smss
- SHA256 88a8d6c28fcd9b72d67b5bbb128d451d3f81f77efe6d53a6f6acca4a3c74b075
Behavioral task
behavioral1
Sample
smss.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
smss.exe
Resource
win11-20260130-en
| resource | yara_rule |
|---|---|
| static1/unpack001/smss.exe | pyinstaller |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Chrome-bin/chromedriver.exe |
| unpack001/Chrome-bin/chromedrivers.exe |
| unpack001/Interop.SHDocVw.dll |
| unpack001/cefpython3/cefpython_py36.pyd |
| unpack001/conhost.exe |
| unpack001/s.exe |
| unpack001/smss.exe |
| unpack001/subprocess.exe |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/unicodedata.pyd |
Apr 28, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Apr 28, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=3, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=188, version=30716,
count=43, id=171, productName=VS2010 build 30319, version=30319,
count=18, id=158, productName=VS2010 build 30319, version=30319,
count=105, id=170, productName=VS2010 build 30319, version=30319,
count=198, id=1, productName=Unmarked objects,
count=21, id=185, version=30716,
count=1, id=132, productName=VS2008 build 21022, version=21022,
count=69, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Nov 6, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 6, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=18, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=101, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=347, id=1, productName=Unmarked objects,
count=105, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Sep 3, 2021
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
May 8, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=28900,
count=141, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=61, id=261, version=27316,
count=1, id=260, version=27316,
count=1, id=253, version=28900,
count=65, id=259, version=28900,
count=219, id=261, version=28900,
count=1, id=256, version=28900,
count=136, id=264, version=28900,
count=51, id=260, version=28900,
count=1, id=255, version=28900,
count=1, id=258, version=28900,
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Feb 11, 2022
CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=19, id=261, version=29118,
count=10, id=260, version=29118,
count=1, id=259, version=29118,
count=4, id=257, version=29118,
count=2, id=257, productName=VS2017 v15.9.4 build 27025, version=27025,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=3, id=257, productName=VS2017 v15.5.2 build 25831, version=25831,
count=458, id=1, productName=Unmarked objects,
count=31, id=265, version=29337,
count=1, id=256, productName=VS2019 v16.8.5 build 29337, version=29337,
count=1, id=255, productName=VS2019 v16.8.5 build 29337, version=29337,
count=1, id=258, productName=VS2019 v16.8.5 build 29337, version=29337,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=241, version=40116,
count=141, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=199, version=41118,
count=22, id=259, version=24123,
count=19, id=260, version=24123,
count=44, id=261, version=24123,
count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=266, id=1, productName=Unmarked objects,
count=49, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=241, version=40116,
count=172, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=24123,
count=29, id=261, version=24123,
count=18, id=260, version=24123,
count=7, id=203, version=65501,
count=115, id=1, productName=Unmarked objects,
count=17, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=123, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, productName=VS2017 v15.5.2 build 25831, version=25831,
count=216, id=1, productName=Unmarked objects,
count=162, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 27, 2018
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=StartCom Class 3 Object CA,OU=StartCom Certification Authority,O=StartCom Ltd.,C=IL
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=24123,
count=1, id=259, version=24123,
count=11, id=261, version=24123,
count=11, id=260, version=24123,
count=3, id=257, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=2, id=257, version=24610,
count=64, id=1, productName=Unmarked objects,
count=1, id=264, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,