OP-5.zip
- SHA256 244fd5ecb1fe8ec99bc9006015ad9b42193f9dc6b6dc953fa4e723ca86d7f966
Overview
overview
10Static
static
5OP-5.zip
windows10-2004-x64
10OP-5.zip
windows11-ltsc_2024-x64
10OP-5/NO-5.exe
windows10-2004-x64
10OP-5/NO-5.exe
windows11-ltsc_2024-x64
10OP-5/d3d9core.png
windows10-2004-x64
1OP-5/d3d9core.png
windows11-ltsc_2024-x64
8OP-5/libcef.dll
windows10-2004-x64
3OP-5/libcef.dll
windows11-ltsc_2024-x64
3Static task
static1
Behavioral task
behavioral1
Sample
OP-5.zip
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
OP-5.zip
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
OP-5/NO-5.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
OP-5/NO-5.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
OP-5/d3d9core.png
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
OP-5/d3d9core.png
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
OP-5/libcef.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
OP-5/libcef.dll
Resource
win11ltsc2024-20260911-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/OP-5/libcef.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/OP-5/libcef.dll |
Oct 23, 2020
SERIALNUMBER=9133000070337747XE,CN=Hithink RoyalFlush Information Network Co.\, Ltd.,O=Hithink RoyalFlush Information Network Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Oct 23, 2020
SERIALNUMBER=9133000070337747XE,CN=Hithink RoyalFlush Information Network Co.\, Ltd.,O=Hithink RoyalFlush Information Network Co.\, Ltd.,L=Hangzhou,ST=Zhejiang,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085a68656a69616e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=16, id=241, version=40116,
count=168, id=243, version=40116,
count=30, id=242, version=40116,
count=25, id=259, version=25305,
count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,
count=124, id=261, version=25305,
count=36, id=260, version=25305,
count=96, id=261, productName=VS2017 v15.4.5 build 25547, version=25547,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=281, id=1, productName=Unmarked objects,
count=7, id=265, version=25547,
count=1, id=255, productName=VS2017 v15.4.5 build 25547, version=25547,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.4.5 build 25547, version=25547,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.