Setup_File_16.758.7808.zip
- SHA256 a7939b429f50866c8b6bae8d4d1af7154f3e82efa077a9a4688e593bd0bc1e71
Static task
static1
Behavioral task
behavioral1
Sample
Setup_File_50.155.8534.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Setup_File_50.155.8534.exe
Resource
win10ltsc2021-20260513-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/borlndmm.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/borlndmm.dll |
Aug 22, 2022
CN=ACCA software S.p.A.,O=ACCA software S.p.A.,L=BAGNOLI IRPINO,ST=AVELLINO,C=IT
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=29395,
count=188, id=261, version=29395,
count=24, id=260, version=29395,
count=16, id=260, version=30625,
count=10, id=259, version=30625,
count=83, id=261, version=30625,
count=1, id=173, version=30319,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=173, id=1, productName=Unmarked objects,
count=329, id=261, version=30706,
count=1, id=256, version=30706,
count=1, id=255, version=30706,
count=1, id=258, version=30706,