Persistence.zip
- SHA256 232c91dd976bb6b18f7838e4bb2c1c07f3e9d4d58180a3533b065ba17cae4694
Overview
overview
8Static
static
5AXEDOMCore.dll
windows10-2004-x64
1AXEDOMCore.dll
windows11-ltsc_2024-x64
1AdbePM.dll
windows10-2004-x64
1AdbePM.dll
windows11-ltsc_2024-x64
1Builder.dll
windows10-2004-x64
1Builder.dll
windows11-ltsc_2024-x64
1Launcher.exe
windows10-2004-x64
1Launcher.exe
windows11-ltsc_2024-x64
5adobe_caps.dll
windows10-2004-x64
1adobe_caps.dll
windows11-ltsc_2024-x64
1dvacore.dll
windows10-2004-x64
1dvacore.dll
windows11-ltsc_2024-x64
1dynamiclink.dll
windows10-2004-x64
1dynamiclink.dll
windows11-ltsc_2024-x64
1icuuc64.dll
windows10-2004-x64
1icuuc64.dll
windows11-ltsc_2024-x64
1igestep30.dll
windows10-2004-x64
1igestep30.dll
windows11-ltsc_2024-x64
1lgpllibs.dll
windows10-2004-x64
1metadata/CRClient.dll
windows10-2004-x64
1metadata/CRClient.dll
windows11-ltsc_2024-x64
1metadata/d...al.dll
windows10-2004-x64
1metadata/d...al.dll
windows11-ltsc_2024-x64
1version.dll
windows10-2004-x64
8version.dll
windows11-ltsc_2024-x64
8Static task
static1
Behavioral task
behavioral1
Sample
AXEDOMCore.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
AXEDOMCore.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral3
Sample
AdbePM.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
AdbePM.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Builder.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Builder.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
Launcher.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Launcher.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
adobe_caps.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
adobe_caps.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
dvacore.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
dvacore.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
dynamiclink.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
dynamiclink.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
icuuc64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
icuuc64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
igestep30.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
igestep30.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
lgpllibs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
metadata/CRClient.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral21
Sample
metadata/CRClient.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral22
Sample
metadata/dvamarshal.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral23
Sample
metadata/dvamarshal.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral24
Sample
version.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
version.dll
Resource
win11ltsc2024-20260710-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/version.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/version.dll |
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=17, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=259, version=26706,
count=3, id=257, version=26213,
count=82, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=4, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=260, version=26706,
count=6, id=259, version=26706,
count=26, id=261, version=26706,
count=4, id=257, version=26706,
count=48, productName=Unmarked objects (old),
count=2, id=257, productName=VS2017 v15.6.7 build 26132, version=26132,
count=2, id=257, version=25203,
count=9, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=258, id=1, productName=Unmarked objects,
count=1, id=259, productName=VS2017 v15.9.11 build 27030, version=27030,
count=74, id=265, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Aug 22, 2025
CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
count=34, id=241, version=40116,
count=211, id=243, version=40116,
count=59, id=242, version=40116,
count=1, id=135, version=30729,
count=2, id=261, version=23013,
count=43, id=260, version=24123,
count=15, id=259, version=24123,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=3, productName=Unmarked objects (old),
count=1, id=136, version=30729,
count=1, id=173, version=30319,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1115, id=1, productName=Unmarked objects,
count=452, id=261, version=24123,
count=759, id=265, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=241, version=40116,
count=174, id=243, version=40116,
count=26, id=242, version=40116,
count=2, id=261, version=23013,
count=8, id=259, version=23907,
count=56, id=261, version=23907,
count=67, id=260, version=23907,
count=280, id=1, productName=Unmarked objects,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=264, version=23918,
count=18, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=24123,
count=11, id=260, version=24123,
count=4, id=257, version=24123,
count=24, id=261, version=24123,
count=3, id=206, version=65501,
count=1, id=208, version=65501,
count=10, id=257, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=25, id=203, version=65501,
count=623, id=1, productName=Unmarked objects,
count=9, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=171, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=24123,
count=21, id=261, version=24123,
count=11, id=260, version=24123,
count=4, id=257, version=24123,
count=6, id=203, version=65501,
count=13, id=257, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=289, id=1, productName=Unmarked objects,
count=39, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=13, id=241, version=40116,
count=125, id=243, version=40116,
count=20, id=242, version=40116,
count=8, id=259, version=26706,
count=102, id=261, version=26706,
count=16, id=260, version=26706,
count=2, id=203, version=65501,
count=3, id=257, version=27031,
count=141, id=1, productName=Unmarked objects,
count=190, id=261, version=27031,
count=1, id=256, version=27031,
count=1, id=255, version=27031,
count=1, id=151,
count=1, id=258, version=27031,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=199, version=41118,
count=25, id=261, version=26706,
count=8, id=260, version=26706,
count=3, id=259, version=26706,
count=4, id=257, version=26706,
count=4, id=257, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=265, version=27030,
count=5, id=257, version=25203,
count=476, id=1, productName=Unmarked objects,
count=5, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,
count=34, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Jun 6, 2024
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=24123,
count=11, id=260, version=24123,
count=4, id=257, version=24123,
count=21, id=261, version=24123,
count=1, id=208, version=65501,
count=17, id=203, version=65501,
count=428, id=1, productName=Unmarked objects,
count=10, id=265, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=23, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=24123,
count=20, id=261, version=24123,
count=11, id=260, version=24123,
count=4, id=257, version=24123,
count=2, id=203, version=65501,
count=7, id=257, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=147, id=1, productName=Unmarked objects,
count=6, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=137, id=261, version=33145,
count=15, id=260, version=33145,
count=17, id=259, version=33145,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=38, id=261, version=35207,
count=3, id=257, version=33145,
count=107, id=1, productName=Unmarked objects,
count=1, id=261, version=35225,
count=1, id=259, version=35225,
count=1, id=256, version=35225,
count=1, id=255, version=35225,
count=1, id=151,
count=1, id=258, version=35225,