Hostile ^92% datasets Download

210035

Stolen certificate, process injection APIs

Detects executables signed with stolen, revoked or invalid certificatesAuthenticode chain CN: TechSmith Corporation

SHA-2565f1c81b8fc1f9b810e4d0122bb0f795775c6a179aeadd28ee06ede52a3a4c4bc

MaleculeK(Am)H₇(CmDb₂F₂Hf₂MgOs₄Po₅)Md₃(Bi₃PaSi₂)Th

Evidence

COM self-registration entry points and InProcServer32 value 0x13340–0x13420

⋯3 more rows
0x1337000488941f8e876e2feff488bcb4883c4.H.A..v...H..H..
0x13380205be9f9ea0100cccccccccccccccccc [..............
0x1339040574883ec3048c7442420feffffff48@WH..0H.D$ ....H
0x133a0895c2440488bda488bf94885d2750433.\[email protected]
0x133b0c0eb35b930010000e8e1de0500488944..5.0........H.D
⋯7 more rows

DLL exports the COM unload and class-factory pair 0x3a820–0x3a8e0

⋯3 more rows
0x3a850cf488944242041ff5268488b17488bcf.H.D$ A.RhH..H..
0x3a8608bd8ff5210488b7c24688bc3488b5c24...R.H.|$h..H.\$
0x3a870704883c440415c5e5dc3b80140008048pH..@A\^][email protected]
⋯7 more rows

Locates a PE resource entry 0x4a9fd0–0x4aa2c0

⋯3 more rows
0x4aa000103df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa010113df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa020123df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa030133df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa040143df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa050153df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa060163df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa070173df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa080183df34cca58634d98fb372129deac90.=.L.XcM..7!)...
⋯4 more rows
0x4aa0d01e3df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa0e01f3df34cca58634d98fb372129deac90.=.L.XcM..7!)...
0x4aa0f0fd84fdaa332c774a90b8cba5ba11da22....3,wJ......."
0x4aa100203df34cca58634d98fb372129deac90 =.L.XcM..7!)...
0x4aa110220593190100000014c94d0000000000".........M.....
0x4aa12000000000030000009c5b4d0020000000.........[M. ...
0x4aa13000000000010000002205931901000000........".......
0x4aa140e0854d00000000000000000003000000..M.............
0x4aa150445c4d00200000000000000001000000D\M. ...........
0x4aa160220593190100000014c94d0000000000".........M.....
0x4aa1700000000003000000905d4d0020000000.........]M. ...
0x4aa18000000000010000002205931901000000........".......
0x4aa190dcee4d00000000000000000003000000..M.............
0x4aa1a0c05d4d00200000000000000001000000.]M. ...........
0x4aa1b02205931901000000b4d84d0000000000".........M.....
0x4aa1c00000000003000000f05d4d0020000000.........]M. ...
0x4aa1d000000000010000002205931901000000........".......
0x4aa1e0d48c4d00000000000000000003000000..M.............
0x4aa1f0285e4d00200000000000000001000000(^M. ...........
0x4aa20022059319010000002cd94d0000000000".......,.M.....
0x4aa2100000000005000000605e4d0020000000........`^M. ...
0x4aa22000000000010000002205931901000000........".......
0x4aa230d48c4d00000000000000000007000000..M.............
0x4aa240a85e4d00200000000000000001000000.^M. ...........
0x4aa25022059319010000002cd94d0000000000".......,.M.....
0x4aa2600000000003000000fc5e4d0020000000.........^M. ...
0x4aa27000000000010000002205931901000000........".......
⋯5 more rows

References C fopen file-open API 0x4aa889–0x4aab79

⋯3 more rows
0x4aa8b90593190200000008644d000000000000........dM......
0x4aa8c90000000400000018644d002000000000........dM. ....
0x4aa8d900000001000000540065006300680053.......T.e.c.h.S
0x4aa8e9006d006900740068002000460069006c.m.i.t.h. .F.i.l
⋯28 more rows
0x4aaab9f70a06dd68d0118fc100c04fd9189d00....h......O....
0x4aaac922a4cd88bdd011bd4e00a0c911ce86c0".......N.......
0x4aaad91c651e99b1d011821200c04fc32c4580.e.........O.,E.
0x4aaae99f580556c3ce11bf0100aa0055595a81.X.V........UYZ.
⋯6 more rows
0x4aab59270780010000000c270780010000000c'.......'.......
0x4aab6927078001000000220593190200000058'......".......X
0x4aab79644d0000000000000000000500000068dM.............h

GDI+ per-pixel bitmap readback 0x4aac98–0x4aad98

⋯3 more rows
0x4aacc840010480010000004001048001000000@.......@.......
0x4aacd8d8924c8001000000b61e078001000000..L.............
0x4aace8e0e000800100000050eb008001000000........P.......
0x4aacf840010480010000004001048001000000@.......@.......
0x4aad0858934c8001000000b61e078001000000X.L.............
0x4aad1810e100800100000050eb008001000000........P.......
0x4aad2840010480010000004001048001000000@.......@.......
⋯7 more rows