24102026_1835_23102026_4.img.zip
- SHA256 4fb8f3739d052b1de2b8cd6bc9a53dbe7f66287135d6adbdf047d358e9f18943
Static task
static1
Behavioral task
behavioral1
Sample
DF-202601001301.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
DF-202601001301.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
mfc140u.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
mfc140u.dll
Resource
win11ltsc2024-20260911-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack002/mfc140u.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack002/mfc140u.dll |
Aug 5, 2026
CN=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,O=NetEase Youdao Information Technology (Beijing) Co.\,Ltd.,ST=Beijing,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=13, id=259, version=33145,
count=169, id=261, version=33145,
count=25, id=260, version=33145,
count=10, id=257, version=33145,
count=3, id=261, version=35228,
count=26, id=259, version=35207,
count=19, id=260, version=35207,
count=96, id=261, version=35207,
count=208, id=1, productName=Unmarked objects,
count=3, id=257, version=35207,
count=6, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=258, version=35228,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.