WinRAR.zip
- SHA256 44d2b20e32183e91d37e6a7ff5b21287d4453fccc1f4c00ffa9d909df76b70bb
Static task
static1
Behavioral task
behavioral1
Sample
Fling-Standalone31.559.6032.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
borlndmm.dll
Resource
win10v2004-20260911-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/borlndmm.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/borlndmm.dll |
Aug 22, 2022
CN=ACCA software S.p.A.,O=ACCA software S.p.A.,L=BAGNOLI IRPINO,ST=AVELLINO,C=IT
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=6, id=259, version=33145,
count=9, id=259, version=35721,
count=15, id=260, version=35721,
count=31, id=261, version=35721,
count=3, id=257, version=33145,
count=109, id=1, productName=Unmarked objects,
count=1, id=265, version=36256,
count=1, id=256, version=36256,
count=1, id=258, version=36256,