krx.zip
- SHA256 eaead92d22b4d979391c33fb4ef9d815853ce2b5dfabc55549e2823ea4136e49
Behavioral task
behavioral1
Sample
krx.zip
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
krx.zip
Resource
win11ltsc2024-20260911-en
| resource | yara_rule |
|---|---|
| static1/unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/cares.dll | themida |
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/ucrtbased.dll |
Embeds OpenSSL, may be used to circumvent TLS interception.
| resource | yara_rule |
|---|---|
| static1/unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libcrypto-3-x64.dll | embeds_openssl |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/DDNet-Server.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/KRX Client.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/SDL2.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/avcodec-61.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/avformat-61.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/avutil-59.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/cares.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/config_retrieve.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/config_store.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/data/krx/DDNet_original.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/demo_extract_chat.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/dilate.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/exchndl.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libcrypto-3-x64.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libcurl.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libfreetype.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libogg.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libopus.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libopusfile.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libpng16-16.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libssl-3-x64.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libssp-0.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/libwinpthread-1.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/map_convert_07.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/map_create_pixelart.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/map_diff.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/map_extract.exe |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/mgwhelp.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/sqlite3.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/steam_api.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/swresample-5.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/swscale-8.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/ucrtbased.dll |
| unpack001/krx/KRX-Client-18.9.1-win64-ultimate-v1.32/zlib1.dll |
| unpack001/krx/PROXY/krx.exe |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=33, id=259, version=30795,
count=203, id=261, version=30795,
count=38, id=260, version=30795,
count=5, id=253, version=34321,
count=12, id=259, version=34321,
count=18, id=260, version=34321,
count=105, id=261, version=34321,
count=4, id=257, version=34436,
count=4, id=257, version=27045,
count=215, productName=Unmarked objects (old),
count=2, id=123, version=2207,
count=27, id=257, version=30795,
count=448, id=1, productName=Unmarked objects,
count=29, id=260, version=34436,
count=312, id=261, version=34436,
count=1, id=255, version=34436,
count=1, id=151,
count=1, id=258, version=34436,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=2, id=253, version=35207,
count=4, id=259, version=35207,
count=8, id=260, version=35207,
count=13, id=261, version=35207,
count=126, id=1, productName=Unmarked objects,
count=9, id=257, version=33140,
count=91, id=260, version=35211,
count=1, id=256, version=35211,
count=1, id=255, version=35211,
count=1, id=151,
count=1, id=258, version=35211,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Mar 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=26715,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1120, id=1, productName=Unmarked objects,
count=8, id=260, version=26715,
count=3, id=259, version=26715,
count=16, id=261, version=26715,
count=1, id=256, version=26715,
count=14, id=265, version=26715,
count=1, id=253, version=26715,
count=1, id=255, version=26715,
count=1, id=258, version=26715,
Mar 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=57, id=261, version=26028,
count=1, id=260, version=26028,
count=2, id=257, version=26715,
count=57, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1219, id=1, productName=Unmarked objects,
count=11, id=260, version=26715,
count=4, id=259, version=26715,
count=1, id=256, version=26715,
count=96, id=265, version=26715,
count=2, id=253, version=26715,
count=30, id=261, version=26715,
count=1, id=255, version=26715,
count=1, id=258, version=26715,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Apr 29, 2022
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Apr 29, 2022
SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=27, id=260, version=27412,
count=21, id=259, version=27412,
count=136, id=261, version=27412,
count=31, id=261, version=26706,
count=14, id=260, version=26706,
count=8, id=259, version=26706,
count=17, id=257, version=27412,
count=204, id=1, productName=Unmarked objects,
count=13, id=260, version=27045,
count=489, productName=Unmarked objects (old),
count=1, id=256, version=27045,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33030,
count=12, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=211, id=1, productName=Unmarked objects,
count=11, id=257, version=30795,
count=36, productName=Unmarked objects (old),
count=917, id=260, version=33133,
count=1, id=256, version=33133,
count=1, id=255, version=33133,
count=1, id=258, version=33133,
Unsigned PE
Checks for missing Authenticode signature.
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34321,
count=8, id=253, version=34321,
count=4, id=259, version=34321,
count=8, id=260, version=34321,
count=12, id=261, version=34321,
count=6, id=257, version=33134,
count=10, id=257, version=27412,
count=3, id=257, version=34436,
count=434, id=1, productName=Unmarked objects,
count=170, id=260, version=34436,
count=1, id=256, version=34436,
count=1, id=255, version=34436,
count=1, id=151,
count=1, id=258, version=34436,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33030,
count=13, id=261, version=33030,
count=8, id=260, version=33030,
count=4, id=259, version=33030,
count=4, id=257, version=30795,
count=3, id=257, version=33133,
count=589, id=1, productName=Unmarked objects,
count=89, id=260, version=33133,
count=1, id=256, version=33133,
count=1, id=255, version=33133,
count=1, id=258, version=33133,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Mar 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=26715,
count=15, id=260, version=26715,
count=266, id=1, productName=Unmarked objects,
count=9, id=257, version=26715,
count=10, id=261, version=26715,
count=1, id=256, version=26715,
count=30, id=265, version=26715,
count=1, id=255, version=26715,
count=1, id=258, version=26715,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=144, id=1, productName=Unmarked objects,
count=1, id=238, version=40116,
count=48, id=241, version=40116,
count=324, id=243, version=40116,
count=125, id=247, version=40116,
count=278, id=242, version=40116,
count=1, id=237, version=40116,
count=1, id=240, version=40116,
Jun 10, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jun 10, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=203, version=65501,
count=3, id=239, version=40116,
count=46, id=1, productName=Unmarked objects,
count=11, id=259, version=24123,
count=20, id=260, version=24123,
count=24, id=261, version=24123,
count=1, id=256, version=24123,
count=1, id=255, version=24123,
count=1, id=258, version=24123,
Jun 13, 2022
CN=LunarG\, Inc.,O=LunarG\, Inc.,L=Fort Collins,ST=Colorado,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=167, id=261, version=28900,
count=12, id=259, version=28900,
count=14, id=260, version=28900,
count=31, id=261, version=26706,
count=15, id=260, version=26706,
count=8, id=259, version=26706,
count=7, id=257, version=28900,
count=120, id=1, productName=Unmarked objects,
count=16, id=260, version=27045,
count=1, id=259, version=27045,
count=1, id=256, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.