Silver Rat.zip
- SHA256 954f637d4c8d2c47dc648d703f073fa8586222a8cef8aa8226bce48490ce8b10
Overview
overview
7Static
static
7Silver Rat...ng.dll
windows11-21h2-x64
1Silver Rat/Loader.exe
windows11-21h2-x64
7Silver Rat...on.dll
windows11-21h2-x64
1Silver Rat...ra.dll
windows11-21h2-x64
1Silver Rat...at.dll
windows11-21h2-x64
1Silver Rat...ps.dll
windows11-21h2-x64
1Silver Rat...er.dll
windows11-21h2-x64
1Silver Rat...DP.dll
windows11-21h2-x64
1Silver Rat...NC.dll
windows11-21h2-x64
1Silver Rat...er.dll
windows11-21h2-x64
1Silver Rat...er.dll
windows11-21h2-x64
1Silver Rat...ns.dll
windows11-21h2-x64
1Silver Rat...rm.dll
windows11-21h2-x64
1Silver Rat...ds.dll
windows11-21h2-x64
1Silver Rat...PP.dll
windows11-21h2-x64
1Silver Rat...DP.dll
windows11-21h2-x64
1Silver Rat...om.dll
windows11-21h2-x64
1Silver Rat...xy.dll
windows11-21h2-x64
1Silver Rat...ET.dll
windows11-21h2-x64
1Silver Rat...rp.dll
windows11-21h2-x64
1Silver Rat...at.exe
windows11-21h2-x64
7Silver Rat...rs.dll
windows11-21h2-x64
1Silver Rat...le.dll
windows11-21h2-x64
1Silver Rat...ry.dll
windows11-21h2-x64
1Silver Rat...rs.dll
windows11-21h2-x64
1Silver Rat...to.dll
windows11-21h2-x64
1Silver Rat....3.dll
windows11-21h2-x64
1Silver Rat...ms.dll
windows11-21h2-x64
1Silver Rat/cgeoip.dll
windows11-21h2-x64
1Silver Rat...i2.dll
windows11-21h2-x64
1Silver Rat...re.dll
windows11-21h2-x64
1Silver Rat...et.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
Silver Rat/Bunifu.Licensing.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Silver Rat/Loader.exe
Resource
win11-20240412-en
windows11-21h2-x64
11 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Silver Rat/Newtonsoft.Json.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral4
Sample
Silver Rat/Plugins/Camera.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral5
Sample
Silver Rat/Plugins/Chat.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral6
Sample
Silver Rat/Plugins/HApps.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral7
Sample
Silver Rat/Plugins/HBrowser.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral8
Sample
Silver Rat/Plugins/HRDP.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral9
Sample
Silver Rat/Plugins/HVNC.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral10
Sample
Silver Rat/Plugins/Keylogger.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral11
Sample
Silver Rat/Plugins/Manager.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral12
Sample
Silver Rat/Plugins/Options.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral13
Sample
Silver Rat/Plugins/OptionsForm.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral14
Sample
Silver Rat/Plugins/Passwords.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral15
Sample
Silver Rat/Plugins/RAPP.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral16
Sample
Silver Rat/Plugins/RDP.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral17
Sample
Silver Rat/Plugins/Ransom.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral18
Sample
Silver Rat/Plugins/ReverseProxy.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral19
Sample
Silver Rat/Plugins/ScanNET.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral20
Sample
Silver Rat/RestSharp.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral21
Sample
Silver Rat/SilverRat.exe
Resource
win11-20240412-en
windows11-21h2-x64
4 signatures
1800 seconds
Behavioral task
behavioral22
Sample
Silver Rat/System.Buffers.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral23
Sample
Silver Rat/System.Collections.Immutable.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral24
Sample
Silver Rat/System.Memory.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral25
Sample
Silver Rat/System.Numerics.Vectors.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral26
Sample
Silver Rat/bouncycastle.crypto.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral27
Sample
Silver Rat/bunifu.ui.winforms.1.5.3.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral28
Sample
Silver Rat/bunifu.ui.winforms.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral29
Sample
Silver Rat/cgeoip.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral30
Sample
Silver Rat/guna.ui2.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral31
Sample
Silver Rat/protobuf-net.core.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral32
Sample
Silver Rat/protobuf-net.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
1800 seconds
General
- Target Silver Rat.zip
- Size 19.6MB
- Sample240413-chtp1aab79
- SHA256 954f637d4c8d2c47dc648d703f073fa8586222a8cef8aa8226bce48490ce8b10
- MD5 f67750ed58c00406f728287640231c3c
- SHA1 e89408beaf5af22b470ad6c33fbeb63b57095ff3
- SHA512 9820e79cc0ecef5a250771ae7250aeb51e1370976c482c7d3847f517b0d109ac075b0bcea1cdb47736c923be10ded43af66c7996fe4999c25826980af2110b0b
- SSDEEP 393216:piz4ay92E7wdPIpsbGMoTnhqfglsXczA0nkgNdLHw:po3AsXbNoFIpc02kKQ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Silver Rat/Bunifu.Licensing.dll agile_net static1/unpack001/Silver Rat/bunifu.ui.winforms.1.5.3.dll agile_net - Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/Silver Rat/Loader.exe unpack001/Silver Rat/RestSharp.dll unpack001/Silver Rat/SilverRat.exe unpack001/Silver Rat/bouncycastle.crypto.dll unpack001/Silver Rat/bunifu.ui.winforms.dll unpack001/Silver Rat/cgeoip.dll unpack001/Silver Rat/protobuf-net.core.dll unpack001/Silver Rat/protobuf-net.dll
File Explorer
-
Silver Rat.zip.zip 19.6MB
-
Silver Rat/Bunifu.Licensing.dll.dll 1.3MB
-
Silver Rat/Loader.exe.exe 490KB
-
Silver Rat/Newtonsoft.Json.dll.dll 659KB
-
Silver Rat/Plugins/Camera.dll52KB
-
Silver Rat/Plugins/Chat.dll36KB
-
Silver Rat/Plugins/HApps.dll30KB
-
Silver Rat/Plugins/HBrowser.dll22KB
-
Silver Rat/Plugins/HRDP.dll16KB
-
Silver Rat/Plugins/HVNC.dll31KB
-
Silver Rat/Plugins/Keylogger.dll13KB
-
Silver Rat/Plugins/Manager.dll126KB
-
Silver Rat/Plugins/Options.dll45KB
-
Silver Rat/Plugins/OptionsForm.dll28KB
-
Silver Rat/Plugins/OptionsForm.dll.config122B
-
Silver Rat/Plugins/Passwords.dll63KB
-
Silver Rat/Plugins/RAPP.dll18KB
-
Silver Rat/Plugins/RDP.dll17KB
-
Silver Rat/Plugins/Ransom.dll14KB
-
Silver Rat/Plugins/ReverseProxy.dll12KB
-
Silver Rat/Plugins/ScanNET.dll438KB
-
Silver Rat/Profiles/Builder.xml1KB
-
Silver Rat/Profiles/SocketPort.xml57B
-
Silver Rat/RestSharp.dll.dll 166KB
-
Silver Rat/SilverRat.exe.exe 25.7MB
-
Silver Rat/SilverRat.exe.config.xml 526B
-
Silver Rat/System.Buffers.dll.dll 20KB
-
Silver Rat/System.Collections.Immutable.dll.dll 175KB
-
Silver Rat/System.Memory.dll.dll 138KB
-
Silver Rat/System.Numerics.Vectors.dll.dll 113KB
-
Silver Rat/bouncycastle.crypto.dll.dll 2.5MB
-
Silver Rat/bunifu.ui.winforms.1.5.3.dll.dll 297KB
-
Silver Rat/bunifu.ui.winforms.dll.dll 1.3MB
-
Silver Rat/cgeoip.dll.dll 2.3MB
-
Silver Rat/guna.ui2.dll.dll 1.4MB
-
Silver Rat/protobuf-net.core.dll.dll 263KB
-
Silver Rat/protobuf-net.dll.dll 251KB
-
Silver Rat/stub.cs.js 84KB
Silver Rat/Bunifu.Licensing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 661a5be944dc9fb2e0eba01c3c0584feb3ecca44877d77f54d0f409ce801af22
- MD5 c18a9e44e200c7315a1868caab894293
- SHA1 18f65508762d2492f41b22e4e6e5ad19a2226baa
- SHA512 9a5e08bb6ed4535ac92ca446b630b29587cb5a4d7d695234a5d93267d2ac13d702b3738ba0e20606f10020e9642e8e315e7ddc92f1c321b68daf8524a3f5f2d1
- SSDEEP 24576:d2zl/P3R5+dsFXDbzFWIq7GVuU9QS3AJYeyA1xJj4WIbDIHIr:d2ztPhM+XZWrqQAw61bHr
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Digest
ec:b2:77:c2:12:4e:91:29:6f:54:9a:e7:fb:15:1a:ca:da:79:ed:09
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Chains
Mar 3, 2022
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Serial Number
5c:a8:2f:f3:e2:49:8f:60:ba:9b:0f:ad:f3:bc:d4:87
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 31, 2021 - Mar 31, 2022
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 19, 2010 - Jan 18, 2038
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Minor OS version
0
Major OS version
4
Entry point
1345354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\wilsk\source\repos\apps\desktop\bunifu\work\bunifu-framework\Licensing\Bunifu.Licensing.Redistributable\bin\Debug\net40\Secured\net40\Bunifu.Licensing.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/Loader.exe
- SHA256 f5f14b9073f86da926a8ed319b3289b893442414d1511e45177f6915fb4e5478
- MD5 9c9245810bad661af3d6efec543d34fd
- SHA1 93e4f301156d120a87fe2c4be3aaa28b9dfd1a8d
- SHA512 90d9593595511e722b733a13c53d2e69a1adc9c79b3349350deead2c1cdfed615921fb503597950070e9055f6df74bb64ccd94a60d7716822aa632699c70b767
- SSDEEP 6144:3PkcFUUUQHs5TlOhDuy4VjmSO6/tU4j06xeJyCjvhsXZ4m05d0qCsfBLuWWCV/rr:3McWUUysz/NhKjJPhM4/5bV/rvgE3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
29747
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
145KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
329KB
Virtual Size
328KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.kbvtrz
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
Silver Rat/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
- MD5 4df6c8781e70c3a4912b5be796e6d337
- SHA1 cbc510520fcd85dbc1c82b02e82040702aca9b79
- SHA512 964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c
- SSDEEP 12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn
- MD5 SHA1 SHA512 SSDEEP
Digest
a7:cc:fe:41:40:99:65:07:53:c6:c7:f4:1c:e3:22:5f:f1:9e:7a:db:83:aa:c0:1c:bd:9b:44:a1:54:ff:58:a1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Apr 22, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
672442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
649KB
Virtual Size
649KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/Plugins/Camera.dll
- SHA256 2c82773466f72756d8152e4d5dc24d2ec954bfe5a6e7cae587d2e1d316ef43d0
- MD5 e9e0b5fc7b1ed6f01d08d981d1cd761f
- SHA1 011ac2fa1b9df6a4cb6d88c14316216bb64526bb
- SHA512 df75359dd9c1bcc6bccb17522186d710ae16054a496c3f75fa171dfe8f09e314fb28a7b1111193e64e37639c6d37de5c77cd99d795f72ab5338459886da6b964
- SSDEEP 1536:K74lunLw1ANlGCkO9bTlqpWQq5As9VG3wEiz:K7XXaGHApPq5cAEiz
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/Chat.dll
- SHA256 0c83898f29762a4e3650fc5f5a8a3c3114d06da8f6a3fb2fa8b990a36716d6bd
- MD5 736292dd81ad93bff84c28ce5de02385
- SHA1 40d46e915d049966f023e8d8c1e059d9b6c22567
- SHA512 c126f17b9ed91994d52e61c7ab75536962a2c0f03cf90cba06fa423dd732379e7ccdf4050dada73267864feee8b677bd5c16ead8a485e3d8bd3f4bcc462015ed
- SSDEEP 768:IOgpJ+MbCCj9fGS7C1mf8O1eJU4Fcn6vELlZbS/uG7lknOez1fVQrgYo1:9gpJRH997DfB+U4FK6vEWuml+z1VQrgp
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/HApps.dll
- SHA256 d922c1762640f37a503eb116627a732290ae38b52f9b33437ffee608f7853a28
- MD5 a7c3b329ab9f4e20ed40c78b2ac36864
- SHA1 fcb594e1a2a7c27e0208d413411e1ca30fdf4279
- SHA512 870085fabe2ae4768b6ea9d2e7f13dad752f4c26ec6d61debd0b76c683771823b07338e1323e26c0c8e17f9ecf7f5d7fcd4b7d0b148501ef9e278b8b680925f9
- SSDEEP 768:B+Oy2Qaqmlo69aT1+STn1dtU6l5sOyniwSWAqDIug:B+a1oKYcMnt5TbWJg
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/HBrowser.dll
- SHA256 55b5efe0a09cb5cb79308874e2e5d25c895f995754bbf960ce9a403207ce3abd
- MD5 ce1d9f8c498cd8c5ee38fa94df4b4907
- SHA1 d3b811137776e4b1dc937d294ce0eff9a12594ff
- SHA512 58c9e62bc32376773a9bb1f266aab617ad2098f2d12b13fba1bfcefdf3edd1f44682c791567cc67035550b80b735ae460111145fd1b9d733325cda9dfbe61849
- SSDEEP 384:a1vknrDG5kbu+MyKCduqwYjrVCSvuC+s6ZxMuzB9uzwVkOLyeKKIyYCiJo9BkzH6:CvO+CnMyKirwkuC+s6ZxPzB9nkZM/Bku
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/HRDP.dll
- SHA256 a475f59f6a1b6b1fb4c6e78f1fbe7df2d38c4f743488ba7da128a5771bf6de86
- MD5 b9c9ea357d04731bda8c8393ae5cd741
- SHA1 8d462aafddd5f37513226523dd4b7a354be2f492
- SHA512 1876e27c5d224d4bac403f99bfff21cbdd35e3d4d91257ff7c2482552e9925d85c69eb092e590ca48251e8fbf19372c131d191caa0e2b8977a2ced36173515e2
- SSDEEP 384:KiHITWv10Dlxk/Apew9M7A7VAmp93Yc9d1CThP3kVL:DdmPkYpn7VAmn79dQThP0VL
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/HVNC.dll
- SHA256 44cb17f3b048ba2c7653409b0dec7c94eb86d2cf0322ac79ce6764d5b8df1549
- MD5 3d07031e76978680240e80cc54451ad4
- SHA1 255f32852fa97990ce16c8bdae766c79c7bcfe56
- SHA512 3595793d4b8e197a60d9c28060415489592da44e20e8f999d91e4c2f164e43ee00aaf94216a0daf4ade1cab8577dd34bb8e02c7ba12b3757b2c82c4e4bb91c7a
- SSDEEP 768:hdLQtzcSzlbMwNVCQZ/7zBcdiWhl/6tVSFn4MU1bpN2OCDSjLBydQEw:rL6oSpNVRZ/fBFMSt2fU5/jCDeLodQEw
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/Keylogger.dll
- SHA256 c3fd1d11641109c9033fa20af16c6b737008c137fd8a926bf0b4c6630d8ab9ac
- MD5 8e2d761ccea68168d0b991b475155678
- SHA1 2872d722bdaf496d520e643d114e712199ef00f1
- SHA512 e179a1da9f2d00cd74352dc81305462dc928a6e2acace665d42e8a2d0999bc6c8669e5e290ebd17064c6166604f87de2c7e7f31b42b4ea82b23738792c68f68d
- SSDEEP 384:ilOmhksiBTIy2tyzb9UX1jiXGf+histUnXdRcrTZxx:S29FIr4zBqUGGc2UnNITZxx
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/Manager.dll
- SHA256 da8c5ffb5d268e9aa5783bcb064502df8f78cba724a0f96793795fe97e62a6e1
- MD5 b17ddbfdf27aaedb6e26ed70783a6ae7
- SHA1 08590ed55d9adc47c53a9dcf7dfafc60b877aa13
- SHA512 0079131280257413f43a01a0de2b3cf393745d2864ab521619888b3b25f7f0ec1f32f9d6f682250b73c92c1483d841f7ca3f8bf34e785e3fc93afae6d086693e
- SSDEEP 3072:rgBZ0kM7aryhNEAXTx0XGgrLU2T+2CdjVz+2YLaBb4oPL6:8BaH7aEE2mXbLU2yz5b1G
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/Options.dll
- SHA256 3fd7b67e56b40caf53aa9b2df102967f7e2aab0bb4bf90ea769ea725c0498657
- MD5 ff88d61dc7adc644d79b0f898059a7b1
- SHA1 151557a014d6b177fd1ae1496f0719184df08c86
- SHA512 ae06793d10c6c76a994db8cf3fe97a859df2a1e0dd2bc56fac042bba8a93a56e52b4edf28a30113e4cd547157bde07a77383f0295822d8e6ddea51dfcdc0b1f0
- SSDEEP 768:guYdNeZRx4qeyvSlFSOr4eKzBSea9jxOyVKJiN86ajxYGit6N2iX6/bwN45BVFg6:Xawe0SlFSk4eKzBha+yYiF3CNNX64QS6
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/OptionsForm.dll
- SHA256 b2a0dd7d7b92ec5b99e3b18fb0235b3b039373edf9a4ea51b36447ac7d0ad464
- MD5 fdaa271259f3b58f88bcfce1da990af4
- SHA1 ae2bb4c6725134e9f53f7d63d8920d5c7c4e54de
- SHA512 469507660f15a9b72cf160da089b2b4e44625010ba15cdee3d6e08f467e1d724aa0d177adbd7af926a55b0dddd016d565804ab1b2fb071ee37b48487d553b8d9
- SSDEEP 768:jsyNQnYSA6ncANYj93R++1XZiyTpidYe0Hhhv:1D8Rm3RrXZiyTpiYHv
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/OptionsForm.dll.config
- SHA256 c53f33a5c3a7dfa005f62bc9d81ae8d6e5eb019463bd2986c32ca00ce9404f1a
- MD5 a78fa19b73baa4b9bb1d29d22dfbea83
- SHA1 f4a03e27396eb1a3f3e135dede8cae930f7cc3a5
- SHA512 e6811ba76e7a0284413af12cbe06884fb9e2f94c09bbe42f9adc03cb506cfee7c081e1002a1d59fd6db910ed33f255de9f4c0236759bf8cd39ad8886f22e3e6b
- MD5 SHA1 SHA512
Silver Rat/Plugins/Passwords.dll
- SHA256 31805c53dcd4df47675401e2f286026492a4d2c9ffb13bf5293e8955d5ec96d1
- MD5 67df2a509df555bbbb04264d9177c4c9
- SHA1 4afbe8e70698cc6cc7cb2091c1d7dd8b343e49b6
- SHA512 0b10b268a5590aa4649decda9190df03673f55b09bf66660cab43f76e61cd9afd4e3ff285b6623377f883930f3221933c7abde1b795642ccd909ccb17154712e
- SSDEEP 1536:wCulm7fmXE654s9/i7fiaMLY/u9rU3xgQxR8:/KXE6Wj74L4u9r+E
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/RAPP.dll
- SHA256 2e717bd5321a2ac65b38cc39238dafa7e34b7446031a6a6200aca86199a59ade
- MD5 3749325c46c36e83ea28ddd92aa60c9f
- SHA1 a792b9eb154fcbd376660bca5bb1cac11e29cd17
- SHA512 876013df8c6736ac3bed7e8efb03cc783abe33936c2f8b7908b554b5584c42a8e81f953f7c4066576d8ef931026eb4af84618179cc0001519c493f6651ccd4be
- SSDEEP 384:ac5CxOJrR6SkdyR9DVB8PMhwkQAuWh/Z+tBEsLHhJU1thzssJaBVoS7z+8cbt:acUOR7lRxT9+kQdWh/AtBEaJU1ti6S+t
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/RDP.dll
- SHA256 c5d5123886fc5e948693a2c1cf14b6b1262f2b98b2ccb6ee3b06bab0c32e6c00
- MD5 2bd24da470e3968fec572600d4637f37
- SHA1 752a3ee7e92e6141c26338b327b5a060c0583030
- SHA512 60df75c2362a991ce108ed2b52d47316b56b527eef67700b89a6aa8dc52cb0f223991fe6b9819d4c047c5445051078d55965209bbf8f7c1421fc0dbc12fbc393
- SSDEEP 384:Iy6n5a9cH8dkubDfK+eTpual9QSiSNkQ0KhEjH66U78:h6whHfK1lWzSNZ3hEjan78
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/Ransom.dll
- SHA256 d47f10f19ff148464747bf7e38f7fb44c1d99569d4a9b31eee731abacd540a2f
- MD5 47ced016511c0edca8af7e371ed50136
- SHA1 83306913534c4a2ff234ce1dc399ac017978a476
- SHA512 459333e1c3437b13db1988f901c97f16ab6e99269b3459001e898f661322b4ad034046b29561c0a6b366ff3d2c69a27334d49623744e3ee4f3341789b4bab37a
- SSDEEP 384:mXAJqi0AmyuWlo+Oz+t/7maeJjl4a9Ju4upj4isYZS9TF:m4qi0AoFcmJh4aPNupjXZS9TF
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/ReverseProxy.dll
- SHA256 d5c47e21b22ddd9087ecda3c2bad283de7d3dd69906802f2023f86bbba92f06b
- MD5 015e7bdd40eee884542840f551074710
- SHA1 6d5d38182998f28129ad8f0f5801b89cee4e6498
- SHA512 a199f5be4a0a83a291ee19868428d147783e55c38067d10c0353fdfc363087c23f88b8b2d44d7fbf7b16c03427342d96fc0dcb52b6cb1064dd84d3f0f28d5afe
- SSDEEP 384:asuofwnSWvLO+H7rOo4bY8IiA5TpISmM3:JuykSWORo2Y8rA5TxmM3
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Plugins/ScanNET.dll
- SHA256 389a2431ed1c413afb6c5361dde893cfe4374c56f5121151f91e9ed8723d0967
- MD5 4a66cf2e8575107a677833dcbe7e1142
- SHA1 59dea7c17ca242a5aeb6a5a9353f711bac1e0eeb
- SHA512 005893f2ee4ae6375ab9464c002326f6c07d1a04fad8034adfcd3a9506358fda43ffeec6600acb20fe4bec25765dc4c3046343a1e51cd80a7d7f1164cdd4fa37
- SSDEEP 12288:05joX7j3jnahCS4ENDHg9OiaDrttMVf8cMSuht9U858W7B5ONJsDy1P+PioK+ci:0Rq3EttwC0V3Luht9Ui8W7rmGuixGi
- MD5 SHA1 SHA512 SSDEEP
Silver Rat/Profiles/Builder.xml
- SHA256 b4b7d0f7878a60e5d641443a7d4720e178568e6febbb38a243d3b9fb8a30842b
- MD5 3fcd4ac4720febae7ed0b81913daaf1c
- SHA1 7d2ec4090023cc93a453c65782c78fe9bcf5afbd
- SHA512 c6a5c5c5d17d2e56fd2fde8705062a8916673ec5557ef9f30c9f62c67877c72f5b8e4528a3a8a8ec24f74e5c52ed385442483606b13972bcc645257a5826f2ca
- MD5 SHA1 SHA512
Silver Rat/Profiles/SocketPort.xml
- SHA256 7b87c31f6d1163fc236651f5e1f3187cfa0c79d4a85d20c1c05f1dc3056c4823
- MD5 5f807862258a390b2e2f75abb6d2c865
- SHA1 22abc144aa034c6490cbf143a8f1cdd42bd06d1b
- SHA512 b831e4b2eeec23e39544961cef6619c8d57c50b53dc6bad8846682df6f5252041f50ce33cbe182488288d6d5e2e3e5194055ee4143ceb09f9601ed49d39dba39
- MD5 SHA1 SHA512
Silver Rat/RestSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e7a0f3910741e81f9b4660501b30aab5eee71cfa4fa9dcc9b32acb64c865428
- MD5 09806e18f9f8e3f2351827be22e634e0
- SHA1 54ec870ffb8ce10b3c8b05bbc7fb7ea45142a430
- SHA512 45b5743bd3f50f51b6953bbfca9f8c5d1aca75aaed5cee0d6ef401034a05a09f27b928f539101801450b428ca7eac9ecc3ad0b41f2bc19258da52fbc7dc8ed09
- SSDEEP 3072:JsC2yztWrT99ZTN/ru4Y1Gs1AvVUDOIpjdz4LuYcEFRZ8w/VrvFjsu2i+:JBztWrT99Z5/am4IFsZ4LuVEp8oQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
175886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\personal_source\RestSharp\RestSharp.Net46\obj\ReleaseSigned\RestSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/SilverRat.exe
- SHA256 7fbd062f70148d59c94c603191c5cdb4f62d70f2dfaf1ba519ed1af4a0a05d97
- MD5 f32b6857259b5a94830d087559b5370a
- SHA1 a6f79e840ce7c3ab28428cc18d41e4286899b33b
- SHA512 4289267c9db4aa92d9a95f8fa97760e0e77c387c2b32419656b7b19f92ebb4356679be9cba3b77fe5e0cb64696c598e761c0bdce64a45bf8652824b77e27cb49
- SSDEEP 786432:HZYRGnGvovVvAuuglekvAR4vzHcv6lHGH9KdDmvQuLGgJMKV+n9n1vgvVv2jlv1R:vk79a5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8396
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
770B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
25.7MB
Virtual Size
25.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Silver Rat/SilverRat.exe.config
- SHA256 a47f3f83cdb9816f03632833dc361ac5e7a4c5c923af1fdebfa16303f9d68a72
- MD5 d6f1152d647b57f64494c3e1d32ede94
- SHA1 a35bd77be82c79a034660df07270467ee109f5ac
- SHA512 699b5ad93d3497348f8aad8e15d54ddd789bbac43f11a7fb629f19cda3749bee0ae06dc83f4e6246df631488169fda5d15c48585581d3a96d2523b8b45e639bd
- MD5 SHA1 SHA512
Silver Rat/System.Buffers.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
17218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/System.Collections.Immutable.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 67730917b4e856e37a9d78245527584087fac6b20a7377677b2f444cd15db918
- MD5 8f55c22412f7d448d6e7b83102665368
- SHA1 88df86ee0b137992af15a35825804274fa252e30
- SHA512 058431aa2280511b00a72ea55ded9bdaef55420f5bce10c9352d4f92736a11884d1e70706016b988cca560358b3b43ce1bad5c9bd726f11d8ad66e3c91f98ccb
- SSDEEP 3072:gUbJLl+WMe7FJ02NPhVN0T2rcoNXvUJ4C0jucx2ejoVjM4xT56pL:gUVMWNvrxUJ4CDcY5G
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
33:35:16:55:df:62:5e:90:93:72:fe:bd:fe:ac:db:f2:1e:96:b4:4d:30:e1:68:45:9c:04:3b:aa:ba:f4:42:36
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
174314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb
mscoree
_CorDllMain
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/System.Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
136114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb
mscoree
_CorDllMain
Name
.text
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/System.Numerics.Vectors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 12, 2024
PE Signature issue
Digest
12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
103866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/bouncycastle.crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
- MD5 f0b3e112ce4807a28e2b5d66a840ed7f
- SHA1 54a6743781fd4ceb720331fce92f16186931192d
- SHA512 dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190
- SSDEEP 49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2603454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/bunifu.ui.winforms.1.5.3.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6937052b86bc251be510b110e08fc5089d3bd687ce2333a85ea6d5c2c09b437a
- MD5 c1d51a0e747c9d6156410cb3c5b97a60
- SHA1 86312cba2eb3495cc6bec66d54d4ab88596275d8
- SHA512 a8d7b2e5555c01076e8dd744d21d8cd901aaffad052af0e8c22269e8c2f765019422ed245368a64d64157652a0e4fcab1a889086fde4e139b4ccf5f7bad08222
- SSDEEP 6144:S8oD4R+RVzdBZI1TAcHoP2iErkSeyoJij/YKEC:S8oMR+RVz2FAcHo5y+eEC
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Digest
3e:60:9f:ee:0b:c1:db:79:70:f4:a1:a5:c3:e7:56:69:b3:1e:fc:57
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Chains
Mar 3, 2022
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Serial Number
5c:a8:2f:f3:e2:49:8f:60:ba:9b:0f:ad:f3:bc:d4:87
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 31, 2021 - Mar 31, 2022
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 19, 2010 - Jan 18, 2038
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Minor OS version
0
Major OS version
4
Entry point
300982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\wilsk\source\repos\apps\desktop\bunifu\work\bunifu-framework\__build__\__raw__\Bunifu UI WinForms\1.5.3\net40\Secured\net40\Bunifu.UI.WinForms.1.5.3.pdb
mscoree
_CorDllMain
Name
.text
Size
286KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/bunifu.ui.winforms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 578cbcfb7a01234907fb6314918efd23a502882c79d0ee3c2e7d4ae0cf63ebc2
- MD5 686833fccd95b4f5c8d7695a2d45955d
- SHA1 882f60ea47f536c1f01da0f5767dfe5d569fc011
- SHA512 8bb3a8741b73ad7c280de31905dbfc449c2d6f538b8feca232201c7079f917c4291936211632bcdf17c95d6cf5d9b97df2cdd21c57af6cbff486ea7691ff3bc1
- SSDEEP 24576:xyvPvuVgLZSIFzv+qBoZHS5zmq+u2oN2+/:mJLIOJBoY5zmq+u2oQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1355278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/cgeoip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/guna.ui2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf72939922afa2cd17071f5170b4a82d05bceb1fc33ce29cdfbc68dbb97f0277
- MD5 acec68d05e0b9b6c34a24da530dc07b2
- SHA1 015eb32aad6f5309296c3a88f0c5ab1ba451d41e
- SHA512 d68d3ac62319178d3bc27a0f1e1762fc814a4da65156db90ae17284a99e5d9909e9e6348a4ff9ef0b92a46ba2033b838b75313307b46ab72dc0aab9641e4f700
- SSDEEP 24576:0EYgGsL29WxSrDIFlabtrA8UCf4haho7pcHxvHOVSAF:0dgucgciQj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
a6:b6:6a:35:8d:b6:02:9a:d9:94:90:ab:3a:ff:17:50:0a:a4:8b:2e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Apr 22, 2020
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
1510366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Guna.UI2\Build\Guna.UI2.WinForms\build\.net 4.0\Guna.UI2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/protobuf-net.core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c80999a13b87b0449ce09ebb7d53344b5771876e5af2e426c8e80258f62dff1
- MD5 7d5a891689dc097d641272a459da8ac8
- SHA1 a5b6efdd77bb8dacafb4b3013ab81919ad0e407e
- SHA512 a618ddfd22fc1ead717c2d0ca98c98d81ac4888f4af0c5952c1404f1c36e8ea4796f57bbd026aef187b9575a8737bf02ec7d5c58079bb89678b09239f4f932a7
- SSDEEP 6144:Y8m4EMIWZbQikB4bhhKKW7on7lrFWp/QiSsKyY:+izkmbhhKKSohF0/QiSGY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
274510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
260KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c814d207eba7589cbb810b1625ac4091a5cb5cdc9be5e6691bddb2c4dde4619d
- MD5 02de5f3f2a4b2e15ab53212bc93dc2db
- SHA1 e71e402ab28cd47d55eb997ad0e55ef1ac29d533
- SHA512 7b1f09cdae30c2f1577a694c6ddbed6446997788f42167b4bb78f59c46154b43405639f0c9de7bc57aac598920fd4767cbfcc5ca01f803599d53820c3da4dcc1
- SSDEEP 6144:jjJ3dANv2SafbrR0h4er6RI50Gqo3DcGDsqm:h3dANv2SaT2h38Ivqo3QGL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
263030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
249KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Silver Rat/stub.cs
- SHA256 1ffef5d31a2d6dbc01177fcf7835c9d9eeb4334bd39b20ec76eb2be1ba429f3f
- MD5 255787b7316051d866d8a8a384102c9a
- SHA1 5a9fe0570579b7fe3916ec51abaa6606cf44dd18
- SHA512 3016709d0ca83b58abadf1db647ff313105fa03e738f016cbb6364fa258c1824bfb692117ce325b1189a73242208fbcb58825c0abc022df06b771ed0937594db
- SSDEEP 768:5DyEjJsKMQz84UUQ/0CVnss+Hgr5YDAbZvg6JCPYQdJEFoCG2Q5qT9HGqa7GAgOL:h3jJsKMQz84ELnsAEki3YQdsW3G3y
- MD5 SHA1 SHA512 SSDEEP