Virtual Desktop.zip
- SHA256 dcfd992e54c6af0b0128460997539e166a5087c517c65b31a42c22cbece5b91a
Behavioral task
behavioral1
Sample
Virtual Desktop.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Virtual Desktop.zip
Resource
win11ltsc2024-20260709-en
Detects SmartAssembly .NET packer.
| resource | yara_rule |
|---|---|
| static1/unpack001/Virtual Desktop/VirtualDesktop.Setup.exe | SmartAssembly |
| resource | yara_rule |
|---|---|
| static1/unpack001/Virtual Desktop/yt-dlp.exe | pyinstaller |
File was codesigned using an insecure algorithm.
| resource |
|---|
| unpack001/Virtual Desktop/AudioDriver/Win7/vdvad.sys |
| unpack001/Virtual Desktop/EasyHook32Svc.exe |
| unpack001/Virtual Desktop/EasyHook64Svc.exe |
| unpack001/Virtual Desktop/openvr_api.dll |
| unpack001/Virtual Desktop/steam_api64.dll |
| unpack001/Virtual Desktop/texconv.exe |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Virtual Desktop/Assimp32.dll |
| unpack001/Virtual Desktop/Assimp64.dll |
| unpack001/Virtual Desktop/AssimpNet.dll |
| unpack001/Virtual Desktop/Audio360.dll |
| unpack001/Virtual Desktop/EasyHook.dll |
| unpack001/Virtual Desktop/EasyHook32.dll |
| unpack001/Virtual Desktop/EasyHook64.dll |
| unpack001/Virtual Desktop/EasyLoad32.dll |
| unpack001/Virtual Desktop/EasyLoad64.dll |
| unpack001/Virtual Desktop/SharpDX.D3DCompiler.dll |
| unpack001/Virtual Desktop/SharpDX.DXGI.dll |
| unpack001/Virtual Desktop/SharpDX.Direct2D1.dll |
| unpack001/Virtual Desktop/SharpDX.Direct3D10.dll |
| unpack001/Virtual Desktop/SharpDX.Direct3D11.dll |
| unpack001/Virtual Desktop/SharpDX.Direct3D9.dll |
| unpack001/Virtual Desktop/SharpDX.Mathematics.dll |
| unpack001/Virtual Desktop/SharpDX.dll |
| unpack001/Virtual Desktop/VirtualDesktop.Engine.Injection.dll |
| unpack001/Virtual Desktop/VirtualDesktop.Engine.Media.dll |
| unpack001/Virtual Desktop/VirtualDesktop.Engine.MilkDrop.dll |
| unpack001/Virtual Desktop/Xceed.Wpf.Toolkit.dll |
| unpack001/Virtual Desktop/de/Virtual Desktop.resources.dll |
| unpack001/Virtual Desktop/ffmpeg.exe |
| unpack001/Virtual Desktop/fr/Virtual Desktop.resources.dll |
| unpack001/Virtual Desktop/ja/Virtual Desktop.resources.dll |
| unpack001/Virtual Desktop/libFacebookAudio360.dll |
| unpack001/Virtual Desktop/yt-dlp.exe |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/Virtual Desktop/Environment Editor.exe |
| unpack001/Virtual Desktop/Microsoft.Speech.dll |
| unpack001/Virtual Desktop/Virtual Desktop.exe |
| unpack001/Virtual Desktop/VirtualDesktop.Setup.exe |
Unsigned PE
Checks for missing Authenticode signature.
count=7, id=205, version=50929,
count=14, id=206, version=50929,
count=4, id=203, version=50929,
count=10, id=207, version=50929,
count=177, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=9, id=206, productName=VS2012 UPD2 build 60315, version=60315,
count=147, id=207, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=202, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=201, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=204, productName=VS2012 UPD2 build 60315, version=60315,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=199, version=41118,
count=2, id=205, version=50929,
count=13, id=206, version=50929,
count=4, id=203, version=50929,
count=10, id=207, version=50929,
count=194, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=9, id=206, productName=VS2012 UPD2 build 60315, version=60315,
count=147, id=207, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=202, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=201, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=204, productName=VS2012 UPD2 build 60315, version=60315,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=44, id=260, version=23917,
count=29, id=259, version=23917,
count=170, id=261, version=23917,
count=1, id=199, version=41118,
count=8, id=259, version=24123,
count=110, id=261, version=24123,
count=38, id=260, version=24123,
count=7, id=257, version=23917,
count=162, id=1, productName=Unmarked objects,
count=95, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=71, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Jan 28, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 28, 2022
SERIALNUMBER=BC1130961,CN=Virtual Desktop\, Inc.,O=Virtual Desktop\, Inc.,L=Vancouver,ST=British Columbia,C=CA,1.3.6.1.4.1.311.60.2.1.2=#13104272697469736820436f6c756d626961,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=263, version=26715,
count=5, id=257, version=26715,
count=25, id=1, productName=Unmarked objects,
count=3, id=259, version=26715,
count=3, id=260, version=26715,
count=7, id=261, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Jan 28, 2022
SERIALNUMBER=BC1130961,CN=Virtual Desktop\, Inc.,O=Virtual Desktop\, Inc.,L=Vancouver,ST=British Columbia,C=CA,1.3.6.1.4.1.311.60.2.1.2=#13104272697469736820436f6c756d626961,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=263, version=26715,
count=5, id=257, version=26715,
count=25, id=1, productName=Unmarked objects,
count=3, id=259, version=26715,
count=3, id=260, version=26715,
count=7, id=261, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Jan 28, 2022
CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 28, 2022
SERIALNUMBER=BC1130961,CN=Virtual Desktop\, Inc.,O=Virtual Desktop\, Inc.,L=Vancouver,ST=British Columbia,C=CA,1.3.6.1.4.1.311.60.2.1.2=#13104272697469736820436f6c756d626961,1.3.6.1.4.1.311.60.2.1.3=#13024341,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=1, id=263, version=26715,
count=5, id=257, version=26715,
count=25, id=1, productName=Unmarked objects,
count=3, id=259, version=26715,
count=3, id=260, version=26715,
count=7, id=261, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=48, id=225, productName=VS2013 build 21005, version=21005,
count=20, id=223, productName=VS2013 build 21005, version=21005,
count=135, id=224, productName=VS2013 build 21005, version=21005,
count=11, id=203, version=65501,
count=130, id=1, productName=Unmarked objects,
count=1, id=109, version=31008,
count=25, id=228, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Apr 21, 2018
SERIALNUMBER=BC1130961,CN=Virtual Desktop\, Inc.,O=Virtual Desktop\, Inc.,L=Vancouver,ST=British Columbia,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=199, version=41118,
count=51, id=225, version=20806,
count=127, id=224, version=20806,
count=11, id=223, version=20806,
count=11, id=203, version=65501,
count=134, id=1, productName=Unmarked objects,
count=1, id=109, version=31008,
count=25, id=228, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Apr 21, 2018
SERIALNUMBER=BC1130961,CN=Virtual Desktop\, Inc.,O=Virtual Desktop\, Inc.,L=Vancouver,ST=British Columbia,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jan 1, 0001
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Dec 6, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 14, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 14, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 14, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 14, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 14, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 14, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 14, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Sep 14, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Dec 6, 2011
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Jan 22, 2020
CN=Red Gate Software Ltd,O=Red Gate Software Ltd,POSTALCODE=CB4 0WZ,STREET=Cambridge Business Park+STREET=Newnham House 12,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Jan 22, 2020
CN=Red Gate Software Ltd,O=Red Gate Software Ltd,POSTALCODE=CB4 0WZ,STREET=Cambridge Business Park+STREET=Newnham House 12,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jan 1, 0001
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=241, version=40116,
count=123, id=243, version=40116,
count=13, id=242, version=40116,
count=9, id=259, version=34321,
count=14, id=260, version=34321,
count=35, id=261, version=34321,
count=1, id=206, version=65501,
count=19, id=203, version=65501,
count=111, id=1, productName=Unmarked objects,
count=4, id=265, version=34809,
count=1, id=256, version=34809,
count=1, id=255, version=34809,
count=1, id=151,
count=1, id=258, version=34809,
Unsigned PE
Checks for missing Authenticode signature.
count=15, id=241, version=40116,
count=156, id=243, version=40116,
count=41, id=242, version=40116,
count=3, id=253, version=34321,
count=33, id=259, version=34321,
count=15, id=260, version=34321,
count=1, id=206, version=65501,
count=54, id=261, version=34321,
count=17, id=203, version=65501,
count=154, id=1, productName=Unmarked objects,
count=22, id=265, version=34809,
count=1, id=256, version=34809,
count=1, id=255, version=34809,
count=1, id=151,
count=1, id=258, version=34809,
Jan 1, 0001
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jan 1, 0001
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=241, version=40116,
count=118, id=243, version=40116,
count=13, id=242, version=40116,
count=9, id=259, version=34321,
count=14, id=260, version=34321,
count=31, id=261, version=34321,
count=2, id=203, version=65501,
count=3, id=257, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=90, id=1, productName=Unmarked objects,
count=2, id=265, version=34809,
count=1, id=256, version=34809,
count=1, id=255, version=34809,
count=1, id=151,
count=1, id=258, version=34809,
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Mar 27, 2019
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Jul 25, 2019
CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Apr 21, 2018
SERIALNUMBER=BC1130961,CN=Virtual Desktop\, Inc.,O=Virtual Desktop\, Inc.,L=Vancouver,ST=British Columbia,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=2, id=221, version=20806,
count=1, id=223, version=20806,
count=7, id=223, productName=VS2013 build 21005, version=21005,
count=20, id=224, productName=VS2013 build 21005, version=21005,
count=4, id=221, productName=VS2013 build 21005, version=21005,
count=10, id=225, productName=VS2013 build 21005, version=21005,
count=19, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=206, version=65501,
count=1, id=207, version=65501,
count=5, id=203, version=65501,
count=100, id=1, productName=Unmarked objects,
count=1, id=229, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Detects Pyinstaller
Unsigned PE
Checks for missing Authenticode signature.