, version=33811,
count=1, id=258, version=33811,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Feb 13, 2024
count=11, id=259, version=30795,
count=176, id=261, version=30795,
count=18, id=260, version=33030,
count=22, id=259, version=33030,
count=23, id=260, version=30795,
count=80, id=261, version=33030,
count=1, id=262, version=30795,
count=11, id=257, version=30795,
count=141, id=1, productName=Unmarked objects,
count=2, id=265, version=33134,
count=1, id=255, version=33134,
count=1, id=151,
count=1, id=258, version=33134,
Unsigned PE
Checks for missing Authenticode signature.
count=31, id=241, version=40116,
count=149, id=243, version=40116,
count=30, id=242, version=40116,
count=4, id=261, version=27034,
count=29, id=259, version=24237,
count=41, id=261, version=24237,
count=18, id=260, version=24237,
count=38, id=260, version=27034,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=301, id=1, productName=Unmarked objects,
count=4, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=151,
count=1, id=258, version=24245,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=316, id=1, productName=Unmarked objects,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=211, version=60610,
count=1, id=201, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,
Unsigned PE
Checks for missing Authenticode signature.
count=26, id=223, productName=VS2013 build 21005, version=21005,
count=64, id=225, productName=VS2013 build 21005, version=21005,
count=179, id=224, productName=VS2013 build 21005, version=21005,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=104, id=1, productName=Unmarked objects,
count=1, id=229, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.
count=183, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33140,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35215,
count=1, id=258, version=35215,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=257, version=27412,
count=1, id=1, productName=Unmarked objects,
count=3, id=259, version=30148,
count=1, productName=Unmarked objects (old),
count=1, id=258, version=30148,
Unsigned PE
Checks for missing Authenticode signature.
Detects Amadey x86-bit Payload
Unsigned PE
Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=54, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=69, id=1, productName=Unmarked objects,
count=10, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Codesign digest Mismatch
File was altered after it was signed.
Dec 26, 2025
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=98, id=1, productName=Unmarked objects,
count=15, id=265, version=25835,
count=1, id=255, productName=VS2017 v15.5.6 build 25835, version=25835,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.5.6 build 25835, version=25835,
RedLine payload
SectopRAT payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=95, version=2179,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=3, id=12, version=7291,
count=1, id=28, version=9178,
count=2, id=25, version=9210,
count=2, id=93, version=2067,
count=10, id=93, version=2179,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=163, id=1, productName=Unmarked objects,
count=3, id=4, version=9782,
count=13, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=89, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=14, version=7299,
count=17, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=152, id=1, productName=Unmarked objects,
count=61, id=19, version=8034,
count=1, productName=Unmarked objects (old),
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=73, id=225, productName=VS2013 build 21005, version=21005,
count=30, id=223, productName=VS2013 build 21005, version=21005,
count=201, id=224, productName=VS2013 build 21005, version=21005,
count=2, id=225, version=20806,
count=4, id=206, version=65501,
count=33, id=203, version=65501,
count=468, id=1, productName=Unmarked objects,
count=101, id=229, version=30501,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=222, productName=VS2013 UPD2 build 30501, version=30501,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=29, version=9037,
count=2, id=25, version=9043,
count=12, productName=Unmarked objects (old),
count=1, id=12, version=7291,
count=3, id=14, version=7299,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=4, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=15, id=19, version=8034,
count=304, id=1, productName=Unmarked objects,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=23, id=11, productName=VS98 (6.0) build 8168, version=8168,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Dec 26, 2025
Dec 26, 2025
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Nov 8, 2025
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=12, version=7291,
count=1, id=11, version=8047,
count=4, id=14, version=7299,
count=11, id=10, version=8047,
count=4, id=4, version=8047,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=7, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
Detect Xworm Payload
Detects Umbral payload
Unsigned PE
Checks for missing Authenticode signature.
Detects Sheetrat Obfuscated Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
Unsigned PE
Checks for missing Authenticode signature.
Detects Umbral payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Codesign digest Mismatch
File was altered after it was signed.
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer
Feb 14, 2023
SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=SYS BG-PC BU-SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=257, version=34808,
count=1, id=260, version=34808,
count=12, id=259, version=34321,
count=12, id=260, version=34321,
count=66, id=261, version=34321,
count=7, id=257, version=33138,
count=168, id=1, productName=Unmarked objects,
count=2, id=261, version=34436,
count=1, id=255, version=34436,
count=1, id=258, version=34436,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=2, id=1, productName=Unmarked objects,
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
RevengeRat Executable
Unsigned PE
Checks for missing Authenticode signature.
Detects Windows variant of BlackNevas ransomware
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=241, version=40116,
count=149, id=243, version=40116,
count=24, id=242, version=40116,
count=38, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=162, id=1, productName=Unmarked objects,
count=21, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=265, version=27045,
count=1, id=255, version=27045,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
Detects DuplexSpyRAT
Unsigned PE
Checks for missing Authenticode signature.
Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE
Checks for missing Authenticode signature.
Detects Windows variant of BlackNevas ransomware
Unsigned PE
Checks for missing Authenticode signature.
Detect SalatStealer payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=32, id=171, productName=VS2010 build 30319, version=30319,
count=108, id=170, productName=VS2010 build 30319, version=30319,
count=9, id=158, productName=VS2010 build 30319, version=30319,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=2, id=175, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=153, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=158, id=1, productName=Unmarked objects,
count=15, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Detects ArcaneStealer in memory.
Unsigned PE
Checks for missing Authenticode signature.
Detects Cosmu payload
Cosmu is a worm written in C++.
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=19, version=8034,
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=74, id=1, productName=Unmarked objects,
count=3, id=4, version=9782,
count=3, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=259, version=33140,
count=145, id=261, version=33140,
count=19, id=260, version=33140,
count=20, id=259, version=34321,
count=18, id=260, version=34321,
count=41, id=261, version=34321,
count=19, id=257, version=33140,
count=158, id=1, productName=Unmarked objects,
count=15, id=261, version=34808,
count=1, id=258, version=34808,
Detect Neshta payload
Detects JLocker ransomware.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=142, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=40, id=261, version=35207,
count=3, id=257, version=33145,
count=109, id=1, productName=Unmarked objects,
count=1, id=261, version=35219,
count=1, id=258, version=35219,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=33030,
count=30, id=261, version=33030,
count=10, id=260, version=33030,
count=4, id=259, version=33030,
count=24, id=257, version=30151,
count=334, id=1, productName=Unmarked objects,
count=14, productName=Unmarked objects (old),
count=1, id=255, version=33134,
count=1, id=258, version=33134,
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=259, version=30795,
count=171, id=261, version=30795,
count=1, id=262, version=30795,
count=22, id=260, version=30795,
count=21, id=259, version=33808,
count=18, id=260, version=33808,
count=85, id=261, version=33808,
count=7, id=260, version=33811,
count=23, id=257, version=30795,
count=226, id=1, productName=Unmarked objects,
count=21, id=265, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
Unsigned PE
Checks for missing Authenticode signature.
Detects Bert Ransomware Windows Version
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=128, version=50727,
count=4, id=132, productName=VS2008 build 21022, version=21022,
count=72, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=688, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=123, productName=VS2005 build 50727, version=50727,
count=236, id=1, productName=Unmarked objects,
count=10, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=19, id=149, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=48, id=132, productName=VS2008 build 21022, version=21022,
count=142, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=142, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=40, id=261, version=35207,
count=3, id=257, version=33145,
count=106, id=1, productName=Unmarked objects,
count=1, id=261, version=35219,
count=1, id=258, version=35219,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=260, version=27412,
count=5, id=259, version=27412,
count=138, id=261, version=27412,
count=37, id=261, version=26706,
count=16, id=260, version=26706,
count=8, id=259, version=26706,
count=5, id=257, version=27412,
count=97, id=1, productName=Unmarked objects,
count=1, id=260, version=27054,
count=1, id=258, version=27054,
Unsigned PE
Checks for missing Authenticode signature.
count=15, id=257, version=33140,
count=134, id=1, productName=Unmarked objects,
count=85, productName=Unmarked objects (old),
count=1, id=255, version=35211,
count=1, id=258, version=35211,
Unsigned PE
Checks for missing Authenticode signature.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=199, version=41118,
count=51, id=205, version=50929,
count=174, id=206, version=50929,
count=50, id=207, version=50929,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=532, id=1, productName=Unmarked objects,
count=77, id=216, version=61030,
count=2, id=205, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Quasar payload
Unsigned PE
Checks for missing Authenticode signature.
Codesign digest Mismatch
File was altered after it was signed.
Jan 14, 2025
count=28, id=259, version=30795,
count=40, id=260, version=30795,
count=211, id=261, version=30795,
count=1, id=262, version=30795,
count=45, id=257, version=30795,
count=872, id=1, productName=Unmarked objects,
count=25, id=259, version=34321,
count=21, id=260, version=34321,
count=421, id=261, version=34321,
count=43, id=265, version=34436,
count=1, id=255, version=34436,
count=3, id=151,
count=1, id=258, version=34436,
A stealer written in Python and packaged with Pyinstaller
Codesign digest Mismatch
File was altered after it was signed.
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
count=183, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33140,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35215,
count=1, id=258, version=35215,
Unsigned PE
Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.
Inno Setup installer