Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add zlibwapi.yml #95

Merged
merged 4 commits into from
Nov 24, 2024
Merged

Add zlibwapi.yml #95

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0be0d3e
Add zlibwapi.yml
Still34 Nov 24, 2024
2c9d261
Remove extra new line
wietze Nov 24, 2024
15a3ad9
Minor tweaks
wietze Nov 24, 2024
e4851e8
Merge branch 'main' into patches/add-zlibwapi
wietze Nov 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions yml/3rd_party/zlib/zlibwapi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
---
Name: zlibwapi.dll
Author: Still Hsu
Created: 2024-11-24
Vendor: zlib
ExpectedLocations:
- '%PROGRAMFILES%\DS Clock'
VulnerableExecutables:
- Path: '%PROGRAMFILES%\DS Clock\dsclock.exe'
Type: Sideloading
ExpectedVersionInformation:
- FileDescription: DS Clock
LegalCopyright: Copyright ©️ 2001-2023 Duality Software. All rights reserved. Developed by Vladimir Kulemin.
InternalName: dsclock.exe
OriginalFilename: dsclock.exe
ProductName: DS Clock
ProductVersion: 5.1.2.0
ExpectedSignatureInformation:
- Subject: CN=Duality Software LLC, O=Duality Software LLC, L=Saint Petersburg, S=Saint Petersburg, C=RU
Issuer: CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Type: Authenticode
SHA256:
- f85ce4492e1354f8310027c5f70ef73aae654fcd8fd9a58034e4f82a41a9826b
Resources:
- https://twitter.com/malwrhunterteam/status/1859316170773397966
- https://www.virustotal.com/gui/file/b8d38fc9f4560719fa64227e4b25b732b22602cb596d44cb38418a196c3340be
- https://github.com/Still34/malware-lab/tree/main/reworkshop/2024-11-24
Acknowledgements:
- Name: MalwareHunterTeam
Twitter: '@malwrhunterteam'
- Name: Still Hsu
Twitter: '@AzakaSekai_'