a6471a2c254aa8b00a6202aa087c9a2b345a7927c0109a8900db273988ddb02d.lzh
- SHA256 a6471a2c254aa8b00a6202aa087c9a2b345a7927c0109a8900db273988ddb02d
Overview
overview
10Static
static
10DOCUMENTOS...DF.exe
windows10-2004-x64
10DOCUMENTOS...DF.exe
windows11-21h2-x64
10DOCUMENTOS...40.dll
windows10-2004-x64
3DOCUMENTOS...40.dll
windows11-21h2-x64
3DOCUMENTOS...re.dll
windows10-2004-x64
3DOCUMENTOS...re.dll
windows11-21h2-x64
3DOCUMENTOS...ui.dll
windows10-2004-x64
3DOCUMENTOS...ui.dll
windows11-21h2-x64
3DOCUMENTOS...rk.dll
windows10-2004-x64
3DOCUMENTOS...rk.dll
windows11-21h2-x64
3DOCUMENTOS...ts.dll
windows10-2004-x64
3DOCUMENTOS...ts.dll
windows11-21h2-x64
3DOCUMENTOS...ml.dll
windows10-2004-x64
3DOCUMENTOS...ml.dll
windows11-21h2-x64
3DOCUMENTOS...40.dll
windows10-2004-x64
3DOCUMENTOS...40.dll
windows11-21h2-x64
3Behavioral task
behavioral1
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/001_CITACION DEMANDA JUZGADO PENAL.PDF.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/001_CITACION DEMANDA JUZGADO PENAL.PDF.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/MSVCP140.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/MSVCP140.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Core.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Core.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Gui.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Gui.dll
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Network.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Network.dll
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Widgets.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Widgets.dll
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Xml.dll
Resource
win10v2004-20260129-en
Behavioral task
behavioral14
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Xml.dll
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/VCRUNTIME140.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/VCRUNTIME140.dll
Resource
win11-20260130-en
hijackloader
%APPDATA%\extprompt
%windir%\SysWOW64\input.dll
| resource | yara_rule |
|---|---|
| static1/unpack001/DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/proxy.json | family_hijackloader |
File was altered after it was signed.
| resource |
|---|
| unpack001/DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Network.dll |
File was Codesigned using an insecure algorithm.
| resource |
|---|
| unpack001/DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/001_CITACION DEMANDA JUZGADO PENAL.PDF.exe |
Codesigned binary was signed by an untrusted entity.
| resource |
|---|
| unpack001/DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Core.dll |
| unpack001/DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Gui.dll |
| unpack001/DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Widgets.dll |
| unpack001/DOCUMENTOS DE JUZGADO PENAL CON FUNCION DE CONTROL DE GARANTIAS/Qt5Xml.dll |
Insecure Codesign Algorithm
File was Codesigned using an insecure algorithm.
Jun 11, 2020
CN=Shenzhen Moyea Software,O=Shenzhen Moyea Software,L=ShenZhen,ST=GuangDong,C=CN
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=28, id=261, version=26706,
count=12, id=260, version=26706,
count=5, id=259, version=26706,
count=4, id=257, version=26706,
count=10, id=257, version=26213,
count=11, id=257, version=27034,
count=492, id=1, productName=Unmarked objects,
count=1, id=261, version=27034,
count=14, id=261, version=27040,
count=1, id=255, version=27040,
count=1, id=151,
count=1, id=258, version=27040,
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=191, id=1, productName=Unmarked objects,
count=3, id=257, version=26706,
count=8, id=259, version=26706,
count=78, id=260, version=26706,
count=76, id=261, version=26706,
count=1, id=256, version=26706,
count=1, id=255, version=26706,
count=1, id=258, version=26706,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Mar 27, 2020
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=26706,
count=4, id=199, version=41118,
count=28, id=261, version=26706,
count=10, id=260, version=26706,
count=13, id=259, version=26706,
count=2, id=260, version=26715,
count=1, id=262, version=26715,
count=23, id=257, version=26715,
count=328, id=1, productName=Unmarked objects,
count=45, id=260, version=27034,
count=251, id=261, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Mar 27, 2020
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=26706,
count=12, id=259, version=26706,
count=24, id=261, version=26706,
count=4, id=257, version=26706,
count=2, id=257, version=27034,
count=1, id=261, version=26715,
count=13, id=257, version=26715,
count=1607, id=1, productName=Unmarked objects,
count=16, id=260, version=27034,
count=361, id=261, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
Codesign digest Mismatch
File was altered after it was signed.
Mar 27, 2020
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=260, version=26715,
count=10, id=260, version=26706,
count=4, id=259, version=26706,
count=24, id=261, version=26706,
count=4, id=257, version=26706,
count=14, id=257, version=26715,
count=3, id=257, version=27034,
count=1020, id=1, productName=Unmarked objects,
count=134, id=261, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Mar 27, 2020
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=26706,
count=9, id=259, version=26706,
count=24, id=261, version=26706,
count=4, id=257, version=26706,
count=1, id=260, version=26715,
count=14, id=257, version=26715,
count=5, id=257, version=27034,
count=3382, id=1, productName=Unmarked objects,
count=187, id=261, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
Mar 27, 2020
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=2, id=257, version=26715,
count=18, id=261, version=26706,
count=10, id=260, version=26706,
count=1, id=259, version=26706,
count=3, id=257, version=27034,
count=172, id=1, productName=Unmarked objects,
count=2, id=261, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=40, id=1, productName=Unmarked objects,
count=19, id=259, version=26706,
count=20, id=260, version=26706,
count=27, id=261, version=26706,
count=1, id=256, version=26706,
count=1, id=255, version=26706,
count=1, id=258, version=26706,
Detects HijackLoader (aka IDAT Loader)