Signed Sample - Very Suspect

[Sandbox Breaker - DFIR]

VirusTotal

VirusTotal

www.virustotal.com

Xcitium says clean: Cloud Verdict Customer Login | Xcitium Cloud Verdict

Triage Says Suspect: Triage | Malware sandboxing report by Hatching Triage

Kaspersky Sandbox says clean: Kaspersky Threat Intelligence Portal

Sophos Intelix says clean or suspicious: Intelix UI

Listed as a trusted vendor with Comodo:

What do you guys think. Im going with suspect/malicious.

 

[Trident]

False positive, seems to be some weird and low-quality bootstrap downloading one of their secure browsers.

ITS - Create, Deliver, and Manage Tests

AI-powered assessment solutions built for security, reliability, and flexibility so test owners can reach candidates anytime, anywhere.

www.testsys.com

It can look a bit suspicious due to the fact that it's packed with UPX, signed by Comodo CA and probably not too frequently seen.

 

[Sandbox Breaker - DFIR]

False positive, seems to be some weird and low-quality bootstrap downloading one of their secure browsers.

ITS - Create, Deliver, and Manage Tests

AI-powered assessment solutions built for security, reliability, and flexibility so test owners can reach candidates anytime, anywhere.

www.testsys.com

It can look a bit suspicious due to the fact that it's packed with UPX, signed by Comodo CA and probably not too frequently seen.

Good. I was wondering what the hell was happening. The trusted vendor through me off.

 

[Trident]

Good. I was wondering what the hell was happening. The trusted vendor through me off.

It is mainly used to lock down the systems during tests and exams it seems. It can't download the browser because authorization is required.

 

[Sandbox Breaker - DFIR]

It is mainly used to lock down the systems during tests and exams it seems. It can't download the browser because authorization is required.

I was thinking that it was some sort of exam anticheat also before but didn't have enough to confirm. I was theorizing a compromised certificate. Plus their website is trash lol.

 

[harlan4096]

Hello,

No malicious software was found in the attached file.

Best regards, A.S., Malware Analyst, Kaspersky Lab
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 Kaspersky Cyber Security Solutions for Home and Business | Kaspersky Securelist | Kaspersky’s threat research and reports
Kaspersky Threat Intelligence Portal - get insights about suspicious files, hashes, URLs, IP addresses or domain names