dist.rar
- SHA256 7d11a92f3ba0ec31e914c4ea1eeb1f5170f64ff16e203c047e506cbfeada3150
Overview
overview
9Static
static
7WebView2Loader.dll
windows10-2004-x64
1libcrypto-4-x64.dll
windows10-2004-x64
1libcrypto-4-x64.dll
windows11-ltsc_2024-x64
1libssl-4-x64.dll
windows10-2004-x64
1libssl-4-x64.dll
windows11-ltsc_2024-x64
1sx_client_...ed.exe
windows10-2004-x64
9sx_client_...ed.exe
windows11-ltsc_2024-x64
9Behavioral task
behavioral1
Sample
WebView2Loader.dll
Resource
win10v2004-20260911-fr
Behavioral task
behavioral2
Sample
libcrypto-4-x64.dll
Resource
win10v2004-20260911-fr
Behavioral task
behavioral3
Sample
libcrypto-4-x64.dll
Resource
win11ltsc2024-20260911-fr
Behavioral task
behavioral4
Sample
libssl-4-x64.dll
Resource
win10v2004-20260911-fr
Behavioral task
behavioral5
Sample
libssl-4-x64.dll
Resource
win11ltsc2024-20260911-fr
Behavioral task
behavioral6
Sample
sx_client_protected.exe
Resource
win10v2004-20260911-fr
Behavioral task
behavioral7
Sample
sx_client_protected.exe
Resource
win11ltsc2024-20260911-fr
| resource | yara_rule |
|---|---|
| static1/unpack001/sx_client_protected.exe | themida |
Embeds OpenSSL, may be used to circumvent TLS interception.
| resource | yara_rule |
|---|---|
| static1/unpack001/libcrypto-4-x64.dll | embeds_openssl |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/sx_client_protected.exe |
Sep 15, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
Dec 13, 2023
CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=11, id=257, version=27412,
count=197, id=1, productName=Unmarked objects,
count=1, id=259, version=30152,
count=921, id=260, version=30152,
count=1, id=256, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
Jun 9, 2026
SERIALNUMBER=05901601,CN=FireDaemon Technologies Limited,O=FireDaemon Technologies Limited,ST=Suffolk,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
count=10, id=259, version=35721,
count=13, id=260, version=35721,
count=31, id=261, version=35721,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=33145,
count=3, id=257, version=36246,
count=662, id=1, productName=Unmarked objects,
count=110, id=260, version=36246,
count=1, id=256, version=36246,
count=1, id=255, version=36246,
count=1, id=258, version=36246,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=35721,
count=41, id=261, version=35721,
count=6, id=259, version=35721,
count=6, id=257, version=35721,
count=2, productName=Unmarked objects (old),
count=1, id=261, version=35222,
count=34, id=257, version=35222,
count=3, id=257, version=35729,
count=725, id=1, productName=Unmarked objects,
count=43, id=265, version=36257,
count=1, id=255, version=36257,
count=2, id=151,
count=1, id=258, version=36257,