xipher.rar
- SHA256 b6cabb63528573f614d1a574d6b266432179f61cc63010f9e7304191b9d53865
Static task
static1
Behavioral task
behavioral1
Sample
xipher.rar
Resource
win10ltsc2021-20260911-en
Behavioral task
behavioral2
Sample
CipherX/Sysinfo Cipherx.vmp.exe
Resource
win10ltsc2021-20260911-en
Behavioral task
behavioral3
Sample
CipherX/VAN0 Fix.exe
Resource
win10ltsc2021-20260911-en
Behavioral task
behavioral4
Sample
CipherX/libcrypto-3-x64.dll
Resource
win10ltsc2021-20260911-en
Behavioral task
behavioral5
Sample
CipherX/libssl-3-x64.dll
Resource
win10ltsc2021-20260911-en
Embeds OpenSSL, may be used to circumvent TLS interception.
| resource | yara_rule |
|---|---|
| static1/unpack001/CipherX/libcrypto-3-x64.dll | embeds_openssl |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/CipherX/Sysinfo Cipherx.vmp.exe |
| unpack001/CipherX/VAN0 Fix.EXE |
| unpack001/CipherX/libssl-3-x64.dll |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
Dec 13, 2023
CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=11, id=257, version=27412,
count=197, id=1, productName=Unmarked objects,
count=1, id=259, version=30152,
count=921, id=260, version=30152,
count=1, id=256, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=2, id=257, version=29395,
count=12, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=3, id=257, version=32217,
count=540, id=1, productName=Unmarked objects,
count=49, id=260, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,