Skinchanger.exePE analysis report - No threats detected

Submitted asBLZ.exe

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

34.6sto launch

5telemetry events

3observed

65agent notes

No threats detected

0/100

Nothing scored against this sample. A run reads as suspicious from 35.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+21

Static analysis

Packed (unknown/custom, confidence 84)
1 high-risk capability(ies): sandbox evasion

+14

Review confirms

3 of 3 local reviews independently read this as suspicious, on top of 21 points the platform measured itself

Model review

findings review (advisory, not scored): suspicious - packed executable, vm detection capability, registry write, signed binary

-35

Code signing

Valid code signature (Mykolai Skydan) - trusted provenance; heuristic score discounted below malicious (no definitive malicious evidence)

Model reading

Measured CLEAN0 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score

Dynamic ran no points

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution137s

Guest hardware2 vCPU4095 MB RAM

Detection signatures

4 detected · 1 withheld as common

Severity	Detection	Evidence	Layer
MED	Packed with unknown/custom MITRE T1027.002	packer unknown/custom packer identification entropy 7.80 file entropy (8.0 = random)	static
MED	TLS callback (pre-main execution) MITRE T1055	pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point	static
LOW	Adjusts token privileges (SeDebug / escalation) MITRE T1134 seen in 8% of benign software	import advapi32.dll!AdjustTokenPrivileges	static
LOW	Cryptographic capability (packing/ransom) MITRE T1573 seen in 6% of benign software	capability bcryptgenrandom capability: crypto	static

Withheld: 1 rule fired and was not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

WMI usage (recon / execution) fires on 40% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	none established at runtime
Cross-process injection	none observed
Payloads written to disk	none observed
Network connections	not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)	none observed
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	reported no detection
Anti-analysis / evasion checks	not measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

The file carries a code signature (Mykolai Skydan).
The local anti-virus engine reported no detection.
No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: packing detected.

Instrument coverage

0 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

Layer	Ran	What that means
Runtime anti-analysis watch	not measured	Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
API call sequence	not measured	Not measured. No anti-analysis hook armed on this run, so this sequence carries interpreter spawns only and an empty one does not mean the sample called no APIs.
Explicit module loads	not measured	Not measured. No in-process monitor reported in on this run, so no module load could be recorded and an empty list does not mean the sample loaded nothing.
Network capture	not on this plan	Not included on this scan's plan.
Live kernel introspection	not measured	Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Direct3D(11)

Packed Trusted signature

LibraryDirect3D(11)

Identity

File

typeexecutable

size20.8 MB

file arch64-bit (x64)

subsystemGUI

entropy7.8017

date2026-10-16 11:23:04 UTC

languageEN

Antivirus engine

no signature matched signature set 28161 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature set	Value
Set version	28161
Signatures in the set	3,642,894
Set published	22 Oct 2026 06:24 +0000
Age when this file was scanned	same day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

20.6 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 20.6 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural feature	What it means	Pushes	Weight
countersigned at	When a timestamp authority countersigned the signature (1792151424)	towards benign	-1.5407
certificate chain length	How many certificates the chain holds (2)	towards benign	-0.9734
image flag dll	Image flag: a library rather than a program	towards malicious	+0.9680
security directory size	Size of the security table (12352)	towards benign	-0.6332
security directory address	Location of the security table (21789696)	towards benign	-0.5585
readable executable sections	Sections marked both readable and executable (3)	towards malicious	+0.5532
resource directory size	Size of the resource table (322279)	towards benign	-0.3821
parser warning: Suspicious flags set for section...	Header defect reported by the parse: Suspicious flags set for section... (0)	towards benign	-0.3758

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing

Packed with unknown/custom

Packed code is compressed or encrypted on disk and only appears once the sample runs.

84/100

packer confidence

Detonation is the reliable read here A packed file hides its behaviour from a static pass, so the verdict leans on what it does when it runs.

Evidence 10 signals

Executable section '.text' has zero raw size (unpack target)
Executable section '. $*' has zero raw size (unpack target)
Executable-section entropy 7.82 (encrypted/packed)
Unusually few imports (17)
Entry point in non-code section '.,=K'
Non-standard section names: .fptable, _RDATA, _guard_c, _guard_d, memcmp_
Unusually many sections (17)
High-entropy overlay (7.62, 12352 bytes)
High-entropy resource (possible packed payload)
TLS callback present

Family configuration search

Not attempted

The sample is 20.8 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.

Sample size	20.8 MB
Bound	16.0 MB
Limit reached	Sample size, before any parser was loaded.

Capabilities

2 behaviour buckets · 1 high-risk

Severity	Capability	MITRE	APIs
high	Privilege escalation Adjusts tokens / privileges	T1134.001	adjusttokenprivileges
med	Cryptography Uses crypto APIs (often ransomware / packers)	T1573	bcryptgenrandom

Security mitigations

partial posture

ON ASLR (DynamicBase)

ON High-entropy ASLR (64-bit)

ON DEP / NX (NxCompat)

OFF Control Flow Guard

OFF SafeSEH

ON Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Sections

17 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.text Executable code	0x1000	0.0 B	10.3 MB expands	EXECUTEREAD	0.0
.rdata Read-only data	0xa42000	0.0 B	5.4 MB expands	READ	0.0
.data Initialised data	0xfab000	0.0 B	187.0 KB expands	READWRITE	0.0
.pdata Exception unwind data	0xfda000	0.0 B	531.6 KB expands	READ	0.0
.fptable Non-standard section	0x105f000	0.0 B	256.0 B	READWRITE	0.0
.tls Thread-local storage	0x1060000	0.0 B	10.4 KB expands	READWRITE	0.0
_RDATA Non-standard section	0x1063000	0.0 B	1.1 KB	READ	0.0
_guard_c Non-standard section	0x1064000	0.0 B	36.0 B		0.0
_guard_d Non-standard section	0x1065000	0.0 B	36.0 B		0.0
memcmp_ Non-standard section	0x1066000	0.0 B	88.0 B		0.0
memcpy_ Non-standard section	0x1067000	0.0 B	332.0 B		0.0
memset_ Non-standard section	0x1068000	0.0 B	120.0 B		0.0
. $* Non-standard section	0x1069000	0.0 B	9.5 MB expands	EXECUTEREAD	0.0
.h2h Non-standard section	0x19ea000	11.0 KB	10.7 KB	READWRITE	0.0837
.,=KEP Non-standard section	0x19ed000	20.5 MB	20.5 MB	EXECUTEREAD	7.821
.rsrc Resources	0x2e63000	315.0 KB	314.7 KB	READ	3.8532
.reloc Base relocations	0x2eb2000	512.0 B	180.0 B	READ	2.0928

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

17 funcs / 17 DLLs · 1 suspicious

▸d3d11.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
D3D11CreateDevice	0x019ea000	-	-

▸ADVAPI32.dll1 func 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
AdjustTokenPrivileges	0x019ea010	-	T1134

▸WSOCK32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
WSACleanup	0x019ea020	-	-

▸WS2_32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetAddrInfoExCancel	0x019ea030	-	-

▸KERNEL32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
AcquireSRWLockExclusive	0x019ea040	-	-

▸USER32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
AdjustWindowRectEx	0x019ea050	-	-

▸SHELL32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CommandLineToArgvW	0x019ea060	-	-

▸ole32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CoCreateInstance	0x019ea070	-	-

▸OLEAUT32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
SysStringLen	0x019ea080	-	-

▸GDI32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CreateRectRgn	0x019ea090	-	-

▸IMM32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
ImmGetContext	0x019ea0a0	-	-

▸D3DCOMPILER_47.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
D3DCompile	0x019ea0b0	-	-

▸dwmapi.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
DwmEnableBlurBehindWindow	0x019ea0c0	-	-

▸api-ms-win-core-synch-l1-2-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
WaitOnAddress	0x019ea0d0	-	-

▸IPHLPAPI.DLL1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
if_nametoindex	0x019ea0e0	-	-

▸bcrypt.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
BCryptGenRandom	0x019ea0f0	-	-

▸CRYPT32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CertCloseStore	0x019ea100	-	-

Binary metadata

what the headers declare about this build

Resource langs	EN
Debug info	no
TLS callbacks	yes

Code signing

Trusted signature

Mykolai Skydan

issued by GlobalSign GCC R45 EV CodeSigning CA 2020

Signed by	Mykolai Skydan
Issuer (CA)	GlobalSign GCC R45 EV CodeSigning CA 2020
Valid	2026-05-13 → 2027-05-14
Serial	3d00691fc72435be00abab3a
Algorithm	SHA256-RSA

Verification

Embedded signature: OK

Chain verification: verified

Provenance

The chain verifies as of now, so these bytes are attributable to the publisher above.

Signed at	2026-10-16T11:51:15+00:00 proven
Countersigned by	Globalsign R45 TSA for CodeSign 202510 under GlobalSign Timestamping Root R45
Countersignature form	RFC3161 token a signed structure issued by the timestamp authority, which is the stronger of the two forms and the one preferred here when a file carries both
Authority revocation	unanswered no definite revocation answer was obtained for this authority's own chain
Dated by	This platform's own verification of the countersignature - the same reading that proves it, so the moment the chain is judged at and the proof of that moment are one thing.
Second reading	2026-10-16T11:51:15+00:00 agrees with ours
Second opinion	unverifiable an independent verifier's separate answer about the same countersignature, kept so the two can be compared

Certificate chain (2)

Subject	Issuer	Valid to	Algo
GlobalSign GCC R45 EV CodeSigning…	GlobalSign Code Signing Root R45	2030-07-28	SHA256-RSA
Mykolai Skydan	GlobalSign GCC R45 EV CodeSigning…	2027-05-14	SHA256-RSA

Resources

Resource Hacker view

Group Icon1Icon10Manifest1

▸Group Icon1

IDI_MAINICONEN

▸Icon10

1EN

2EN

3EN

4EN

5EN

6EN

7EN

8EN

9EN

10EN

▸Manifest1

1EN

Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.

Group Icon IDI_MAINICON Download

Type	Group Icon
Name / ID	IDI_MAINICON
Language	EN
Size	146.0 B
RVA offset	0x2eb18d8
Content signature	Icon
MD5	ff9af45181e4bc022ba467fc5484fdc4
Entropy	3.096

Icon 1 Download

Type	Icon
Name / ID	1
Language	EN
Size	21.6 KB
RVA offset	0x2e632b8
Content signature	PNG
MD5	c4c2def3111a6ed22183661911fd3fd0
Entropy	7.979

Icon 2 Download

Type	Icon
Name / ID	2
Language	EN
Size	148.5 KB
RVA offset	0x2e68910
Content signature	Icon
MD5	8caff3e07e2b21beb04eda9bc59d0d84
Entropy	3.035

Icon 3 Download

Type	Icon
Name / ID	3
Language	EN
Size	66.0 KB
RVA offset	0x2e8db38
Content signature	Icon
MD5	a55b0652e9b3e4135115458584543542
Entropy	3.268

Icon 4 Download

Type	Icon
Name / ID	4
Language	EN
Size	37.2 KB
RVA offset	0x2e9e360
Content signature	Icon
MD5	40f2b1358fdf7f30bfcfefe3417e5994
Entropy	3.462

Icon 5 Download

Type	Icon
Name / ID	5
Language	EN
Size	16.5 KB
RVA offset	0x2ea7808
Content signature	Icon
MD5	f48a2ad558ab838c254c37f7fbc69748
Entropy	3.801

Icon 6 Download

Type	Icon
Name / ID	6
Language	EN
Size	9.4 KB
RVA offset	0x2eaba30
Content signature	Icon
MD5	79747a2012e159d6a6db8e875beb576d
Entropy	4.072

Icon 7 Download

Type	Icon
Name / ID	7
Language	EN
Size	6.6 KB
RVA offset	0x2eadfd8
Content signature	Icon
MD5	00aa1c2c31907de1eed4a9332f1657c4
Entropy	4.266

Icon 8 Download

Type	Icon
Name / ID	8
Language	EN
Size	4.2 KB
RVA offset	0x2eafa40
Content signature	Icon
MD5	61389d2f587f560d21b79d3c6543cb76
Entropy	4.59

Icon 9 Download

Type	Icon
Name / ID	9
Language	EN
Size	2.4 KB
RVA offset	0x2eb0ae8
Content signature	Icon
MD5	b577dc4cccd313edf649182bf97f4810
Entropy	4.888

Icon 10 Download

Type	Icon
Name / ID	10
Language	EN
Size	1.1 KB
RVA offset	0x2eb1470
Content signature	Icon
MD5	c426d01007764b2489cecaa5048859b7
Entropy	5.413

Manifest 1 Download

Type	Manifest
Name / ID	1
Language	EN
Size	375.0 B
RVA offset	0x2eb1970
Content signature	XML manifest
MD5	1f7f9f7576fa558def076a2171be2723
Entropy	4.755

Application manifest

<?xml version="1.0" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1"
          manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
         <requestedExecutionLevel level='requireAdministrator' uiAccess='false'/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Capability detection

4 capabilities

Capability	Namespace
contain loop	-
reference analysis tools strings	anti-analysis
contain a thread local storage (.tls) section	executable/pe/section/tls
reference anti-VM strings targeting Xen	anti-analysis/anti-vm/vm-detection

ATT&CK techniques

Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]

Malware Behavior Catalog

Anti-Behavioral Analysis::Virtual Machine DetectionDiscovery::Analysis Tool Discovery::Process detection

Signature matches

2 findings · 4 file properties · 0 scored

Rule	What it matched	Corpus	Weight
maldoc_getEIP_method_1 maldoc	No description 1 of 1 string matched $a \xe8\x00\x00\x00\x00Z at 0xe09c48 · 1017 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.
possible_includes_base64_packed_functions	Detects possible includes and packed functions 2 of 2 strings matched $f AtOB at 0x97ac4b $fff This at 0x4e · 57989 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.

File properties - not findings

IsPE64IsWindowsGUIIsPackedHasOverlay

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 185

!This program cannot be run in DOS mode.$
.text
`.rdata
@.data
.pdata
@.fptable
.tls
_RDATA
memset_
h.rsrc
@.reloc
vXRA
A|ETh
Tosh
DIfa
'Jfat
7Jfad
mnX+LE
tdtR
siQY_
dsiQ
AdjustWindowRectEx
AZ%l
E.OW
WOLEAUT32.dll
R7 fad
.ps($Fh
R.DZ
6.eD
.aBd
#Qg%s
ESql
%XICY
Otyh
a?pyaR
TB7TOj
Ud_Rhae
P\ECD
hONC|
<<g%l
ACadq
NCAh
fab9me
pYaSt0pYac
X%d2WsYa
4%l4
pAB^H
E}RSo
<QIIN
h"lUT
a .te
LCCa
3%xm2%&]
d1iedei
Ya.Oe
TTmli
t4mli
t.XS
G%s>
nf_Ui
mKy(.CmKy
=dinL
DwmEnableBlurBehindWindow
N.CK
'1.Lg
.jP?L
mxut
eSU2H
RYnt
.pjA
bhUL
UTKB
d(IPNP
].BOO
fnpe;
!qioA
ystF
I.Md
I>ALqj
K.tA
seXX
trnP
pXSIK
dw%s
lA%x
lomt
N%l^
V.be
qgeZ
DCth
nNOB
Prtr
IDI_MAINICON
EMTa
ouJ^L
%l0|
cse%R
j+.sZ
byo$f
PRNc
Nzon
j|erg
YE"ORt
_jrch
0rNHA
T}oio
'GVE8G
~1mZC;A
3@ieDI
Rqes
-bm_XL
YOlu
%d6=z6
.GMd
?OFZXH5
ozOU
Hoju
Dandqs
jaDX
gr ith
%l+z"
esSCV
ORZ$g
?.uA*:
a<.AGR
V%s{|i
AVD+I
ck_qeD
.Ek>U
qkA.ZN
>oMVC4
{X NAD
DIDX
ydAT
IDBHG
ORWV
amAPE
llR8D
LAcc
t6oYS
'%s)[
.rrz
Cuid
R2%x
B@TIen
a.tM
W%db
eiTE
@,%x_
nshL
\Julz
Ifn%d
0[esG]J
mASX
LA%l
LEiu
.WWM
cflPeA
PpArG7yP8kf
sAD~J
6\\/
SOB`x
'GSM0A>
fzzp'a
W{.kQ
ogEG
l^%l
bC_Ih
FH_LQ5
PRMA
b%|mecIb
.om`K
AUTs
.LUs
G.br
hoce
.wG/G
aICU
Vm_IqB
T`WAD(
ygl|A6
@T@tpr
illB
[.nR
itxS

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 25 insns

AddressBytesMnemonicOperands

0x14214d3aae8ff2f0000call0x1421503ae

0x14214d3af693bc9399c8aimuledi, dword ptr [rbx], 0x8a9c39c9

0x14214d3b5b7ecmovbh, 0xec

0x14214d3b76cinsbbyte ptr [rdi], dx

0x14214d3b89flahf

0x14214d3b9a3bae16f472ce1655amovabsdword ptr [0x5a65e12c476fe1ba], eax

0x14214d3c27f6bjg0x14214d42f

0x14214d3c47e56jle0x14214d41c

0x14214d3c67478je0x14214d440

0x14214d3c8f5cmc

0x14214d3c97b46jnp0x14214d411

0x14214d3cb8754c815xchgdword ptr [rax + rcx*8 + 0x15], edx

0x14214d3cfcbretf

0x14214d3d0468754e89dxchgdword ptr [rax + r13*8 - 0x63], r10d

0x14214d3d5234687andeax, dword ptr [rsi - 0x79]

0x14214d3d854pushrsp

0x14214d3d900663baddbyte ptr [rsi + 0x3b], ah

0x14214d3dc468754086exchgdword ptr [rax + r9 + 0x6e], r10d

0x14214d3e1034687addeax, dword ptr [rsi - 0x79]

0x14214d3e454pushrsp

0x14214d3e5a036ab468754f98e23movabsal, byte ptr [0x238ef9548746ab36]

0x14214d3ee468754b00exchgdword ptr [rax + r14*4 + 0xe], r10d

0x14214d3f33a1467cmpdl, byte ptr [rdi + riz*2]

0x14214d3f65apoprdx

0x14214d3f750pushrax

callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample

Fingerprint	12:2bVap1bOMXPBsN6m4wxrn5PjnIXUYa9Yb:2xafOWpXm4wxxIuQ
Imports read	17 functions from 17 libraries (17 distinct)
Comparable	yes
Compared against	96 stored samples

Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

97 frames · screen recording · 137s

1 / 97

0:00 · 1/97

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 137s

1 process(es) observed

LaunchedC:\Users\user\Desktop\Skinchanger.exe

Privilegestandard

Telemetry sources: Kernel ETW (8 of 140 events) Process audit: 2keydiff: 1

Evasion / anti-analysis checks

4 checks

MED

System Checks Capability analysis

MITRE T1497

MED

Reference analysis tools strings Capability rule

MITRE T1497 · Anti-analysis

MED

Reference anti-VM strings targeting Xen Capability rule

MITRE T1497.001 · Virtual-machine detection

MED

Virtual Machine Detection Capability taxonomy

MITRE T1497 · Anti-Behavioral Analysis

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 912 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

1 read

1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process

1registry operation

BLZ.exe

1 process

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Registry operations1

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 2 registry · sample scope

Files (0) Registry (2)

Operation	Target	Process
create	Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters kernel trace	Skinchanger.exe pid 1704
setvalue	Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters TrapPollTimeMilliSecs = 15000 read backread back	-

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Earlier analysis of these bytes

1 earlier run

Earlier analyses of the identical file, matched by SHA-256. Same bytes, same questions - what this platform found the last time it looked is evidence about the file in front of you now.

Run	Analysed	Module	Verdict	Score
#2900	2026-10-22 17:21	File Analysis	No threats detected0	0/100

1 reported a hit 9 answered no 13 had nothing to check

1Sources with a hit

10Sources queriedof 23 available

470.6kFeed records

0Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	3,003 records 52 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 4 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,153 records 52 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,680 records 52 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

nothing of this kind to check

Source	Checks	Result	Detail	Feed
blocklist.de	IP / domain / URL	not checked	no IP, domain or URL observed to check	27.6k records 52 minutes ago
CINS Army	IP / domain / URL	not checked	no IP, domain or URL observed to check	15k records 52 minutes ago
Emerging Threats	IP / domain / URL	not checked	no IP, domain or URL observed to check	482 records 52 minutes ago
Feodo Tracker	IP / domain / URL	not checked	no IP, domain or URL observed to check	5 records 52 minutes ago
IPsum	IP / domain / URL	not checked	no IP, domain or URL observed to check	19.7k records 52 minutes ago
Phishing.Database	IP / domain / URL	not checked	no IP, domain or URL observed to check	391.5k records 4 hours ago
ThreatFox	IP / domain / URL	not checked	no IP, domain or URL observed to check	1,153 records 52 minutes ago
URLhaus	IP / domain / URL	not checked	no IP, domain or URL observed to check	no records ingested

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 10 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

1 of 2 listed

Source	Checks	Result	Detail	Feed
Signature rules	Sample content	2 matches	maldoc_getEIP_method_1, possible_includes_base64_packed_functions	110 records 52 minutes ago
Sigma rules	Behavior log	clean	-	2,275 records 5 hours ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	1 process image path, none masqueraded	245 records 52 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 51 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 52 minutes ago
LOLRMM	Names and domains	clean	2 name/domain indicators checked, no remote-management tooling	360 records 52 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 0 suspicious 3 info

File indicators

Severity	Type	Indicator	Description
info	sample_sha256	8c79906319148f2ba30b421386954c5d7be964914e831c832d84042918489d98	Submitted sample (SHA256)
info	sample_md5	86934d0ad32d3a78b5f34660db0e3c0f	Submitted sample (MD5)
info	imphash	5482166703c7a0db1fb0f4c96ea9ac6b	Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2904

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

2 runs

This file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.

Submitted	Environment	Verdict	Score
2026-10-22 20:40 Shown below	Windows 10 22H2	No threats detected	0/100
2026-10-22 17:12	Windows 10 22H2	No threats detected	0/100

Skinchanger.exePE analysis report - No threats detected

Run integrity

Why this verdict

Model reading

Analysis layers

Sample

Run conditions

Detection signatures

What the tests returned

Arguing against malice

How much weight this carries

Instrument coverage

Structure

Sections & resources

Signatures & packing

Strings

Code

Antivirus engine

Local ML assessment

Family configuration search

Capabilities

Security mitigations

Sections

Imports

Binary metadata

Code signing

Resources

Resources

Capability detection

Signature matches

Extracted strings

Disassembly

Nothing in this view

Import fingerprint

Screen recording

Behavior summary

Evasion / anti-analysis checks

Command lines, unwrapped

Network activity

Process tree

BLZ.exe

Attributed activity

Not attributed to any process

Persistence mechanisms

No persistence established

Detection coverage

File activity summary

Dropped payload analysis

File & registry ops

Earlier analysis of these bytes

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

AI analysis

File indicators

Sigma detections

Generated rules

No generated rules

Extracted files

No extracted files

Export & download

AI analysis report

Public analyses of this file