Ghost-Windows.zip
- SHA256 bd3e94c6d782e4eb0e129b8f146ddec1555ec7a7996da7b205d1a0319f2fb311
Behavioral task
behavioral1
Sample
Ghost-Windows.zip
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral2
Sample
Ghost-Windows/ghost-main/.venv/Lib/site-packages/pip/_internal/network/cache.py
Resource
win11ltsc2024-20260710-en
File was altered after it was signed.
| resource |
|---|
| unpack001/Ghost-Windows/ghost-main/.venv/Scripts/Activate.ps1 |
| resource | yara_rule |
|---|---|
| static1/unpack001/Ghost-Windows/Ghost.exe | pyinstaller |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Ghost-Windows/Ghost.exe |
| unpack001/Ghost-Windows/ghost-main/.venv/Lib/site-packages/pip/_vendor/distlib/t32.exe |
| unpack001/Ghost-Windows/ghost-main/.venv/Lib/site-packages/pip/_vendor/distlib/t64.exe |
| unpack001/Ghost-Windows/ghost-main/.venv/Lib/site-packages/pip/_vendor/distlib/w32.exe |
| unpack001/Ghost-Windows/ghost-main/.venv/Lib/site-packages/pip/_vendor/distlib/w64.exe |
| unpack001/Ghost-Windows/ghost-main/.venv/Scripts/pip.exe |
| unpack001/Ghost-Windows/ghost-main/.venv/Scripts/pip3.14.exe |
| unpack001/Ghost-Windows/ghost-main/.venv/Scripts/pip3.exe |
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=33, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=15, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=121, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=33, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=118, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=33, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=15, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=118, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=33, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=115, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Codesign digest Mismatch
File was altered after it was signed.
Jun 10, 2026
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=33, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=118, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=33, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=118, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=152, version=20115,
count=33, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=118, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Jun 10, 2026
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
count=143, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=2, id=257, version=33145,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=105, id=1, productName=Unmarked objects,
count=1, id=264, version=35227,
count=1, id=255, version=35227,
count=1, id=258, version=35227,
Jun 10, 2026
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
count=144, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=4, id=257, version=33145,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=1, productName=Unmarked objects,
count=1, id=264, version=35227,
count=1, id=255, version=35227,
count=1, id=258, version=35227,