C:\Users\lwrogers\source\repos\Clear Geoprocessing History 3.0\obj\Release\net6.0-windows\ClearGeoprocessingHistory.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Install/ClearGeoprocessingHistory.dll
Resource
win11-20231222-en
General
-
Target
ClearGeoprocessingHistory3.esriAddinX
-
Size
34KB
-
MD5
c19a3d0fa8a2be4186f3e7a6604fc2f3
-
SHA1
955d709dc75341f7feeda590321478e20e53a6c4
-
SHA256
22ce8911f047d800e6f2f9b05aa466d0f3f5ed9302ae9683fa11216321bf1f94
-
SHA512
f5e2dcd5bbde97bd7597011c962e498e8267e321f6bfbf87e28e26eb49f10f46b4fb1631faea5131ff34060342429f5de723a2a0f87adc87246d58c9d96bb024
-
SSDEEP
768:4QQlIei9jQe7y/ap1A+j4ZdLGCGjUpbV9V/q+1zfPTuV4:mRUpe/avAE4ZFGhmV9Vy+1bSV4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Install/ClearGeoprocessingHistory.dll
Files
-
ClearGeoprocessingHistory3.esriAddinX.zip
-
Config.daml
-
DarkImages/AddInDesktop16.png.png
-
DarkImages/AddInDesktop32.png.png
-
DarkImages/ClearLineage16.png.png
-
DarkImages/ClearLineage32.png.png
-
Images/AddInDesktop16.png.png
-
Images/AddInDesktop32.png.png
-
Images/ClearLineage16.png.png
-
Images/ClearLineage32.png.png
-
Install/ClearGeoprocessingHistory.deps.json
-
Install/ClearGeoprocessingHistory.dll.dll windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Install/ClearGeoprocessingHistory.pdb
-
[Content_Types].xml
-
_rels/.rels
-
package/services/digital-signature/_rels/origin.psdsor.rels
-
package/services/digital-signature/certificate/6144AEE9F1164DC88D322B5A4CEC3661.cer
-
package/services/digital-signature/xml-signature/5bce9c22b7c64aef9d44774655327e94.psdsxs
-
package/services/digital-signature/xml-signature/_rels/5bce9c22b7c64aef9d44774655327e94.psdsxs.rels