bin.rar
- SHA256 b8e10c34b86d4ba87f8ff6cdb971d46907c1c6e7df714bf9c7c8d53efc99a3c5
Static task
static1
Behavioral task
behavioral1
Sample
bin.rar
Resource
win11ltsc2024-20260709-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/bin/ucrtbased.dll |
| unpack001/bin/ucrtbased.dll |
| unpack001/bin/ucrtbased.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/bin/GhostClient.exe |
| unpack001/bin/GhostDriver.sys |
| unpack001/bin/GhostFN.exe |
| unpack001/bin/detectedstockkdmapper.exe |
| unpack001/bin/ucrtbased.dll |
Unsigned PE
Checks for missing Authenticode signature.
count=143, id=261, version=35222,
count=12, id=260, version=35222,
count=7, id=259, version=35222,
count=3, id=257, version=35222,
count=103, id=1, productName=Unmarked objects,
count=9, id=259, version=35721,
count=16, id=260, version=35721,
count=41, id=261, version=35721,
count=1, id=261, version=36248,
count=1, id=258, version=36248,
Unsigned PE
Checks for missing Authenticode signature.
count=1, productName=Unmarked objects (old),
count=4, id=259, version=33140,
count=1, id=260, version=33140,
count=3, id=257, version=33140,
count=23, id=1, productName=Unmarked objects,
count=4, id=261, version=36248,
count=1, id=258, version=36248,
Unsigned PE
Checks for missing Authenticode signature.
count=168, id=261, version=35222,
count=28, id=260, version=35222,
count=23, id=259, version=35222,
count=10, id=259, version=35721,
count=17, id=260, version=35721,
count=61, id=261, version=35721,
count=17, id=257, version=35222,
count=189, id=1, productName=Unmarked objects,
count=13, id=261, version=36248,
count=1, id=258, version=36248,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=259, version=35721,
count=11, id=260, version=35721,
count=40, id=261, version=35721,
count=6, id=257, version=35721,
count=11, id=257, version=35222,
count=249, id=1, productName=Unmarked objects,
count=7, id=261, version=36248,
count=1, id=255, version=36248,
count=1, id=258, version=36248,
Aug 26, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Aug 26, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=203, version=65501,
count=2, id=239, version=40116,
count=3, id=257, version=24123,
count=203, id=1, productName=Unmarked objects,
count=3, id=259, version=24123,
count=79, id=260, version=24123,
count=75, id=261, version=24123,
count=1, id=256, version=24123,
count=1, id=255, version=24123,
count=1, id=258, version=24123,
Apr 17, 2020
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=134, id=1, productName=Unmarked objects,
count=1, id=253, version=26715,
count=1, id=256, version=26715,
count=49, id=259, version=26715,
count=93, id=261, version=26715,
count=568, id=270, version=26715,
count=75, id=260, version=26715,
count=1, id=255, version=26715,
count=1, id=258, version=26715,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=144, id=1, productName=Unmarked objects,
count=1, id=238, version=40116,
count=48, id=241, version=40116,
count=324, id=243, version=40116,
count=125, id=247, version=40116,
count=278, id=242, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
Jun 21, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jun 21, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=2, id=257, version=26504,
count=3, id=257, version=26213,
count=55, id=1, productName=Unmarked objects,
count=4, id=259, version=26504,
count=7, id=260, version=26504,
count=26, id=261, version=26504,
count=1, id=256, version=26504,
count=1, id=255, version=26504,
count=1, id=258, version=26504,
Jun 10, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jun 10, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=203, version=65501,
count=3, id=239, version=40116,
count=46, id=1, productName=Unmarked objects,
count=11, id=259, version=24123,
count=20, id=260, version=24123,
count=24, id=261, version=24123,
count=1, id=256, version=24123,
count=1, id=255, version=24123,
count=1, id=258, version=24123,