Fling-Standalone35.296.11019.zip
- SHA256 a6faa7f18c3298bed705ab9aa8f4ec974fdcf591d223586146d43eca0e7d3c02
Static task
static1
Behavioral task
behavioral1
Sample
Fling-Standalone35.296.11019.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Fling-Standalone35.296.11019.zip
Resource
win11-20260513-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/borlndmm.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/borlndmm.dll |
Aug 22, 2022
CN=ACCA software S.p.A.,O=ACCA software S.p.A.,L=BAGNOLI IRPINO,ST=AVELLINO,C=IT
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=29395,
count=188, id=261, version=29395,
count=24, id=260, version=29395,
count=16, id=260, version=30625,
count=10, id=259, version=30625,
count=83, id=261, version=30625,
count=1, id=173, version=30319,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=173, id=1, productName=Unmarked objects,
count=329, id=261, version=30706,
count=1, id=256, version=30706,
count=1, id=255, version=30706,
count=1, id=258, version=30706,