上个样本释放的带有效签名的载荷vt0

wwwab

tony099 发表于 2025-9-19 09:29
卡巴人工检测回复：

geekerpdf.rar\geekerpdf.exe - Trojan-Dropper.Win32.Agent.tkdble

Hello,

Yes, this file 19372501513C464E3BA1BB659A97A81C is resigned by malware actor and is used only with malicious libraries for dllhijack. We detect it to identify all such cases of infection.
We are not detecting this file 4234c82f96f3f59a0377127ad8c01b07.

Best regards, Denis Sitchikhin, Malware Analyst
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

wwwab

说人话：geekerpdf.exe这玩意儿就是被银狐用自己的黑签名重新签名的白文件，卡巴斯基添加检测不是说这个文件本身有问题，而是因为这份被银狐重新签名的文件目前只被银狐用作dll劫持白利用用途，并且签署的是银狐自己的黑签名，添加该检测用于作为一个特征指标识别此类型的恶意软件和感染迹象。