Example report
fabdeploy.exe
| review | 61/ 100 | D44 / 100 | estimated |
| verdict | file trust | vendor risk | attribution |
|---|---|---|---|
| confidence moderate, risk moderate | 5 weighted factors | identity estimated | content-derived |
Verdict
No malicious signals in any examined path, and no signature to establish who published it. The vendor is inferred from the artifact rather than verified. This needs a human decision, and the decision is about provenance rather than about behaviour.
This artifact appears in the endpoint register at fineness 720. Same value, same meaning, different surface: the register states the confidence, this report shows how it was reached. See it in the register.
Key findings
- Unsigned. There is no certificate, so there is nothing to verify a publisher against and no chain to check. Absent, rather than invalid or expired.
- Vendor inferred as Fabrikam, Inc. from three independent properties of the file itself, version resource, embedded strings, and toolchain artifacts, which agree with one another. That agreement is what produces moderate confidence rather than low.
- No catalog entry exists for this product under any name. It was never published, so there is nothing to look it up in. A catalog-based tool cannot reach a conclusion here at all.
- Built with a toolchain several years older than its declared version. Consistent with a long-lived internal tool, and noted because it bears on the maintenance question rather than the safety one.
Recommended actions
- Before approvalConfirm with whoever engaged the contractor that this binary is theirs and is current. No property of the file can settle that.
- Before approvalRequest signed builds for future releases. A signature moves this from inferred to verified and removes the decision entirely.
- On approvalRecord the hash. With no signature and no catalog identity, the hash is the only stable handle on this artifact.
- OngoingAny change produces a different hash and no way to distinguish an authorised update from an unauthorised one. Re-analysis on change is the only control available.
Decision4Why it concluded that, and whether to approve
Verdict factors
| factor | reading | weight | detail |
|---|---|---|---|
| Code signature | attention | high | Absent. Not invalid, not revoked, absent. There is nothing to verify. |
| Malicious signals | positive | high | No rule matches in any examined content path. See Analysis coverage for what was and was not examined. |
| Vendor reputation | neutral | medium | Vendor inferred, not verified. A reputation record cannot be attached to an identity that has not been established. |
| Software category | neutral | medium | Deployment tooling. Elevated baseline by category, not by finding. |
| Licence obligations | neutral | medium | No licence declared and none inferable. Contract terms, not file terms. |
| Terms-of-service posture | neutral | low | Not applicable to a binary that was never published. |
Scores
61/ 100 file trust
| dimension | weight | score | note |
|---|---|---|---|
| Malicious signals | 40% | 100 | No matches in examined paths |
| Code signing | 20% | 0 | Unsigned: no publisher established |
| Vendor reputation | 20% | 40 | Identity inferred, so reputation is unattachable |
| Software category | 15% | 50 | Deployment tooling, elevated baseline |
| Terms-of-service posture | 5% | 50 | Not applicable |
Vendor2Who published this, and what corroborates it
Vendor intelligence
D44 / 100 vendor risk · identity estimated · evidence completeness 38%
Identity confidence is graded, not asserted. Every line below is tied to something in the artifact itself: a certificate subject, a declared product string, because a package name is not a vendor.
| dimension | weight | score | note |
|---|---|---|---|
| Identity verification | 25% | 35 | Three artifact properties agree; none is authenticated |
| Security posture | 25% | 30 | No public disclosure process to assess |
| Code signing | 15% | 0 | Unsigned |
| Licence compliance | 15% | 50 | No declared licence; governed by contract |
| Community health | 10% | 40 | No public repository, expected for contractor work |
| Vendor maturity | 10% | 70 | A registration matching the inferred name exists |
Confidence is capped at estimated and cannot rise without an authenticated tie between the artifact and the vendor. Three agreeing but unauthenticated properties lift it above a guess; no number of them makes it verified. A package name is not a vendor, and neither is a resource string.
Evidence
| source | tied to | says |
|---|---|---|
| PE version resource | CompanyName field inside this artifact | Fabrikam, Inc. |
| Embedded strings | Build paths and copyright strings in the binary | Consistent with the same company name |
| Toolchain artifacts | Rich header and linker markers | One consistent build environment across all sections |
| Company registration | The inferred name only, not to the artifact | A company of that name is registered, which corroborates nothing about who built this file |
Enterprise readiness
| Deployment method | Copied into place; no installer |
|---|---|
| Silent install | Not applicable |
| Update mechanism | None, replaced manually |
| Uninstall | No uninstall entry; deleting the file is the uninstall |
| Runs as service | No |
| Network listeners | None indicated by imports |
| Telemetry | None identified |
| Offline operation | Yes |
Approval readiness
Review, provenance, not behaviour
Conditions
- Ownership confirmed with the engaging team
- Hash recorded as the identity of record
- Signed builds requested for future releases
Rules matched
| Signed by verified publisher | review |
|---|---|
| Minimum trust score ≥ 70 | review |
| Known vendor in sanctioned register | review |
| No malicious signals | allow |
Compliance3Framework posture, obligations, and the limits
Compliance
| framework | met | gap | review |
|---|---|---|---|
| NIST SP 800-53 | 3 | 2 | 2 |
| SOC 2 | 2 | 1 | 2 |
| ISO 27001:2022 A.8 | 2 | 1 | 2 |
| CMMC 2.0 | 1 | 1 | 2 |
| PCI-DSS v4.0 | 1 | 1 | 1 |
| HIPAA Security Rule | 1 | 0 | 1 |
| GDPR | 1 | 0 | 0 |
Controls
| control | status | note |
|---|---|---|
| SI-7Software integrityNIST SP 800-53 | gap | No signature, so no integrity mechanism beyond the recorded hash |
| CM-7Least functionalityNIST SP 800-53 | met | Single binary, no bundled components |
| SA-12Supply chain protectionNIST SP 800-53 | gap | Provenance rests on an unauthenticated claim inside the artifact |
| CM-11User-installed softwareNIST SP 800-53 | review | Present in a machine-wide path with no installer record |
| CC6.8Unauthorised softwareSOC 2 | review | Approval is possible, but the identity being approved is inferred |
| CC7.1Change detectionSOC 2 | gap | No signature; change detection depends entirely on hash comparison |
| A.8.19Software on operational systemsISO 27001:2022 A.8 | review | Present and recorded; provenance incomplete |
| A.8.30Outsourced developmentISO 27001:2022 A.8 | gap | Contractor-supplied with no verifiable link to the supplier |
Licence obligations
None declared. Governed by the contract with the supplier, not by anything in the file.
| obligation | applies | note |
|---|---|---|
| Commercial-use restriction | no | No terms present in the artifact |
| Attribution | no | No third-party notices found |
| Copyleft | no | No copyleft-licensed components identified |
| Source disclosure | no | Not triggered |
| Patent grant | no | None present |
Analysis coverage
What was examined, and what was not. The limits belong next to the decision, not behind it.
Examined
| PE structure, sections, imports, resources | full |
|---|---|
| Signature slot, confirmed absent rather than assumed | full |
| Embedded strings and toolchain artifacts | full |
| Rule matching across extracted content | full |
| Similarity against this tenant’s own history | full |
Not examined
| Advisory and vulnerability status | Not assessed. This report describes what the file is and who made it, not what is known to be wrong with the software. |
|---|---|
| Runtime behaviour | Static analysis only. Nothing here describes what the binary does when executed. |
| Multi-engine antivirus verdicts | Multi-engine antivirus runs on a customer-supplied key by design: the quota and the data-sharing decision stay with you rather than with us. No key is attached to this example, so no engines were consulted. |
| Supplier confirmation | Whether Fabrikam actually produced this file is a question for the engaging team. No property of the artifact can settle it. |
Composition4What it is made of, and what identifies it
File overview
| Type | PE32 executable (console) Intel 80386 |
|---|---|
| Family | Windows executable |
| Size | 4.2 MB |
| Submitted | 2026-08-03T04:12:44Z |
| Completed | 2026-08-03T04:13:02Z |
File identifiers
| SHA-256 | 7c1f04ae93b28d6f5041ac7739e2b085d6f31c94a0e75b28cd3f6109e4b7a2d5 |
|---|---|
| SHA-1 | b2e7419c05da8f3e61c4079b2ad85f3061ce9a44 |
| MD5 | 31c9a7e04fd2b86530ae19c7d4f0b285 |
| TLSH | T1A237C90D5E4B16F802C39A7E1D6084BC35F7A2E90D14C6B839E5072A4FD16C83B0E29A |
Names
| Submitted as | fabdeploy.exe |
|---|---|
| Original filename | FabDeploy.exe |
| Product name | Fabrikam Deployment Utility |
| Internal name | FabDeploy |
Nearest in your own history
| artifact | tlsh distance | seen |
|---|---|---|
| fabdeploy.exe 2.0.4 | 22 | 2025-11-08 |
| fabcollect.exe 3.0.7 | 118 | 2026-03-18 |
Technical details
| Machine | i386 |
|---|---|
| Subsystem | Windows console |
| Compile timestamp | 2019-03-11T08:47:52Z |
| Sections | 5 |
| Entry point section | .text |
| Overlay | None |
| Base relocations | Stripped |
| ASLR / DEP / CFG | Disabled / Enabled / Disabled |
Sections
| name | characteristics | entropy | note |
|---|---|---|---|
| .text | CNT_CODE, MEM_EXECUTE, MEM_READ | 6.28 | Ordinary compiled code |
| .rdata | CNT_INITIALIZED_DATA, MEM_READ | 4.91 | |
| .data | CNT_INITIALIZED_DATA, MEM_READ, MEM_WRITE | 3.44 | |
| .rsrc | CNT_INITIALIZED_DATA, MEM_READ | 3.97 | Version resource only: no icon, no manifest |
| .bss | CNT_UNINITIALIZED_DATA, MEM_READ, MEM_WRITE | 0.00 |
Imports
| module | functions | note |
|---|---|---|
| KERNEL32.dll | 61 | |
| ADVAPI32.dll | 14 | Registry and service APIs |
| MSVCR120.dll | 22 | Visual C++ 2013 runtime, consistent with the build date |
| SHLWAPI.dll | 6 |
Signature
| Status | Absent |
|---|---|
| Certificate table | Not present in the optional header |
| Subject | None |
| Countersignature | None |
| Consequence | No publisher can be established from the file. Every vendor statement in this report is inference, and is marked as such. |
Enrichment
| source | consulted | result |
|---|---|---|
| Certificate transparency | no | Not applicableNo certificate to look up. |
| Company registration | yes | A company matching the inferred name is registeredCorroborates that the name exists. Does not corroborate that this company built this file, and does not lift identity confidence above estimated. |
| Verified vendor facts | yes | No record |
| Public repository health | no | Not applicableNo public repository, expected for contractor-supplied software. |
| Known-malware hash intelligence | yes | No record for this hashAbsence of a record is not evidence of safety and does not contribute to the verdict. |
| Community threat-intelligence pulses | yes | No pulses reference this artifactNever sufficient on its own: a single uncorroborated feed does not drive a verdict in either direction. |
| Licence resolution | yes | No declared licence to resolve |
| Multi-engine antivirus | no | Not consultedMulti-engine antivirus runs on your own vendor key by design: your quota, your data-sharing terms, not ours. That is a deliberate product decision rather than a limitation. No key is attached to this example, so no engines were consulted and no engine result appears anywhere in this report. |
Compositionnot shipped
CycloneDX 1.5 output for installer-class artifacts is designed, not shipped. Component discovery works today; the signed SBOM document does not exist yet.
1 components identified, 1 with a resolved licence, 0 unresolved. The executables below install alongside the parent product and are governed software in their own right: an approval of the parent does not cover them.
| component | version | publisher | licence | role |
|---|---|---|---|---|
| Visual C++ 2013 runtime | 12.0.40660 | Microsoft Corporation | LicenseRef-Microsoft-CRT | Statically linked runtime |
Forensics2What it touches, and when
Indicators and behaviournot shipped
ATT&CK technique mapping and D3FEND pairing are designed here at a depth the current pipeline does not reach. Observable extraction is real; the mapping from observable to technique is partly manual today.
Observables
| type | value | context |
|---|---|---|
| Path | C:\Fabrikam\build\deploy\Release\FabDeploy.pdb | Debug path left in the binary |
| Registry key | HKLM\SOFTWARE\Fabrikam\Deploy | Referenced in strings |
| UNC path | \\contoso-fs01\deploy$ | Default share in configuration strings |
Techniques
| technique | why it is listed | countermeasure |
|---|---|---|
| T1112Modify Registry | Registry APIs imported and a product key referenced in strings. Expected for a deployment tool, and listed so the capability is on the record. | Registry change monitoring |
| T1105Ingress Tool Transfer | Copies payloads from a file share. This is the tool doing its job; it appears because the capability is indistinguishable from the technique. | File transfer monitoring |
Timelinenot shipped
Reconstructed from artifact timestamps and analysis events. Ordering across sources is best-effort, clock skew between a build host and an analysis host is not resolved.
| when | event | from | confidence |
|---|---|---|---|
| 2019-03-11T08:47:52Z | Artifact compiled | PE compile timestamp, asserted by the file, unverifiable | |
| 2025-11-08T00:00:00Z | Prior version analysed in this tenant | Similarity history | |
| 2026-08-03T04:12:44Z | Submitted by endpoint agent | Agent CON-WKS-4471 | |
| 2026-08-03T04:13:02Z | Analysis completed | Analysis record |
More of this
New posts on what a file tells you before you run it: headers, signatures, manifests, overlays, the fields most inventory never reads. Only when there is something worth the write-up.
We intend to offer a tool that does this across every file on an endpoint. You get one message when you can use it.