76cd69aed94747cb8785f610312640347348fde87277564e69db5e6a6797734b
- SHA256 76cd69aed94747cb8785f610312640347348fde87277564e69db5e6a6797734b
Overview
overview
10Static
static
10MSVCP140.dll
windows10-2004-x64
1MSVCP140.dll
windows11-ltsc_2024-x64
1TenioDL_core.dll
windows10-2004-x64
1TenioDL_core.dll
windows11-ltsc_2024-x64
1VCRUNTIME140.dll
windows10-2004-x64
1VCRUNTIME140.dll
windows11-ltsc_2024-x64
1caesalpiniaceous.exe
windows10-2004-x64
1caesalpiniaceous.exe
windows11-ltsc_2024-x64
1vcruntime140_1.dll
windows10-2004-x64
1vcruntime140_1.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
MSVCP140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
MSVCP140.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
TenioDL_core.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
TenioDL_core.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
VCRUNTIME140.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
VCRUNTIME140.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
caesalpiniaceous.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
caesalpiniaceous.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral9
Sample
vcruntime140_1.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
vcruntime140_1.dll
Resource
win11ltsc2024-20260709-en
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
| resource | yara_rule |
|---|---|
| static1/unpack001/emjio.tmp | family_donutloader |
One or more certificates in the signing chain have been revoked, indicating potential compromise.
| resource |
|---|
| unpack001/caesalpiniaceous.exe |
File was altered after it was signed.
| resource |
|---|
| unpack001/TenioDL_core.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/caesalpiniaceous.exe |
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=26706,
count=197, id=1, productName=Unmarked objects,
count=3, id=259, version=26706,
count=75, id=260, version=26706,
count=78, id=261, version=26706,
count=1, id=256, version=26706,
count=1, id=255, version=26706,
count=1, id=258, version=26706,
Codesign digest Mismatch
File was altered after it was signed.
Sep 10, 2025
SERIALNUMBER=9131011434217342X2,CN=Shanghai Lilith Network Technology Co.\, Ltd.,O=Shanghai Lilith Network Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
SERIALNUMBER=9131011434217342X2,CN=Shanghai Lilith Network Technology Co.\, Ltd.,O=Shanghai Lilith Network Technology Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=35207,
count=8, id=260, version=35207,
count=23, id=261, version=35207,
count=6, id=257, version=35207,
count=5, id=257, version=26715,
count=78, id=1, productName=Unmarked objects,
count=2, id=265, version=35222,
count=1, id=256, version=35222,
count=1, id=255, version=35222,
count=1, id=258, version=35222,
Jan 19, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 19, 2024
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=29395,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=1, productName=Unmarked objects,
count=1, productName=Unmarked objects (old),
count=21, id=259, version=33030,
count=16, id=260, version=33030,
count=31, id=261, version=33030,
count=1, id=256, version=33030,
count=1, id=255, version=33030,
count=1, id=258, version=33030,
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Mar 24, 2017
CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Mar 24, 2017
CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN
count=97, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=98, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Detects DonutLoader
Jan 19, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 19, 2024
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=29395,
count=2, id=257, version=33030,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=51, id=1, productName=Unmarked objects,
count=5, id=259, version=33030,
count=7, id=260, version=33030,
count=27, id=261, version=33030,
count=1, id=256, version=33030,
count=1, id=255, version=33030,
count=1, id=258, version=33030,