GraveYard.Client.rar
- SHA256 c597e0fc16402b1e4d03969819fa2c30ecc1e9969da2f688251a7d32f9214e77
Resubmissions
11/11/2023, 23:21
231111-3bzwjscf8323/10/2023, 06:49
231023-hlwawsgf5223/10/2023, 06:44
231023-hhztxagf431023/10/2023, 01:43
231023-b4865sde8y1023/10/2023, 01:37
231023-b2a7bsde8t1023/10/2023, 00:24
231023-ap5pqsdd611023/10/2023, 00:16
231023-akm9wsdd5y1023/10/2023, 00:09
231023-affdgsdd5s1023/10/2023, 00:08
231023-afbqasfc4723/10/2023, 00:04
231023-acqp2sdd3x10General
- Target GraveYard.Client.rar
- Size 77.3MB
- Sample231111-3bzwjscf83
- SHA256 c597e0fc16402b1e4d03969819fa2c30ecc1e9969da2f688251a7d32f9214e77
- MD5 9ad2319d4791e0227c28c4f9be334051
- SHA1 26f8bb5969cb3c423a00453f16d9cb74e96fe465
- SHA512 1c6667def2d91e529a8317a13bb723c8ce28f9498bb7f2b076ffc0461f7198711da2c0a0921abe7449a2c8af2820e4ac0bc2c5e57507edbe5c37dba11a10bf6f
- SSDEEP 1572864:K5wXvgYqXEOqQyXrR9LPNaITvXzW64VLVyGtWk6+ZaXo9JF:NYYGEBtPlLXkhyGtz6+449b
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
quasar
Attributes
-
reconnect_delay
5000
Signatures
- Detect Pysilon 1 IoCs
resource yara_rule static1/unpack002/source_prepared.pyc pysilon - Pysilon family
- Quasar family
- Quasar payload 1 IoCs
resource yara_rule static1/unpack001/GraveYard.Client/mods/configs/client.bin family_quasar - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/GraveYard.Client/black star ID.exe pyinstaller - Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/GraveYard.Client/black star ID.exe unpack001/GraveYard.Client/mods/configs/Gma.System.MouseKeyHook.dll unpack001/GraveYard.Client/mods/configs/Mono.Cecil.Mdb.dll unpack001/GraveYard.Client/mods/configs/Mono.Cecil.Pdb.dll unpack001/GraveYard.Client/mods/configs/Mono.Cecil.Rocks.dll unpack001/GraveYard.Client/mods/configs/Mono.Cecil.dll unpack001/GraveYard.Client/mods/configs/Open.Nat.dll unpack001/GraveYard.Client/mods/configs/client.bin unpack001/GraveYard.Client/mods/configs/protobuf-net.dll
File Explorer
-
GraveYard.Client.rar.rar 77.3MB
-
GraveYard.Client/BlackStarClent.dll703KB
-
GraveYard.Client/EAC bypass.dll351KB
-
GraveYard.Client/black star ID.exe.exe 76.0MB
-
discord_token_grabber.pyc17KB
-
get_cookies.pyc10KB
-
misc.pyc5KB
-
passwords_grabber.pyc8KB
-
source_prepared.pyc103KB
-
GraveYard.Client/mods/clientopener.dll2.1MB
-
GraveYard.Client/mods/configs/BouncyCastle.Crypto.dll.dll 3.2MB
-
GraveYard.Client/mods/configs/Gma.System.MouseKeyHook.dll.dll 56KB
-
GraveYard.Client/mods/configs/LICENSE1KB
-
GraveYard.Client/mods/configs/Mono.Cecil.Mdb.dll.dll 42KB
-
GraveYard.Client/mods/configs/Mono.Cecil.Pdb.dll.dll 87KB
-
GraveYard.Client/mods/configs/Mono.Cecil.Rocks.dll.dll 27KB
-
GraveYard.Client/mods/configs/Mono.Cecil.dll.dll 350KB
-
GraveYard.Client/mods/configs/Open.Nat.dll.dll 68KB
-
GraveYard.Client/mods/configs/client.bin.exe 3.1MB
-
GraveYard.Client/mods/configs/protobuf-net.dll.dll 282KB
-
GraveYard.Client/mods/flyapi.config345KB
GraveYard.Client/BlackStarClent.dll
- SHA256 a19e9b1d78ffe0dc3631d9908f679b7b7ba5b3cb387fc58eca89635b8a824406
- MD5 146525e45ab0ddfb7d1c3f188a416d51
- SHA1 fccf4a0268389a2130d4f75255c1dfc1e9c3d8ff
- SHA512 a0ca02959dd0875e96ee36c7b0781e77ed23109c736393b47f511e1393adc81b2151572817fff8488fae728e7ea6742c7beec9f9b1acfb94ac06b1c9a7daa1d5
- SSDEEP 12288:Qz8D48I6yoN/M5sxq12Ja3qgwbgVD12JbEp9E3Y4rZaiXp22b/+z8D48I6yoN/MK:Qz96yoCMbgVDwQ94H9wI2z96yoCMbgVO
- MD5 SHA1 SHA512 SSDEEP
GraveYard.Client/EAC bypass.dll
- SHA256 10e918d5632687f53f3c5453b20e5f5d44ecbe63ce9e24fabcc8b52958686b6e
- MD5 17bb2484cca45d120bf88eee66007ed5
- SHA1 fb07ad78266695bd79848fdc8a026fa304a77856
- SHA512 d279c0988f2750db856cfce0123224966fe7ed282df763665df0c4e3bff69223a240bcb81b18e4f3584dfd86297160137638c06cc813007b529cdcc871567135
- SSDEEP 6144:Qz8DHYy6k5niEa4XjykngwehiM5sxq12J2mcji6pAnLg78bxbO9XD125LbPsRz9w:Qz8D48I6yoN/M5sxq12Ja3qgwbgVD12R
- MD5 SHA1 SHA512 SSDEEP
GraveYard.Client/black star ID.exe
- IMPHASH 20d446c1cb128febd23deb17efb67cf6
- SHA256 dd31a2ca64a71f34d9b6efc2e615a962613ea6963f649cfe39c04525ea10b031
- MD5 cb0dbe44a1e4fbd67449e65073ba7029
- SHA1 72c9a74e3c3a472f2caff8cfae9a32124ffafc77
- SHA512 a6f79be16b835051c1cac5272aa2fad1bb6fb264ea377176c84d1bd4835885ef1e9d8ab126fe101c0e3ca3af35d11b58465480a69f6f777fa6b1ffcafed5379b
- SSDEEP 1572864:q2MOiJWPQYHgSk8IpG7V+VPhqaNE7D5RHpPWlXxTa9k4VTWaaN4B6QYq8:qZOpxASkB05awae/Je3Ty9VTRaN4YQYq
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
49664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetOEMCP
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetEndOfFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=187, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=31935,
count=40, id=261, version=31935,
count=17, id=260, version=31935,
count=9, id=259, version=31935,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32217,
count=1, id=258, version=32217,
discord_token_grabber.pyc
- SHA256 8ae6baddc552f9a47c488760a3d3b04f217f7c999dbffc1a548bb09532e6bf77
- MD5 e523026b612006e580e96bd9e2a8882c
- SHA1 03b9938701f7eff11a0c3632ed805e8188598c88
- SHA512 a0f15f5edecbab4894aa3b85092fc2bde34b76f6048b198ce387d59a56d6c74969201cc43d19cd27a9ff0a6ab72268884a90ef206f0be34a5707a7f6ea24a853
- SSDEEP 384:cGllyAavwS9F0RW807PPQviowoYbCj+Mo8WWIc02a8:cIlytvX9iRW8inQ6owoYOyM0d2a8
- MD5 SHA1 SHA512 SSDEEP
get_cookies.pyc
- SHA256 85a7c34afad2c270ca690a5b4c30cc8bf16967e623fc77f4de4497901030a93b
- MD5 b38f506528b3d6d5dbd851426c347b95
- SHA1 e91bf4ef42128267934e21be0176e552480f5977
- SHA512 ab110dc92eba564fd0ec6c6a75e779f588518dc1aa461f072ab02b96bc11fbe25e09faa6a556dc6a127c3e8826382697b72037a0cefbdaf32fd70a723e746295
- SSDEEP 192:TzOCIeinQfUF9LdwOEVOFc1mNe47+o+zEzzzzz1zz+HoowAE:TzOUiQccEe4KoOIAE
- MD5 SHA1 SHA512 SSDEEP
misc.pyc
- SHA256 b522284f1a7e518c269c0414160407ec7834a4397f85ef389433b49367b5df9c
- MD5 31aa260c6cdeaa9d942cd0dcfcadd16a
- SHA1 a6818f3acf5c2ab9d65b41a81cb92b36b85cc932
- SHA512 0dd277ef948315a3554bd8c5110e27afa9b2eac88defc1211771c050cdd27b3668484dec35ec5c5010bff00b62c2cebd9e7286c0b114ad28437719b42bd0fc2c
- SSDEEP 96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0nIAEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0nIAZeQ
- MD5 SHA1 SHA512 SSDEEP
passwords_grabber.pyc
- SHA256 ea26e61dc4ebafcb02301290a96e6fb91ea4df1c111eb6a85f156d95c3c5d8c1
- MD5 83598b70aceb59c6110ac775b51d5b64
- SHA1 2838321de9ef685a66af1157ef18d2ac4d9c06ab
- SHA512 c8805e7f8a4c4635b44b7611f559de53e8d90c4411631a69dcb9453e7dad13e114efa57793848717da9f410c06d194210406681a52925a0d1dec5f326f61dfd5
- SSDEEP 192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxrvP9VRvM:Y4EAL/AfRBO8NsxuOxZw
- MD5 SHA1 SHA512 SSDEEP
source_prepared.pyc
- SHA256 6fe0697f9d958b3d289e16dab5b57115739888d2d29a0cb39cf5e8b01cd21716
- MD5 4f1036f2ebff5776676b88d4e34c8770
- SHA1 6012f116b433f31a05c511e4fab9afe553868d1f
- SHA512 44bcce9e00f2bd18889a579a808c586070e83c4e4d222dbc2234819a26d8960558e943f8b4d7b421e46850fd4fe2a70ad74785c4e30f2b832e44ef010d4b8e19
- SSDEEP 1536:ULadgbKGKOQ0ydBBqQocsPECAteBaHwV5M6dvX6iI:ULaq2GXQRho5PEtesHOX/6iI
- MD5 SHA1 SHA512 SSDEEP
-
Detect Pysilon
GraveYard.Client/mods/clientopener.dll
- SHA256 2cebbf7a0dca24fb9aafca795c30bd5f1a9da3ceb8a46be1cbe6aba75fdf72de
- MD5 9ba80d87abfa3d6260bc4c32f4f72820
- SHA1 acfabe3f8091a2838170e5977cbfc05ee980b18e
- SHA512 07833cac94e2615d72c9dd767faddf312f828804da2541dc02b982737e7207b230103a584816ddd15ae9360a8e99721d6eae2fd8f08d926ea76ce8b62708185d
- SSDEEP 49152:Qz96yYbUwXMz96yYbUwXMz96yYbUwXMz96yYbUwXMz96yYbUwXMz96yYbUwX7:QB6RUwXMB6RUwXMB6RUwXMB6RUwXMB6V
- MD5 SHA1 SHA512 SSDEEP
GraveYard.Client/mods/configs/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
- MD5 0cf454b6ed4d9e46bc40306421e4b800
- SHA1 9611aa929d35cbd86b87e40b628f60d5177d2411
- SHA512 85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
- SSDEEP 49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
- MD5 SHA1 SHA512 SSDEEP
Digest
f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 19, 2021
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 18, 2020 - Mar 23, 2023
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
3221146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/configs/Gma.System.MouseKeyHook.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a67a424013544c8270c12633e2e1e287cd5cf0b3f2e81e8d8204b37a03da59ef
- MD5 bfb3bd1cb571360435100bfa6ed2b997
- SHA1 1325e8dd76180a165117e04da4ee4a020e996880
- SHA512 ae5a88a9e86b9e64b8c289213f814586dfa5fe5e0cc21bdbc3e48c36d81fa9e763c6e78f24e40df07696228270ad72f408846125e61e33cae867ef8ff88a3c15
- SSDEEP 768:qYnDJGdu2oE3d7ltSl+Y8sCcm8Doi/L0CPw87qquEZ+r3FhuiFJ8G:VncoU48/AzPwYpNZ6rXJ8G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/configs/LICENSE
- SHA256 49a25b5003ae74dc02141ba8cd29e1515baf4a2bf8d783019cc2148e07688b9b
- MD5 2656bf9fcaf47fa043715bbd3b2f5134
- SHA1 5832164b16008d7396501f857f9f5f8799fd179c
- SHA512 4d8ca0fc4a8aca853925df5d93eeed1e7c232e1e3816fe096cf153bc6ff802258b7d7c58cbaab4817c3eb4acc7f888b0c622400783fdd3140c7fd954a40c095d
- MD5 SHA1 SHA512
GraveYard.Client/mods/configs/Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
- MD5 1c6aca0f1b1fa1661fc1e43c79334f7c
- SHA1 ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
- SHA512 1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
- SSDEEP 768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/configs/Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
- MD5 6d5eb860c2be5dbeb470e7d3f3e7dda4
- SHA1 80c76660b87c52127b1a7da48e27700f75362041
- SHA512 64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5
- SSDEEP 1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/configs/Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
- MD5 6e7f0f4fff6c49e3f66127c23b7f1a53
- SHA1 14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
- SHA512 0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
- SSDEEP 384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/configs/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
- MD5 de69bb29d6a9dfb615a90df3580d63b1
- SHA1 74446b4dcc146ce61e5216bf7efac186adf7849b
- SHA512 6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
- SSDEEP 6144:jIevdbLPNYe8bikm98KXPHhOWY/fFREomhUFD3z:se1PNL+QRfBg/f/EWFD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
362022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
348KB
Virtual Size
347KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/configs/Open.Nat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5
- MD5 cc6f6503d29a99f37b73bfd881de8ae0
- SHA1 92d3334898dbb718408f1f134fe2914ef666ce46
- SHA512 7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f
- SSDEEP 768:sF6vHHLFkywkNh5qtHMjkCifoydVXw5FxusiolecziijiSvD+ZGFa4Pw6OdrGHUm:8GmyJNh0tbt3MLQ9W2rG0Ydd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
75530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/configs/client.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e
- MD5 f4d16cfe4cad388255e43f258329f805
- SHA1 fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d
- SHA512 867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f
- SSDEEP 49152:4nb7+y2FqZaVmN+PqlhU/mevlL1nYtsCeAcxUuxG2THHB72eh2NT:4nf+y2FqZaVmN+PqlhU//vlL1Yts3Bx
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3294222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/configs/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6
- MD5 abc82ae4f579a0bbfa2a93db1486eb38
- SHA1 faa645b92e3de7037c23e99dd2101ef3da5756e5
- SHA512 e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3
- SSDEEP 3072:yRAISQ1tRSVB3zpKTEPn6Rc0qus/6GMzzeSXLifsE2s58IB7aoqng5YnDBzs39AH:yRFD1niy6n6KwhO5mIYpnNzgGD0u
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
294506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
GraveYard.Client/mods/flyapi.config
- SHA256 f63945849597563bbeb35c7b3e6c402927d1092e526bdce139e3cc125a1be91b
- MD5 d021c745debf9c4dde7548a2889e65c6
- SHA1 017968efd67b7b635be0ffe8fd04bb05821f18f3
- SHA512 8e40e860aa052cba140c590711eb031a5a671caf7ca6f4fc1363a905d0ebf3c27e35403aafef0d5ba5268ff241ab32fc3966fd61e15a53d97ad48e2fc2fd4969
- SSDEEP 6144:Qz8DHYy6k5niEa4XjykngwehiM5sxq12J2mcji6pAnLg78bxbO9XD125LbPsRz9m:Qz8D48I6yoN/M5sxq12Ja3qgwbgVD12X
- MD5 SHA1 SHA512 SSDEEP