Institute.zip
- SHA256 c7b429549f0f74af22d0d0a73b5cf7020a48ee00e0d9c87ca8b2698f5d2c6ab4
Overview
overview
8Static
static
5A3DLIBS.dll
windows10-2004-x64
1A3DLIBS.dll
windows11-ltsc_2024-x64
1AXEDOMCore.dll
windows10-2004-x64
1AXEDOMCore.dll
windows11-ltsc_2024-x64
6AccessibleMarshal.dll
windows10-2004-x64
5CITThreading.dll
windows10-2004-x64
1CITThreading.dll
windows11-ltsc_2024-x64
6Launcher.exe
windows10-2004-x64
6Launcher.exe
windows11-ltsc_2024-x64
4Westfield.dll
windows10-2004-x64
1Westfield.dll
windows11-ltsc_2024-x64
1dvacrashhandler.dll
windows10-2004-x64
8dvacrashhandler.dll
windows11-ltsc_2024-x64
8format_reader.dll
windows10-2004-x64
1format_reader.dll
windows11-ltsc_2024-x64
6icuuc64.dll
windows10-2004-x64
1icuuc64.dll
windows11-ltsc_2024-x64
1lib3mfc.dll
windows10-2004-x64
1lib3mfc.dll
windows11-ltsc_2024-x64
1metadata/AGM.dll
windows10-2004-x64
1metadata/AGM.dll
windows11-ltsc_2024-x64
1metadata/BIBUtils.dll
windows10-2004-x64
1metadata/BIBUtils.dll
windows11-ltsc_2024-x64
1metadata/ffmpeg.dll
windows10-2004-x64
1version.dll
windows10-2004-x64
1version.dll
windows11-ltsc_2024-x64
1Static task
static1
Behavioral task
behavioral1
Sample
A3DLIBS.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
A3DLIBS.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
AXEDOMCore.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
AXEDOMCore.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral5
Sample
AccessibleMarshal.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
CITThreading.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
CITThreading.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral8
Sample
Launcher.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral9
Sample
Launcher.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral10
Sample
Westfield.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral11
Sample
Westfield.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral12
Sample
dvacrashhandler.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral13
Sample
dvacrashhandler.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral14
Sample
format_reader.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral15
Sample
format_reader.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral16
Sample
icuuc64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral17
Sample
icuuc64.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral18
Sample
lib3mfc.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral19
Sample
lib3mfc.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral20
Sample
metadata/AGM.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral21
Sample
metadata/AGM.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral22
Sample
metadata/BIBUtils.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral23
Sample
metadata/BIBUtils.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral24
Sample
metadata/ffmpeg.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
version.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
version.dll
Resource
win11ltsc2024-20260709-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/version.dll |
| unpack001/version.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/metadata/ffmpeg.dll |
| unpack001/version.dll |
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=199, version=41118,
count=28, id=261, version=26706,
count=8, id=260, version=26706,
count=3, id=259, version=26706,
count=4, id=257, version=26706,
count=6, id=257, productName=VS2017 v15.9.11 build 27030, version=27030,
count=9, id=257, version=25203,
count=1092, id=1, productName=Unmarked objects,
count=9, id=264, version=27030,
count=7, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,
count=48, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=17, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=259, version=26706,
count=3, id=257, version=26213,
count=82, id=1, productName=Unmarked objects,
count=75, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=4, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Jun 6, 2024
CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=26706,
count=22, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=259, version=26706,
count=3, id=265, version=27030,
count=3, id=257, version=25203,
count=98, id=1, productName=Unmarked objects,
count=10, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Aug 22, 2025
CN=PANDORATV Co.\,Ltd,O=PANDORATV Co.\,Ltd,L=Seongnam-si,ST=Gyeonggi-do,C=KR
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
count=34, id=241, version=40116,
count=211, id=243, version=40116,
count=59, id=242, version=40116,
count=1, id=135, version=30729,
count=2, id=261, version=23013,
count=43, id=260, version=24123,
count=15, id=259, version=24123,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=3, productName=Unmarked objects (old),
count=1, id=136, version=30729,
count=1, id=173, version=30319,
count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1115, id=1, productName=Unmarked objects,
count=452, id=261, version=24123,
count=759, id=265, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=24123,
count=11, id=260, version=24123,
count=4, id=257, version=24123,
count=15, id=261, version=24123,
count=11, id=203, version=65501,
count=170, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=260, version=26706,
count=2, id=259, version=26706,
count=22, id=261, version=26706,
count=4, id=257, version=26706,
count=2, id=257, version=26213,
count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=131, id=1, productName=Unmarked objects,
count=13, productName=Unmarked objects (old),
count=1, id=256, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=13, id=241, version=40116,
count=125, id=243, version=40116,
count=20, id=242, version=40116,
count=8, id=259, version=26706,
count=102, id=261, version=26706,
count=16, id=260, version=26706,
count=2, id=203, version=65501,
count=3, id=257, version=27031,
count=141, id=1, productName=Unmarked objects,
count=190, id=261, version=27031,
count=1, id=256, version=27031,
count=1, id=255, version=27031,
count=1, id=151,
count=1, id=258, version=27031,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=261, version=26706,
count=8, id=260, version=26706,
count=3, id=259, version=26706,
count=4, id=257, version=26706,
count=11, id=257, version=25203,
count=125, id=1, productName=Unmarked objects,
count=135, id=265, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=199, version=41118,
count=19, id=261, version=26706,
count=8, id=260, version=26706,
count=3, id=259, version=26706,
count=4, id=257, version=26706,
count=11, id=257, version=26213,
count=266, id=1, productName=Unmarked objects,
count=44, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,
count=341, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Jan 15, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=17, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=259, version=26706,
count=3, id=257, version=26213,
count=86, id=1, productName=Unmarked objects,
count=11, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=256, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,
Unsigned PE
Checks for missing Authenticode signature.
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=137, id=261, version=33145,
count=14, id=260, version=33145,
count=6, id=259, version=33145,
count=9, id=259, version=35721,
count=14, id=260, version=35721,
count=40, id=261, version=35721,
count=1, id=262, version=33145,
count=17, id=257, version=33145,
count=128, id=1, productName=Unmarked objects,
count=1, id=261, version=36248,
count=1, id=259, version=36248,
count=1, id=256, version=36248,
count=1, id=255, version=36248,
count=1, id=151,
count=1, id=258, version=36248,