LeLow-Bootp1.zip
- SHA256 6920145c6c9d077785c9a8d2ee29171423865f0ea6355f08c8f16f4e359a6fcf
Static task
static1
Behavioral task
behavioral1
Sample
LeLow-Bootp1.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
LeLow-Bootp1.zip
Resource
win11ltsc2024-20260618-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack002/mpclient.dll |
File was codesigned using an insecure algorithm.
| resource |
|---|
| unpack002/local_bin/temp/libGLESv2.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack002/local_bin/EqualizerAPO.dll |
| unpack002/local_bin/Qt5Core.dll |
| unpack002/local_bin/libfftw3f-3.dll |
| unpack002/local_bin/libsndfile-1.dll |
| unpack002/presets/check_fnis.dll |
| unpack002/presets/diagnose_basic.dll |
| unpack002/presets/game_enderal.dll |
| unpack002/presets/game_ttw.dll |
| unpack002/presets/inibakery.dll |
| unpack002/presets/inieditor.dll |
| unpack002/presets/installer_bain.dll |
| unpack002/presets/installer_bundle.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack002/mpclient.dll |
Nov 6, 2023
CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=37, id=260, version=32595,
count=229, id=261, version=32595,
count=23, id=259, version=32595,
count=31, id=257, version=32595,
count=434, id=1, productName=Unmarked objects,
count=10, id=126, version=50727,
count=175, id=265, version=32595,
count=1, id=255, version=32595,
count=1, id=258, version=32595,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=6, id=257, version=30034,
count=2, id=260, version=27412,
count=1, id=262, version=27412,
count=2, id=257, productName=VS2019 v16.9.2 build 29913, version=29913,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=24, id=261, version=30034,
count=3, id=263, version=27412,
count=23, id=257, version=27412,
count=388, id=1, productName=Unmarked objects,
count=36, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=51, id=265, version=30142,
count=1, id=256, version=30142,
count=1, id=255, version=30142,
count=1, id=151,
count=1, id=258, version=30142,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=257, productName=VS2019 v16.9.2 build 29913, version=29913,
count=4, id=253, version=28518,
count=30, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=8, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=4, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=2, id=260, version=27412,
count=1, id=262, version=27412,
count=23, id=257, version=27412,
count=342, id=1, productName=Unmarked objects,
count=44, id=260, productName=VS2019 v16.9.4 build 29914, version=29914,
count=255, id=261, productName=VS2019 v16.9.4 build 29914, version=29914,
count=1, id=256, productName=VS2019 v16.9.4 build 29914, version=29914,
count=1, id=255, productName=VS2019 v16.9.4 build 29914, version=29914,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.9.4 build 29914, version=29914,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
May 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=28900,
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=207, id=1, productName=Unmarked objects,
count=5, id=257, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=142, id=261, version=30034,
count=1, id=256, version=30034,
count=1, id=255, version=30034,
count=1, id=258, version=30034,
May 19, 2021
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=28900,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=260, version=30034,
count=2, id=259, version=30034,
count=41, id=1, productName=Unmarked objects,
count=5, id=257, version=30034,
count=19, id=261, version=30034,
count=1, id=256, version=30034,
count=1, id=255, version=30034,
count=1, id=258, version=30034,
Aug 22, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Aug 22, 2013
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=54, id=207, version=41209,
count=1, id=206, version=41209,
count=3, id=207, version=65501,
count=12, id=205, version=65501,
count=211, id=1, productName=Unmarked objects,
count=9, id=203, version=65501,
count=16, id=206, version=65501,
count=1, id=202, version=65501,
count=132, id=211, version=65501,
count=1, id=201, version=65501,
count=1, id=204, version=65501,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Sep 3, 2020
CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,ST=Oulu,C=FI
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 19, 2026
CN=tycsports.com,O=MOphJuZKOzQd,L=LydRNM,ST=lmz62Al,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=21, id=261, version=33731,
count=6, id=257, version=33731,
count=2, id=257, version=30795,
count=4, id=257, version=30151,
count=3, id=257, version=33813,
count=139, id=1, productName=Unmarked objects,
count=2, id=261, version=33813,
count=1, id=256, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=33731,
count=8, id=260, version=33731,
count=23, id=261, version=33731,
count=6, id=257, version=33731,
count=2, id=257, version=30795,
count=4, id=257, version=30151,
count=3, id=257, version=33813,
count=284, id=1, productName=Unmarked objects,
count=2, id=261, version=33813,
count=1, id=256, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=29, id=261, version=33731,
count=6, id=257, version=33731,
count=6, id=257, version=30151,
count=1, id=262, version=30795,
count=2, id=257, version=31630,
count=6, id=260, version=33813,
count=3, id=257, version=33813,
count=10, id=257, version=30795,
count=551, id=1, productName=Unmarked objects,
count=22, id=261, version=33813,
count=1, id=256, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=29, id=261, version=33731,
count=6, id=257, version=33731,
count=6, id=257, version=30151,
count=1, id=262, version=30795,
count=2, id=257, version=31630,
count=6, id=260, version=33813,
count=3, id=257, version=33813,
count=10, id=257, version=30795,
count=547, id=1, productName=Unmarked objects,
count=20, id=261, version=33813,
count=1, id=256, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=20, id=261, version=33731,
count=6, id=257, version=33731,
count=2, id=257, version=30795,
count=2, id=257, version=30151,
count=3, id=257, version=33813,
count=89, id=1, productName=Unmarked objects,
count=2, id=261, version=33813,
count=1, id=256, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=20, id=261, version=33731,
count=6, id=257, version=33731,
count=6, id=257, version=30151,
count=4, id=257, version=30795,
count=3, id=257, version=33813,
count=159, id=1, productName=Unmarked objects,
count=3, id=261, version=33813,
count=1, id=256, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=21, id=261, version=33731,
count=6, id=257, version=33731,
count=2, id=257, version=30795,
count=6, id=257, version=30151,
count=3, id=257, version=33813,
count=417, id=1, productName=Unmarked objects,
count=3, id=261, version=33813,
count=1, id=256, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=21, id=261, version=33731,
count=6, id=257, version=33731,
count=2, id=257, version=30795,
count=4, id=257, version=30151,
count=3, id=257, version=33813,
count=276, id=1, productName=Unmarked objects,
count=3, id=261, version=33813,
count=1, id=256, version=33813,
count=1, id=255, version=33813,
count=1, id=258, version=33813,