Weird Results for this File

[Sandbox Breaker - DFIR]

VirusTotal

VirusTotal

www.virustotal.com

Not Signed

Xcitium Cloud Verdict

Scan Files Online using Comodo File Verdict Service that runs tens of different methods to analyze a file and display the detailed results in seconds

verdict.xcitium.com

Signed and Trusted?

GPT Says its Emotet.

Just wanted to post this...

File can be downloaded on triage.

 

[Kongo]

Enforced trusted result by FileScan: FileScan.IO - Next-Gen Malware Analysis Platform

 

[Sandbox Breaker - DFIR]

I didn't spend any time on this busy was wondering why it says signed when VT says it's not.

 

[cartaphilus]

I didn't spend any time on this busy was wondering why it says signed when VT says it's not.

I wouldn't trust a verdict from GPT. I think of GPT as a WebMD version when comes to indicators of compromise or in human terms.... medical symptoms.

"Web MD, I got a headache"

WebMD: it's probably cancer

 

[Kongo]

I didn't spend any time on this busy was wondering why it says signed when VT says it's not.

Well, I am sure it's an official file from Dropbox so nothing malicious about it. But I wonder too why VT says it isn't signed

 

[Sandbox Breaker - DFIR]

Well, I am sure it's an official file from Dropbox so nothing malicious about it. But I wonder too why VT says it isn't signed

That was why I posted it. I saw @struppigel post a video with VT weirdness.

 

[Sandbox Breaker - DFIR]

Username?

 

[Trident]

I am on a mobile device at the moment and not home (like 99% of the time). Maybe there is tracking information inserted in the installer? Someone can have a look on a hex editor.

 

[danb]

The file is clean / safe and signed... I am not sure why VT says it is not signed.

 

[Sandbox Breaker - DFIR]

The file is clean / safe and signed... I am not sure why VT says it is not signed.

Precisely.

 

[cruelsister]

Just a thought- the dropboxupdate.exe connections out to their server (162.125.8.20 and 162.125.3.13) has been classed as suspicious by some for a couple of years, probably (but not certainly) due to Emotet at one time hijacking DropBox to spread.

 

[upnorth]

Where exact does this specific file come from/found = source?

DropboxUpdateSetup.exe 1.3.761.1

Some of the data is a bit weird. The certificate looks manipulated:

but that does not automatic means, malicious. One have to compare it with a original " update " file from Dropbox main site. I was actually able to find the exact same version number that also have zero flags on VT, and where VT shows the signature correct/valid:

VirusTotal

VirusTotal

www.virustotal.com

Same version number, but different Hash values. Even the compile date on these 2 files is exact the same, so that's weird. But the first submissions dates are different. Lets see what the original file from Dropbox url shows with the signature:

PE Header and the Overlay Hash is different. Also got some " appended " data.

 

[Sandbox Breaker - DFIR]

The file popularity is also low. It should be more seen in the wild.

 

[struppigel]

This is exactly the same issue as with the Glasswire download we also analysed. Dropbox is also one of those vendors who save data in the certificate, so that the certificate is not broken.

It is not VirusTotal that is weird but Microsoft Windows being weird in allowing manipulated certificates as valid unless you opt-out.

And the reason for allowing it is, well, companies like Dropbox abusing this vulnerability in legit installers. Why? Imagine you download something from a dropbox link but have no dropbox installed. How will it know what you wanted to download without putting this information into the installer somehow? That is why. They cannot sign the installer for each and every download and they do not want to use non-signed ones. So they inject the data into the certificate instead.

@upnorth was completely correct here in his assessment and despite the manipulation the file is clean. VT is also correct.

 

[Sandbox Breaker - DFIR]

Glad my finding brought this sample under the spotlight. Something seeming to "innocent". Always good to verify

 

[upnorth]

Security Update Guide - Microsoft Security Response Center

msrc.microsoft.com

The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set.

You must restart the system for your changes to take effect.