Project2FA[.]UWP_1[.]2[.]7[.]0_Store_Installer[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Project2FA.UWP_1.2.7.0_Store_Installer.zip
Size

414.9MB
MD5

876513f7d9e613b30e1f47a3ff26abd9
SHA1

456fa7ddc6216b6336f12c659882736544cf6492
SHA256

1a5cc172540fbd64f369f985b8e9685780e8a7e13fee110cb5bce1b46c903ccc
SHA512

ef7df1baca04496d2cb5263564fa04c025765f5f8b05005fb2886ef173d7d8869a2407df8d9e4131cd810df3ed994fbb97a809e2ead15597d3e0c2116370ad7f
SSDEEP

12582912:LZ2ig0wX+Hbzw7ekHwuczAkjtKEiwxs3X11qmC2ov:Uig0wSe6AkRIF1+2s

Score

1^/10

Malware Config

Signatures

Files

Project2FA.UWP_1.2.7.0_Store_Installer.zip
.zip
Add-AppDevPackage.ps1
.ps1
Add-AppDevPackage.resources/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/cs-CZ/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/de-DE/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/en-US/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/es-ES/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/fr-FR/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/it-IT/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/ja-JP/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/ko-KR/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/pl-PL/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/pt-BR/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/ru-RU/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/tr-TR/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/zh-CN/Add-AppDevPackage.psd1
Add-AppDevPackage.resources/zh-TW/Add-AppDevPackage.psd1
Dependencies/Win32/Microsoft.UI.Xaml.2.8.appx
.appx
Dependencies/arm/Microsoft.NET.Native.Framework.2.2.appx
.appx
Dependencies/arm/Microsoft.NET.Native.Runtime.2.2.appx
.appx
Dependencies/arm/Microsoft.Services.Store.Engagement.ARM.10.0.appx
.appx
Dependencies/arm/Microsoft.UI.Xaml.2.8.appx
.appx
Dependencies/arm/Microsoft.VCLibs.ARM.14.00.Desktop.appx
.appx
Dependencies/arm/Microsoft.VCLibs.ARM.14.00.appx
.appx
Dependencies/arm64/Microsoft.NET.Native.Framework.2.2.appx
.appx
Dependencies/arm64/Microsoft.NET.Native.Runtime.2.2.appx
.appx
Dependencies/arm64/Microsoft.Services.Store.Engagement.ARM64.10.0.appx
.appx
Dependencies/arm64/Microsoft.UI.Xaml.2.8.appx
.appx
Dependencies/arm64/Microsoft.VCLibs.ARM64.14.00.Desktop.appx
.appx
Dependencies/arm64/Microsoft.VCLibs.ARM64.14.00.appx
.appx
Dependencies/x64/Microsoft.NET.Native.Framework.2.2.appx
.appx
Dependencies/x64/Microsoft.NET.Native.Runtime.2.2.appx
.appx
Dependencies/x64/Microsoft.Services.Store.Engagement.x64.10.0.appx
.appx
Dependencies/x64/Microsoft.UI.Xaml.2.8.appx
.appx
Dependencies/x64/Microsoft.VCLibs.x64.14.00.Desktop.appx
.appx
Dependencies/x64/Microsoft.VCLibs.x64.14.00.appx
.appx
Dependencies/x86/Microsoft.NET.Native.Framework.2.2.appx
.appx
Dependencies/x86/Microsoft.NET.Native.Runtime.2.2.appx
.appx
Dependencies/x86/Microsoft.Services.Store.Engagement.x86.10.0.appx
.appx
Dependencies/x86/Microsoft.UI.Xaml.2.8.appx
.appx
Dependencies/x86/Microsoft.VCLibs.x86.14.00.Desktop.appx
.appx
Dependencies/x86/Microsoft.VCLibs.x86.14.00.appx
.appx
Install.ps1
.ps1
Project2FA.UWP_1.2.7.0_ARM.appxsym
.zip
Project2FA.UWP.pdb
Project2FA.UWP_1.2.7.0_ARM64.appxsym
.zip
Project2FA.UWP.pdb
Project2FA.UWP_1.2.7.0_x64.appxsym
.zip
Project2FA.UWP.pdb
Project2FA.UWP_1.2.7.0_x86.appxsym
.zip
Project2FA.UWP.pdb
Project2FA.UWP_1.2.7.0_x86_x64_arm_arm64.cer
Project2FA.UWP_1.2.7.0_x86_x64_arm_arm64.msixbundle
.zip
AppxBlockMap.xml
.xml
AppxMetadata/AppxBundleManifest.xml
.xml
AppxSignature.p7x
Project2FA.UWP_1.2.7.0_ARM.msix
.appx
Project2FA.UWP_1.2.7.0_ARM64.msix
.appx
Project2FA.UWP_1.2.7.0_language-de.msix
.appx
Project2FA.UWP_1.2.7.0_scale-100.msix
.appx
Project2FA.UWP_1.2.7.0_scale-125.msix
.appx
Project2FA.UWP_1.2.7.0_scale-150.msix
.appx
Project2FA.UWP_1.2.7.0_scale-400.msix
.appx
Project2FA.UWP_1.2.7.0_x64.msix
.appx
Project2FA.UWP_1.2.7.0_x86.msix
.appx
[Content_Types].xml
.xml
TelemetryDependencies/LogSideloadingTelemetry.ps1
.ps1
TelemetryDependencies/Microsoft.Diagnostics.Tracing.EventSource.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:8a:57:ea:89:a3:49:eb:8b:e8:00:00:00:00:00:8a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

07/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:91:8a:98:87:00:68:27:5d:28:3d:64:39:97:0e:2b:8e:3a:8f:cc:e0:34:5e:99:ae:cc:68:41:24:e8:ee:be
Signer

Actual PE Digest

4c:91:8a:98:87:00:68:27:5d:28:3d:64:39:97:0e:2b:8e:3a:8f:cc:e0:34:5e:99:ae:cc:68:41:24:e8:ee:be

Digest Algorithm

sha256

PE Digest Matches

true

e5:7b:6c:2b:0d:0f:9b:05:7f:e4:3d:1a:85:b7:e3:3d:1d:ca:66:b7
Signer

Actual PE Digest

e5:7b:6c:2b:0d:0f:9b:05:7f:e4:3d:1a:85:b7:e3:3d:1d:ca:66:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TelemetryDependencies/Microsoft.VisualStudio.RemoteControl.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:47

Not After

11/05/2023, 20:47

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:6a:6e:bb:80:6f:e2:1d:f0:da:15:61:b8:f3:79:0a:12:bf:f1:05:c1:c3:4d:32:e1:92:09:8a:e8:df:25:b3
Signer

Actual PE Digest

fb:6a:6e:bb:80:6f:e2:1d:f0:da:15:61:b8:f3:79:0a:12:bf:f1:05:c1:c3:4d:32:e1:92:09:8a:e8:df:25:b3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TelemetryDependencies/Microsoft.VisualStudio.Telemetry.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:fe:59:ca:b7:e6:2a:a5:22:c1:00:00:00:00:04:fe
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:11

Not After

31/01/2024, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:00:41:7d:b7:7e:e6:55:f8:36:63:67:38:f1:1d:2a:86:45:58:29:6b:6d:8c:f4:32:51:f4:ca:72:9e:7b:11
Signer

Actual PE Digest

f8:00:41:7d:b7:7e:e6:55:f8:36:63:67:38:f1:1d:2a:86:45:58:29:6b:6d:8c:f4:32:51:f4:ca:72:9e:7b:11

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 959KB - Virtual size: 959KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TelemetryDependencies/Microsoft.VisualStudio.Utilities.Internal.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:47

Not After

11/05/2023, 20:47

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:43:76:3d:6d:0f:8c:e3:b7:1b:66:67:ef:18:4d:86:41:ce:61:ce:93:e8:dc:84:10:2d:4a:9f:ab:b6:14:36
Signer

Actual PE Digest

03:43:76:3d:6d:0f:8c:e3:b7:1b:66:67:ef:18:4d:86:41:ce:61:ce:93:e8:dc:84:10:2d:4a:9f:ab:b6:14:36

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TelemetryDependencies/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/01/2021, 00:00

Not After

14/01/2046, 23:59

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Not Before

15/07/2021, 00:00

Not After

14/07/2031, 23:59

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Not Before

13/08/2021, 00:00

Not After

29/10/2024, 23:59

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

Actual PE Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 681KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TelemetryDependencies/System.Runtime.CompilerServices.Unsafe.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/02/2021, 20:09

Not After

10/02/2022, 20:09

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a0:70:99:f3:f5:b7:ef:fb:27:e6:01:6f:08:b5:3a:37:53:0b:75:67:14:d0:60:c5:7a:94:ea:2c:97:22:88:f7
Signer

Actual PE Digest

a0:70:99:f3:f5:b7:ef:fb:27:e6:01:6f:08:b5:3a:37:53:0b:75:67:14:d0:60:c5:7a:94:ea:2c:97:22:88:f7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:8a:57:ea:89:a3:49:eb:8b:e8:00:00:00:00:00:8aCertificate

Extended Key Usages

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0aCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

4c:91:8a:98:87:00:68:27:5d:28:3d:64:39:97:0e:2b:8e:3a:8f:cc:e0:34:5e:99:ae:cc:68:41:24:e8:ee:beSigner

e5:7b:6c:2b:0d:0f:9b:05:7f:e4:3d:1a:85:b7:e3:3d:1d:ca:66:b7Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 148KB - Virtual size: 147KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

fb:6a:6e:bb:80:6f:e2:1d:f0:da:15:61:b8:f3:79:0a:12:bf:f1:05:c1:c3:4d:32:e1:92:09:8a:e8:df:25:b3Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 32KB - Virtual size: 32KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:fe:59:ca:b7:e6:2a:a5:22:c1:00:00:00:00:04:feCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

f8:00:41:7d:b7:7e:e6:55:f8:36:63:67:38:f1:1d:2a:86:45:58:29:6b:6d:8c:f4:32:51:f4:ca:72:9e:7b:11Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 959KB - Virtual size: 959KB

.rsrc Size: 72KB - Virtual size: 71KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

03:43:76:3d:6d:0f:8c:e3:b7:1b:66:67:ef:18:4d:86:41:ce:61:ce:93:e8:dc:84:10:2d:4a:9f:ab:b6:14:36Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 28KB - Virtual size: 27KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

33:00:00:00:8a:57:ea:89:a3:49:eb:8b:e8:00:00:00:00:00:8a
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

4c:91:8a:98:87:00:68:27:5d:28:3d:64:39:97:0e:2b:8e:3a:8f:cc:e0:34:5e:99:ae:cc:68:41:24:e8:ee:be
Signer

e5:7b:6c:2b:0d:0f:9b:05:7f:e4:3d:1a:85:b7:e3:3d:1d:ca:66:b7
Signer

.text
Size: 148KB - Virtual size: 147KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

fb:6a:6e:bb:80:6f:e2:1d:f0:da:15:61:b8:f3:79:0a:12:bf:f1:05:c1:c3:4d:32:e1:92:09:8a:e8:df:25:b3
Signer

.text
Size: 32KB - Virtual size: 32KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:04:fe:59:ca:b7:e6:2a:a5:22:c1:00:00:00:00:04:fe
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

f8:00:41:7d:b7:7e:e6:55:f8:36:63:67:38:f1:1d:2a:86:45:58:29:6b:6d:8c:f4:32:51:f4:ca:72:9e:7b:11
Signer

.text
Size: 959KB - Virtual size: 959KB

.rsrc
Size: 72KB - Virtual size: 71KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

03:43:76:3d:6d:0f:8c:e3:b7:1b:66:67:ef:18:4d:86:41:ce:61:ce:93:e8:dc:84:10:2d:4a:9f:ab:b6:14:36
Signer

.text
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 12B

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Certificate

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Certificate

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Signer

.text
Size: 681KB - Virtual size: 680KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

a0:70:99:f3:f5:b7:ef:fb:27:e6:01:6f:08:b5:3a:37:53:0b:75:67:14:d0:60:c5:7a:94:ea:2c:97:22:88:f7
Signer

.text
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B