db06fc0b3a8bef0fdc708948d3110b64eb7e4c9cf51ea0296b13e9f03287e327.zip
- SHA256 db06fc0b3a8bef0fdc708948d3110b64eb7e4c9cf51ea0296b13e9f03287e327
Overview
overview
10Static
static
10Install_58...ib.dll
windows10-2004-x64
3Install_58...ib.dll
windows11-ltsc_2024-x64
3Install_58...up.exe
windows10-2004-x64
10Install_58...up.exe
windows11-ltsc_2024-x64
10Install_58...le.dll
windows10-2004-x64
3Install_58...le.dll
windows11-ltsc_2024-x64
3Install_58...er.dll
windows10-2004-x64
3Install_58...er.dll
windows11-ltsc_2024-x64
3Install_58...er.dll
windows10-2004-x64
3Install_58...er.dll
windows11-ltsc_2024-x64
3Install_58...64.dll
windows10-2004-x64
1Install_58...64.dll
windows11-ltsc_2024-x64
1Install_58...L3.dll
windows10-2004-x64
3Install_58...L3.dll
windows11-ltsc_2024-x64
3Install_58...ge.dll
windows10-2004-x64
3Install_58...ge.dll
windows11-ltsc_2024-x64
3Install_58...tf.dll
windows10-2004-x64
3Install_58...tf.dll
windows11-ltsc_2024-x64
3Install_58...ll.exe
windows10-2004-x64
3Install_58...ll.exe
windows11-ltsc_2024-x64
3Install_58...om.dll
windows10-2004-x64
3Install_58...om.dll
windows11-ltsc_2024-x64
3Install_58...er.dll
windows10-2004-x64
3Install_58...er.dll
windows11-ltsc_2024-x64
3Install_58...64.dll
windows10-2004-x64
1Install_58...64.dll
windows11-ltsc_2024-x64
1Install_58...46.dll
windows10-2004-x64
3Install_58...46.dll
windows11-ltsc_2024-x64
3Install_58...64.dll
windows10-2004-x64
1Install_58...64.dll
windows11-ltsc_2024-x64
1Install_58...1d.dll
windows10-2004-x64
3Install_58...1d.dll
windows11-ltsc_2024-x64
308/08/2026, 02:26
260808-cxc1ssgj2v1008/08/2026, 01:14
260808-bl4tpszwbv1008/08/2026, 00:56
260808-bal5hsztfv1022/03/2025, 04:08
250322-ep7ljsxxay10Behavioral task
behavioral1
Sample
Install_58.97.4263.21.03/DuiLib.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Install_58.97.4263.21.03/DuiLib.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
Install_58.97.4263.21.03/Setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Install_58.97.4263.21.03/Setup.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
Install_58.97.4263.21.03/WinSparkle.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Install_58.97.4263.21.03/WinSparkle.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
Install_58.97.4263.21.03/bin/CSERHelper.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Install_58.97.4263.21.03/bin/CSERHelper.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral9
Sample
Install_58.97.4263.21.03/bin/GameOverlayRenderer.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Install_58.97.4263.21.03/bin/GameOverlayRenderer.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
Install_58.97.4263.21.03/bin/GameOverlayRenderer64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Install_58.97.4263.21.03/bin/GameOverlayRenderer64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
Install_58.97.4263.21.03/bin/SDL3.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Install_58.97.4263.21.03/bin/SDL3.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
Install_58.97.4263.21.03/bin/SDL3_image.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Install_58.97.4263.21.03/bin/SDL3_image.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
Install_58.97.4263.21.03/bin/SDL3_ttf.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
Install_58.97.4263.21.03/bin/SDL3_ttf.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
Install_58.97.4263.21.03/bin/Uninstall.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
Install_58.97.4263.21.03/bin/Uninstall.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
Install_58.97.4263.21.03/bin/aom.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Install_58.97.4263.21.03/bin/aom.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
Install_58.97.4263.21.03/bin/crashhandler.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
Install_58.97.4263.21.03/bin/crashhandler.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral25
Sample
Install_58.97.4263.21.03/bin/crashhandler64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
Install_58.97.4263.21.03/bin/crashhandler64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
Install_58.97.4263.21.03/bin/d3dcompiler_46.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
Install_58.97.4263.21.03/bin/d3dcompiler_46.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
Install_58.97.4263.21.03/bin/d3dcompiler_46_64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
Install_58.97.4263.21.03/bin/d3dcompiler_46_64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
Install_58.97.4263.21.03/bin/dav1d.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
Install_58.97.4263.21.03/bin/dav1d.dll
Resource
win11ltsc2024-20260709-en
hijackloader
%APPDATA%\systemtask_vsv2
%windir%\SysWOW64\pla.dll
HijackLoader is a multi-stage loader, first seen in 2023.
| resource | yara_rule |
|---|---|
| static1/unpack001/Install_58.97.4263.21.03/tantalum.vcf | family_hijackloader |
Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
| resource | yara_rule |
|---|---|
| static1/unpack001/Install_58.97.4263.21.03/x86/steamclient.dll | Potential_DDR_C2S |
File was altered after it was signed.
| resource |
|---|
| unpack001/Install_58.97.4263.21.03/WinSparkle.dll |
File was codesigned using an insecure algorithm.
| resource |
|---|
| unpack001/Install_58.97.4263.21.03/DuiLib.dll |
| unpack001/Install_58.97.4263.21.03/Setup.exe |
| unpack001/Install_58.97.4263.21.03/bin/CSERHelper.dll |
| unpack001/Install_58.97.4263.21.03/bin/openvr_api.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Install_58.97.4263.21.03/bin/SDL3_image.dll |
| unpack001/Install_58.97.4263.21.03/bin/SDL3_ttf.dll |
| unpack001/Install_58.97.4263.21.03/bin/aom.dll |
| unpack001/Install_58.97.4263.21.03/bin/dav1d.dll |
| unpack001/Install_58.97.4263.21.03/bin/libavif-16.dll |
| unpack001/Install_58.97.4263.21.03/bin/libavutil-59.dll |
| unpack001/Install_58.97.4263.21.03/bin/libswresample-5.dll |
| unpack001/Install_58.97.4263.21.03/bin/libswscale-8.dll |
| unpack001/Install_58.97.4263.21.03/x86/SDL3_image.dll |
| unpack001/Install_58.97.4263.21.03/x86/SDL3_ttf.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/Install_58.97.4263.21.03/x64/WriteMiniDump.exe |
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Jun 28, 2023
CN=Shenzhen Tengruiming Technology Co.\, Ltd.,O=Shenzhen Tengruiming Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=Shenzhen Tengruiming Technology Co.\, Ltd.,O=Shenzhen Tengruiming Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
count=32, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=109, productName=VS2005 build 50727, version=50727,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=250, id=1, productName=Unmarked objects,
count=137, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=91, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Jun 28, 2023
CN=Shenzhen Tengruiming Technology Co.\, Ltd.,O=Shenzhen Tengruiming Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=Shenzhen Tengruiming Technology Co.\, Ltd.,O=Shenzhen Tengruiming Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
count=10, id=150, version=20413,
count=35, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, productName=VS2015 UPD2 build 23918, version=23918,
count=708, id=1, productName=Unmarked objects,
count=31, id=123, productName=VS2005 build 50727, version=50727,
count=308, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=82, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=66, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Codesign digest Mismatch
File was altered after it was signed.
Jun 28, 2023
CN=Shenzhen Tengruiming Technology Co.\, Ltd.,O=Shenzhen Tengruiming Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=Shenzhen Tengruiming Technology Co.\, Ltd.,O=Shenzhen Tengruiming Technology Co.\, Ltd.,L=深圳市,ST=广东省,C=CN
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
count=23, id=241, version=40116,
count=179, id=243, version=40116,
count=30, id=242, version=40116,
count=26, id=259, version=23907,
count=55, id=261, version=23907,
count=33, id=260, version=23907,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=451, id=1, productName=Unmarked objects,
count=150, id=265, version=23918,
count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=2, id=151,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Jun 20, 2017
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=30795,
count=137, id=261, version=30795,
count=20, id=260, version=30795,
count=31, id=261, version=33030,
count=16, id=260, version=33030,
count=21, id=259, version=33030,
count=2, id=257, version=30795,
count=3, id=257, version=33135,
count=159, id=1, productName=Unmarked objects,
count=20, id=260, version=33135,
count=1, id=256, version=33135,
count=1, id=255, version=33135,
count=1, id=151,
count=1, id=258, version=33135,
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=259, version=30795,
count=152, id=261, version=30795,
count=25, id=260, version=30795,
count=33, id=261, version=33030,
count=18, id=260, version=33030,
count=25, id=259, version=33030,
count=2, id=257, version=30795,
count=1, id=261, version=33135,
count=3, id=257, version=33135,
count=131, id=1, productName=Unmarked objects,
count=29, id=260, version=33135,
count=1, id=256, version=33135,
count=1, id=255, version=33135,
count=1, id=151,
count=1, id=258, version=33135,
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=30, id=259, version=30795,
count=162, id=261, version=30795,
count=32, id=260, version=30795,
count=31, id=261, version=30034,
count=17, id=260, version=30034,
count=24, id=259, version=30034,
count=3, id=257, version=30795,
count=95, id=1, productName=Unmarked objects,
count=19, productName=Unmarked objects (old),
count=313, id=260, version=30153,
count=1, id=256, version=30153,
count=1, id=255, version=30153,
count=1, id=258, version=30153,
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Aug 21, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Aug 21, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=54, id=207, version=41209,
count=1, id=206, version=41209,
count=3, id=189, version=30716,
count=211, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=13, id=187, version=30716,
count=14, id=188, version=30716,
count=1, id=184, version=30716,
count=128, id=193, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Oct 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 26, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=54, id=207, version=41209,
count=1, id=206, version=41209,
count=3, id=189, version=30716,
count=208, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=2, id=187, version=30716,
count=16, id=188, version=30716,
count=1, id=184, version=30716,
count=128, id=193, version=30716,
count=1, id=183, version=30716,
count=1, id=186, version=30716,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=30795,
count=141, id=261, version=30795,
count=20, id=260, version=30795,
count=31, id=261, version=30034,
count=15, id=260, version=30034,
count=21, id=259, version=30034,
count=3, id=257, version=30795,
count=97, id=1, productName=Unmarked objects,
count=51, id=260, version=30153,
count=45, productName=Unmarked objects (old),
count=1, id=256, version=30153,
count=1, id=255, version=30153,
count=1, id=258, version=30153,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=259, version=30795,
count=154, id=261, version=30795,
count=22, id=260, version=30795,
count=31, id=261, version=33030,
count=16, id=260, version=33030,
count=21, id=259, version=33030,
count=2, id=257, version=30795,
count=5, id=257, version=33135,
count=112, id=1, productName=Unmarked objects,
count=30, id=260, version=33135,
count=1, id=256, version=33135,
count=1, id=255, version=33135,
count=1, id=258, version=33135,
Unsigned PE
Checks for missing Authenticode signature.
count=56, id=259, version=30795,
count=188, id=261, version=30795,
count=45, id=260, version=30795,
count=4, id=253, version=33731,
count=25, id=259, version=33731,
count=17, id=260, version=33731,
count=31, id=261, version=33731,
count=7, id=257, version=30795,
count=125, id=1, productName=Unmarked objects,
count=6, productName=Unmarked objects (old),
count=97, id=260, version=33817,
count=1, id=256, version=33817,
count=1, id=255, version=33817,
count=1, id=258, version=33817,
Unsigned PE
Checks for missing Authenticode signature.
count=23, id=259, version=30795,
count=137, id=261, version=30795,
count=31, id=260, version=30795,
count=2, id=257, version=30795,
count=22, id=259, version=33731,
count=16, id=260, version=33731,
count=31, id=261, version=33731,
count=3, id=257, version=33817,
count=112, id=1, productName=Unmarked objects,
count=3, productName=Unmarked objects (old),
count=13, id=260, version=33817,
count=1, id=256, version=33817,
count=1, id=255, version=33817,
count=1, id=258, version=33817,
Unsigned PE
Checks for missing Authenticode signature.
count=26, id=259, version=30795,
count=137, id=261, version=30795,
count=33, id=260, version=30795,
count=2, id=257, version=30795,
count=21, id=259, version=33731,
count=16, id=260, version=33731,
count=31, id=261, version=33731,
count=3, id=257, version=33817,
count=111, id=1, productName=Unmarked objects,
count=7, productName=Unmarked objects (old),
count=21, id=260, version=33817,
count=1, id=256, version=33817,
count=1, id=255, version=33817,
count=1, id=258, version=33817,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Aug 19, 2022
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Detects HijackLoader (aka IDAT Loader)
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jan 13, 2012
CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US
Mar 8, 2025
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Sep 30, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=30795,
count=146, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=60, id=261, version=27316,
count=1, id=260, version=27316,
count=30, id=259, version=30795,
count=222, id=261, version=30795,
count=55, id=260, version=30795,
count=1, id=256, version=30795,
count=136, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Sep 30, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=53, id=260, version=30795,
count=28, id=259, version=30795,
count=198, id=261, version=30795,
count=2, id=261, version=30034,
count=9, id=257, version=29395,
count=123, id=1, productName=Unmarked objects,
count=170, id=265, version=30795,
count=1, id=256, version=30795,
count=1, id=255, version=30795,
count=1, id=151,
count=1, id=258, version=30795,
Mar 8, 2025
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Mar 8, 2025
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=30795,
count=137, id=261, version=30795,
count=20, id=260, version=30795,
count=31, id=261, version=33030,
count=16, id=260, version=33030,
count=21, id=259, version=33030,
count=2, id=257, version=30795,
count=3, id=257, version=33135,
count=159, id=1, productName=Unmarked objects,
count=20, id=260, version=33135,
count=1, id=256, version=33135,
count=1, id=255, version=33135,
count=1, id=151,
count=1, id=258, version=33135,
Unsigned PE
Checks for missing Authenticode signature.
count=25, id=259, version=30795,
count=152, id=261, version=30795,
count=25, id=260, version=30795,
count=33, id=261, version=33030,
count=18, id=260, version=33030,
count=25, id=259, version=33030,
count=2, id=257, version=30795,
count=1, id=261, version=33135,
count=3, id=257, version=33135,
count=131, id=1, productName=Unmarked objects,
count=29, id=260, version=33135,
count=1, id=256, version=33135,
count=1, id=255, version=33135,
count=1, id=151,
count=1, id=258, version=33135,
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Detects references to legitimate web services potentially used as dead drop resolvers
Detects Telegram, Steam, and other legitimate web-service references that may be used to retrieve secondary C2 infrastructure.
Jan 28, 2025
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US