PaleGreenGold.7z
- SHA256 3e0676a8197f6c56c7ed034d2877740b47da42fd20abc16215ee635ee0e01df9
Static task
static1
Behavioral task
behavioral1
Sample
PaleGreenGold/spkvol.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
PaleGreenGold/spkvol.dll
Resource
win11ltsc2024-20260629-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/PaleGreenGold/spkvol.dll |
| unpack001/PaleGreenGold/vcruntime140.dll |
| unpack001/PaleGreenGold/vcruntime140.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/PaleGreenGold/MSVCP140.dll |
| unpack001/PaleGreenGold/spkvol.dll |
| unpack001/PaleGreenGold/vcruntime140.dll |
Feb 21, 2025
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Feb 14, 2025
CN=Lenovo,OU=G17,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Lenovo,OU=G17,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=2, id=263, version=29395,
count=1, id=253, version=34321,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=6, id=257, version=34321,
count=46, id=261, version=34321,
count=5, id=260, version=29395,
count=4, id=262, version=29395,
count=38, id=257, version=29395,
count=3, id=261, version=34435,
count=3, id=257, version=34435,
count=481, id=1, productName=Unmarked objects,
count=69, id=265, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=31, id=151,
count=1, id=258, version=34435,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=257, version=30795,
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=197, id=1, productName=Unmarked objects,
count=5, id=257, version=33731,
count=4, id=259, version=33731,
count=8, id=260, version=33731,
count=143, id=261, version=33731,
count=1, id=256, version=33731,
count=1, id=255, version=33731,
count=1, id=258, version=33731,
Feb 21, 2025
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 22, 2020
CN=Lenovo,OU=G07,O=Lenovo,L=Morrisville,ST=North Carolina,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
count=12, id=241, version=40116,
count=172, id=243, version=40116,
count=28, id=242, version=40116,
count=8, id=259, version=24123,
count=116, id=261, version=24123,
count=38, id=260, version=24123,
count=2, id=261, version=23013,
count=3, productName=Unmarked objects (old),
count=4, id=260, version=27031,
count=2, id=208, version=65501,
count=25, id=203, version=65501,
count=254, id=1, productName=Unmarked objects,
count=23, id=265, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=239, version=40116,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=1, productName=Unmarked objects,
count=12, id=259, version=26706,
count=16, id=260, version=26706,
count=31, id=261, version=26706,
count=1, id=256, version=26706,
count=1, id=255, version=26706,
count=1, id=258, version=26706,
Jul 18, 2025
CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK
CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK
CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=30795,
count=2, id=257, version=35207,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=53, id=1, productName=Unmarked objects,
count=7, id=260, version=35207,
count=27, id=261, version=35207,
count=5, id=259, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,