vim-malware-verdacht.zip
- SHA256 e925e8dfdbf5bcb2147cecb4d62c9faa800c21826f8a5f762560e4d2d44fe236
Static task
static1
Behavioral task
behavioral1
Sample
8078c4d5f13e/gvim.exe
Resource
win10v2004-20260911-de
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/8078c4d5f13e/vim64.dll |
| unpack001/8078c4d5f13e/python314.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/8078c4d5f13e/python314.dll |
| unpack001/8078c4d5f13e/vim64.dll |
Jun 10, 2026
CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
count=142, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=2, id=257, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=41, id=261, version=35207,
count=3, id=257, version=35227,
count=93, id=1, productName=Unmarked objects,
count=1, id=264, version=35227,
count=1, id=256, version=35227,
count=1, id=255, version=35227,
count=1, id=258, version=35227,
Sep 30, 2026
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
count=1, id=264, version=35229,
count=1, id=256, version=35229,
count=1, id=255, version=35229,
count=1, id=258, version=35229,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
Sep 30, 2026
CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US
CN=Microsoft ID Verified CS EOC CA 03,O=Microsoft Corporation,C=US
CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=10, id=260, version=35207,
count=18, id=261, version=35207,
count=3, id=257, version=35229,
count=2, id=257, version=33145,
count=51, id=1, productName=Unmarked objects,
count=1, id=264, version=35229,
count=1, id=255, version=35229,
count=1, id=258, version=35229,
May 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
May 27, 2026
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=33145,
count=2, id=257, version=35721,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=40, id=1, productName=Unmarked objects,
count=7, id=260, version=35721,
count=27, id=261, version=35721,
count=5, id=259, version=35721,
count=1, id=256, version=35721,
count=1, id=255, version=35721,
count=1, id=258, version=35721,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.