Hostile ^92% datasets Download

209428

Stolen certificate, registry manipulation

Detects executables signed with stolen, revoked or invalid certificatesAuthenticode chain CN: MEDIATEK INC.

SHA-2565def75d7d7522cc77fe838abe1e89a291baf10fa149399bd7db188785784ede4

MaleculeK(Am)H₅(Cm₂DbOs₄PoTi)Md₃(BiPaSi₃)Th

Evidence

Local RPC protocol sequence 0x57fc0–0x582b0

⋯3 more rows
0x57ff0128a450000000000c08b450000000000..E.......E.....
0x5800000000000000000000000000000000000................
0x5801000000000000000000000000000000000................
0x580206000000075058a00924d82dcefca85bb`...u....M......
0x58030a349094d01000000045d888aeb1cc911.I.M.....]......
0x580409fe808002b1048600200000000000000....+.H`........
0x5805020904600000000000000000000000000 .F.............
0x5806000000000000000000000000000000000................
0x58070e08b4500000000000000000400000000..E.............
0x58080443a28443b4f4943493b47413b3b3b42D:(D;OICI;GA;;;B
0x58090472928443b4f4943493b47413b3b3b41G)(D;OICI;GA;;;A
0x580a04e2928413b4f4943493b475247574758N)(A;OICI;GRGWGX
0x580b03b3b3b41552928413b4f4943493b4741;;;AU)(A;OICI;GA
0x580c03b3b3b42412900006e63616c72706300;;;BA)..ncalrpc.
0x580d04e657400706970650000000000000000Net.pipe........
⋯3 more rows
0x5811026002600200030002900000000000000&.&. .0.).......
0x5812042007500660066006500720020006900B.u.f.f.e.r. .i.
0x581307300200074006f006f00200073006d00s. .t.o.o. .s.m.
⋯9 more rows
0x581d02000260026002000280028005f005300 .&.&. .(.(._.S.
0x581e069007a00650049006e00420079007400i.z.e.I.n.B.y.t.
0x581f0650073002900290020003e0020003000e.s.).). .>. .0.
0x5820000000000000000002800730074007200........(.s.t.r.
0x5821069006e006700200021003d0020004e00i.n.g. .!.=. .N.
0x5822055004c004c0029000000000000000000U.L.L.).........
0x5823073007000720069006e00740066000000s.p.r.i.n.t.f...
0x5824073007000720069006e00740066002e00s.p.r.i.n.t.f...
0x582506300000000000000280066006f007200c.......(.f.o.r.
0x582606d0061007400200021003d0020004e00m.a.t. .!.=. .N.
0x5827055004c004c0029000000000000000000U.L.L.).........
0x582807000720069006e007400660000000000p.r.i.n.t.f.....
⋯3 more rows

ASCII case-folding substitution table 0x5ec10–0x5ed20

⋯3 more rows
0x5ec40101112131415161718191a1b1c1d1e1f................
0x5ec50202122232425262728292a2b2c2d2e2f !"#$%&'()*+,-./
0x5ec60303132333435363738393a3b3c3d3e3f0123456789:;<=>?
0x5ec70406162636465666768696a6b6c6d6e6f@abcdefghijklmno
0x5ec80707172737475767778797a5b5c5d5e5fpqrstuvwxyz[\]^_
0x5ec90606162636465666768696a6b6c6d6e6f`abcdefghijklmno
0x5eca0707172737475767778797a7b7c7d7e7fpqrstuvwxyz{|}~.
0x5ecb0808182838485868788898a8b8c8d8e8f................
⋯7 more rows

PDB in numbered directory (build artifacts) 0x63ad8–0x63c18

⋯3 more rows
0x63b085bd199459ae8c40f1f3da77601000000[..E.....=.v....
0x63b18653a5c57434e5f4155544f5c776f726be:\WCN_AUTO\work
0x63b2873706163655c41525f57434e2d57695fspace\AR_WCN-Wi_
0x63b3846695f4170706c69636174696f6e5f52Fi_Application_R
0x63b48616c696e6b5265676973747279577269alinkRegistryWri
0x63b587465725f7836345c35385c636f646562ter_x64\58\codeb
0x63b686173655c52616c696e6b526567697374ase\RalinkRegist
0x63b7872795772697465725c52656c65617365ryWriter\Release
0x63b885c5261526567697374727936342e7064\RaRegistry64.pd
0x63b9862000000000000000000000000000000b...............
0x63ba800000000c0a40600c047060000000000.........G......
⋯7 more rows

Registry key creation API 0x67606–0x67736

⋯3 more rows
0x67636ec015265674f70656e4b657945784100..RegOpenKeyExA.
0x67646d1015265674372656174654b65794578..RegCreateKeyEx
0x676564100d80152656744656c65746556616cA...RegDeleteVal
0x6766675654100d40152656744656c6574654bueA...RegDeleteK
⋯13 more rows

IsDebuggerPresent API name in PE strings 0x67798–0x679e8

⋯27 more rows
0x6794874556e68616e646c6564457863657074tUnhandledExcept
0x67958696f6e46696c74657200350249734465ionFilter.5.IsDe
0x6796862756767657250726573656e7400d002buggerPresent...
0x6797852746c43617074757265436f6e746578RtlCaptureContex
⋯7 more rows