VenomRAT_v6.0.3.rar
- SHA256 668bf9ed54120899b86b21a8aa1df1075937b8c05cfca52817746b6e418e2006
Overview
overview
10Static
static
10VenomRAT_v...us.dll
windows10-1703-x64
1VenomRAT_v...at.dll
windows10-1703-x64
1VenomRAT_v...ns.dll
windows10-1703-x64
1VenomRAT_v...er.dll
windows10-1703-x64
1VenomRAT_v...ry.dll
windows10-1703-x64
1VenomRAT_v...it.dll
windows10-1703-x64
1VenomRAT_v...ra.dll
windows10-1703-x64
1VenomRAT_v...op.dll
windows10-1703-x64
1VenomRAT_v...xy.dll
windows10-1703-x64
1VenomRAT_v...le.dll
windows10-1703-x64
1VenomRAT_v...ry.dll
windows10-1703-x64
1VenomRAT_v...er.dll
windows10-1703-x64
1VenomRAT_v...nc.exe
windows10-1703-x64
1VenomRAT_v...op.dll
windows10-1703-x64
1VenomRAT_v...op.dll
windows10-1703-x64
3VenomRAT_v...cs.dll
windows10-1703-x64
1VenomRAT_v...es.ps1
windows10-1703-x64
3VenomRAT_v...es.ps1
windows10-1703-x64
3VenomRAT_v...ny.exe
windows10-1703-x64
10VenomRAT_v...64.exe
windows10-1703-x64
10VenomRAT_v...86.exe
windows10-1703-x64
10VenomRAT_v...on.dll
windows10-1703-x64
1VenomRAT_v...ls.dll
windows10-1703-x64
1VenomRAT_v...er.exe
windows10-1703-x64
7VenomRAT_v...ib.dll
windows10-1703-x64
1VenomRAT_v...Ip.dll
windows10-1703-x64
1VenomRAT_v...ib.dll
windows10-1703-x64
1VenomRAT_v...in.url
windows10-1703-x64
1VenomRAT_v...ng.url
windows10-1703-x64
1VenomRAT_v...rd.dll
windows10-1703-x64
1VenomRAT_v...re.dll
windows10-1703-x64
1VenomRAT_v...et.dll
windows10-1703-x64
1Behavioral task
behavioral1
Sample
VenomRAT_v6.0.3/Plugins/Miscellaneous.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
VenomRAT_v6.0.3/Plugins/Netstat.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
VenomRAT_v6.0.3/Plugins/Options.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
VenomRAT_v6.0.3/Plugins/ProcessManager.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
VenomRAT_v6.0.3/Plugins/Recovery.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
VenomRAT_v6.0.3/Plugins/Regedit.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
VenomRAT_v6.0.3/Plugins/RemoteCamera.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
VenomRAT_v6.0.3/Plugins/RemoteDesktop.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
VenomRAT_v6.0.3/Plugins/ReverseProxy.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
VenomRAT_v6.0.3/Plugins/SendFile.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
VenomRAT_v6.0.3/Plugins/SendMemory.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
VenomRAT_v6.0.3/Plugins/Stealer.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
VenomRAT_v6.0.3/Plugins/hvnc.exe
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
VenomRAT_v6.0.3/Plugins/x64/SQLite.Interop.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
VenomRAT_v6.0.3/Plugins/x86/SQLite.Interop.dll
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
300 seconds
Behavioral task
behavioral16
Sample
VenomRAT_v6.0.3/SMDiagnostics.dll
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral17
Sample
VenomRAT_v6.0.3/Server.Properties.Resources.ps1
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral18
Sample
VenomRAT_v6.0.3/Server.Properties.Resources.resources.ps1
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral19
Sample
VenomRAT_v6.0.3/Stub/ClientAny.exe
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
300 seconds
Behavioral task
behavioral20
Sample
VenomRAT_v6.0.3/Stub/Clientx64.exe
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
300 seconds
Behavioral task
behavioral21
Sample
VenomRAT_v6.0.3/Stub/Clientx86.exe
Resource
win10-20240404-en
windows10-1703-x64
3 signatures
300 seconds
Behavioral task
behavioral22
Sample
VenomRAT_v6.0.3/System.IO.Compression.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
VenomRAT_v6.0.3/System.ServiceModel.Internals.dll
Resource
win10-20240404-en
windows10-1703-x64
1 signatures
300 seconds
Behavioral task
behavioral24
Sample
VenomRAT_v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
300 seconds
Behavioral task
behavioral25
Sample
VenomRAT_v6.0.3/Vestris.ResourceLib.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
VenomRAT_v6.0.3/cGeoIp.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
VenomRAT_v6.0.3/dnlib.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
VenomRAT_v6.0.3/gbpast - Login.url
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
VenomRAT_v6.0.3/learn all kind of hacking.url
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
VenomRAT_v6.0.3/netstandard.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
VenomRAT_v6.0.3/protobuf-net.Core.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
VenomRAT_v6.0.3/protobuf-net.dll
Resource
win10-20240404-en
windows10-1703-x64
0 signatures
300 seconds
General
- Target VenomRAT_v6.0.3.rar
- Size 92.3MB
- Sample240516-2faxjsbg73
- SHA256 668bf9ed54120899b86b21a8aa1df1075937b8c05cfca52817746b6e418e2006
- MD5 7cbabf71dd915f44b67f1765e805e5ab
- SHA1 bc44d2fd089fc818824a5eb8f3c4310636dc2b81
- SHA512 9a3171a9c0f813b2c228348d2d4a3b94457578a6d1d5f80d7780fffcc3d67731b49b2cfe38f6ba4498203f1551e7c1cbc7b60d2ccc4dd8412943bc634a870509
- SSDEEP 1572864:Ox40amHGeCj7VmyotHgaspW71f6xJgOBWWqwGaoAaCAOEFHiWlMvbRje/L20J1XP:raCj7VJoBgaMW75KC1Wq0TUORWudA203
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Async RAT payload 2 IoCs
resource yara_rule static1/unpack001/VenomRAT_v6.0.3/Stub/ClientAny.exe family_asyncrat static1/unpack001/VenomRAT_v6.0.3/Stub/Clientx86.exe family_asyncrat - Asyncrat family
- StormKitty payload 1 IoCs
resource yara_rule static1/unpack001/VenomRAT_v6.0.3/Plugins/Recovery.dll family_stormkitty - Stormkitty family
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack001/VenomRAT_v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe net_reactor - Unsigned PE 53 IoCs
Checks for missing Authenticode signature.
resource unpack001/VenomRAT_v6.0.3/BouncyCastle.Crypto.dll unpack001/VenomRAT_v6.0.3/DevExpress.Data.Desktop.v22.1.dll unpack001/VenomRAT_v6.0.3/DevExpress.Data.v22.1.dll unpack001/VenomRAT_v6.0.3/DevExpress.Drawing.v22.1.dll unpack001/VenomRAT_v6.0.3/DevExpress.Printing.v22.1.Core.dll unpack001/VenomRAT_v6.0.3/DevExpress.Utils.v22.1.dll unpack001/VenomRAT_v6.0.3/DevExpress.WinRTPresenter.Launcher.exe unpack001/VenomRAT_v6.0.3/DevExpress.XtraBars.v22.1.dll unpack001/VenomRAT_v6.0.3/DevExpress.XtraEditors.v22.1.dll unpack001/VenomRAT_v6.0.3/DevExpress.XtraGrid.v22.1.dll unpack001/VenomRAT_v6.0.3/DevExpress.XtraLayout.v22.1.dll unpack001/VenomRAT_v6.0.3/DotNetZip.dll unpack001/VenomRAT_v6.0.3/FastColoredTextBox.dll unpack001/VenomRAT_v6.0.3/IP2Region.dll unpack001/VenomRAT_v6.0.3/IconExtractor.dll unpack001/VenomRAT_v6.0.3/Keylogger.exe unpack001/VenomRAT_v6.0.3/MessagePackLib.dll unpack001/VenomRAT_v6.0.3/PeNet.Asn1.dll unpack001/VenomRAT_v6.0.3/PeNet.dll unpack001/VenomRAT_v6.0.3/Plugins/Audio.dll unpack001/VenomRAT_v6.0.3/Plugins/Discord.dll unpack001/VenomRAT_v6.0.3/Plugins/Extra.dll unpack001/VenomRAT_v6.0.3/Plugins/FileManager.dll unpack001/VenomRAT_v6.0.3/Plugins/FileSearcher.dll unpack001/VenomRAT_v6.0.3/Plugins/Fun.dll unpack001/VenomRAT_v6.0.3/Plugins/HVNCStub.dll unpack001/VenomRAT_v6.0.3/Plugins/Information.dll unpack001/VenomRAT_v6.0.3/Plugins/Keylogger.exe unpack001/VenomRAT_v6.0.3/Plugins/Logger.dll unpack001/VenomRAT_v6.0.3/Plugins/Miscellaneous.dll unpack001/VenomRAT_v6.0.3/Plugins/Netstat.dll unpack001/VenomRAT_v6.0.3/Plugins/Options.dll unpack001/VenomRAT_v6.0.3/Plugins/ProcessManager.dll unpack001/VenomRAT_v6.0.3/Plugins/Recovery.dll unpack001/VenomRAT_v6.0.3/Plugins/Regedit.dll unpack001/VenomRAT_v6.0.3/Plugins/RemoteCamera.dll unpack001/VenomRAT_v6.0.3/Plugins/RemoteDesktop.dll unpack001/VenomRAT_v6.0.3/Plugins/ReverseProxy.dll unpack001/VenomRAT_v6.0.3/Plugins/SendFile.dll unpack001/VenomRAT_v6.0.3/Plugins/SendMemory.dll unpack001/VenomRAT_v6.0.3/Plugins/Stealer.dll unpack001/VenomRAT_v6.0.3/Plugins/hvnc.exe unpack001/VenomRAT_v6.0.3/SMDiagnostics.dll unpack001/VenomRAT_v6.0.3/Stub/ClientAny.exe unpack001/VenomRAT_v6.0.3/Stub/Clientx64.exe unpack001/VenomRAT_v6.0.3/Stub/Clientx86.exe unpack001/VenomRAT_v6.0.3/System.ServiceModel.Internals.dll unpack001/VenomRAT_v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe unpack001/VenomRAT_v6.0.3/Vestris.ResourceLib.dll unpack001/VenomRAT_v6.0.3/cGeoIp.dll unpack001/VenomRAT_v6.0.3/dnlib.dll unpack001/VenomRAT_v6.0.3/protobuf-net.Core.dll unpack001/VenomRAT_v6.0.3/protobuf-net.dll
File Explorer
-
VenomRAT_v6.0.3.rar.rar 92.3MB
-
VenomRAT_v6.0.3/BouncyCastle.Crypto.dll.dll 2.5MB
-
VenomRAT_v6.0.3/DevExpress.Charts.v22.2.Core.dll.dll 1023KB
-
VenomRAT_v6.0.3/DevExpress.CodeParser.v22.2.dll.dll 1.7MB
-
VenomRAT_v6.0.3/DevExpress.Data.Desktop.v22.1.dll.dll 838KB
-
VenomRAT_v6.0.3/DevExpress.Data.Desktop.v22.2.dll.dll 912KB
-
VenomRAT_v6.0.3/DevExpress.Data.v22.1.dll.dll 5.0MB
-
VenomRAT_v6.0.3/DevExpress.Data.v22.2.dll.dll 5.1MB
-
VenomRAT_v6.0.3/DevExpress.DataAccess.v22.2.UI.dll.dll 1.1MB
-
VenomRAT_v6.0.3/DevExpress.DataAccess.v22.2.dll.dll 2.3MB
-
VenomRAT_v6.0.3/DevExpress.DataVisualization.v22.2.Core.dll.dll 70KB
-
VenomRAT_v6.0.3/DevExpress.Diagram.v22.2.Core.dll.dll 3.0MB
-
VenomRAT_v6.0.3/DevExpress.Dialogs.v22.2.Core.dll.dll 927KB
-
VenomRAT_v6.0.3/DevExpress.Drawing.v22.1.dll.dll 291KB
-
VenomRAT_v6.0.3/DevExpress.Drawing.v22.2.dll.dll 598KB
-
VenomRAT_v6.0.3/DevExpress.Images.v22.1.dll.dll 8.4MB
-
VenomRAT_v6.0.3/DevExpress.Images.v22.2.dll.dll 8.2MB
-
VenomRAT_v6.0.3/DevExpress.Mvvm.v22.2.dll.dll 1.5MB
-
VenomRAT_v6.0.3/DevExpress.Office.v22.1.Core.dll.dll 3.7MB
-
VenomRAT_v6.0.3/DevExpress.Office.v22.2.Core.dll.dll 3.7MB
-
VenomRAT_v6.0.3/DevExpress.Pdf.v22.1.Core.dll.dll 5.1MB
-
VenomRAT_v6.0.3/DevExpress.Pdf.v22.1.Drawing.dll.dll 502KB
-
VenomRAT_v6.0.3/DevExpress.Pdf.v22.2.Core.dll.dll 4.9MB
-
VenomRAT_v6.0.3/DevExpress.Pdf.v22.2.Drawing.dll.dll 501KB
-
VenomRAT_v6.0.3/DevExpress.PivotGrid.v22.2.Core.dll.dll 3.6MB
-
VenomRAT_v6.0.3/DevExpress.Printing.v22.1.Core.dll.dll 4.5MB
-
VenomRAT_v6.0.3/DevExpress.Printing.v22.2.Core.dll.dll 4.5MB
-
VenomRAT_v6.0.3/DevExpress.RichEdit.v22.1.Core.dll.dll 8.4MB
-
VenomRAT_v6.0.3/DevExpress.RichEdit.v22.2.Core.dll.dll 8.4MB
-
VenomRAT_v6.0.3/DevExpress.RichEdit.v22.2.Export.dll.dll 252KB
-
VenomRAT_v6.0.3/DevExpress.Sparkline.v22.1.Core.dll.dll 87KB
-
VenomRAT_v6.0.3/DevExpress.Sparkline.v22.2.Core.dll.dll 88KB
-
VenomRAT_v6.0.3/DevExpress.Utils.v22.1.dll.dll 20.0MB
-
VenomRAT_v6.0.3/DevExpress.Utils.v22.2.UI.dll.dll 383KB
-
VenomRAT_v6.0.3/DevExpress.Utils.v22.2.dll.dll 19.4MB
-
VenomRAT_v6.0.3/DevExpress.WinRTPresenter.Launcher.exe.exe 13KB
-
VenomRAT_v6.0.3/DevExpress.Xpo.v22.2.dll.dll 2.2MB
-
VenomRAT_v6.0.3/DevExpress.XtraBars.v22.1.dll.dll 6.5MB
-
VenomRAT_v6.0.3/DevExpress.XtraBars.v22.2.dll.dll 6.6MB
-
VenomRAT_v6.0.3/DevExpress.XtraCharts.v22.2.Extensions.dll.dll 38KB
-
VenomRAT_v6.0.3/DevExpress.XtraCharts.v22.2.UI.dll.dll 537KB
-
VenomRAT_v6.0.3/DevExpress.XtraCharts.v22.2.Wizard.dll.dll 6.9MB
-
VenomRAT_v6.0.3/DevExpress.XtraCharts.v22.2.dll.dll 5.0MB
-
VenomRAT_v6.0.3/DevExpress.XtraDiagram.v22.2.dll.dll 1.3MB
-
VenomRAT_v6.0.3/DevExpress.XtraDialogs.v22.2.dll.dll 901KB
-
VenomRAT_v6.0.3/DevExpress.XtraEditors.v22.1.dll.dll 7.7MB
-
VenomRAT_v6.0.3/DevExpress.XtraEditors.v22.2.dll.dll 7.7MB
-
VenomRAT_v6.0.3/DevExpress.XtraGrid.v22.1.dll.dll 3.6MB
-
VenomRAT_v6.0.3/DevExpress.XtraGrid.v22.2.dll.dll 3.6MB
-
VenomRAT_v6.0.3/DevExpress.XtraLayout.v22.1.dll.dll 2.0MB
-
VenomRAT_v6.0.3/DevExpress.XtraLayout.v22.2.dll.dll 2.1MB
-
VenomRAT_v6.0.3/DevExpress.XtraNavBar.v22.2.dll.dll 434KB
-
VenomRAT_v6.0.3/DevExpress.XtraPivotGrid.v22.2.dll.dll 893KB
-
VenomRAT_v6.0.3/DevExpress.XtraPrinting.v22.1.dll.dll 1.1MB
-
VenomRAT_v6.0.3/DevExpress.XtraPrinting.v22.2.dll.dll 994KB
-
VenomRAT_v6.0.3/DevExpress.XtraRichEdit.v22.1.dll.dll 2.9MB
-
VenomRAT_v6.0.3/DevExpress.XtraRichEdit.v22.2.dll.dll 2.5MB
-
VenomRAT_v6.0.3/DevExpress.XtraTreeList.v22.1.dll.dll 1.6MB
-
VenomRAT_v6.0.3/DevExpress.XtraTreeList.v22.2.dll.dll 1.6MB
-
VenomRAT_v6.0.3/DevExpress.XtraVerticalGrid.v22.2.dll.dll 1.2MB
-
VenomRAT_v6.0.3/DevExpress.XtraWizard.v22.2.dll.dll 102KB
-
VenomRAT_v6.0.3/DotNetZip.dll.dll 461KB
-
VenomRAT_v6.0.3/FastColoredTextBox.dll.dll 323KB
-
VenomRAT_v6.0.3/Home - blankhack.url.url 110B
-
VenomRAT_v6.0.3/Home - cybergoons.url.url 121B
-
VenomRAT_v6.0.3/IP2Region.dll.dll 13KB
-
VenomRAT_v6.0.3/IconExtractor.dll.dll 10KB
-
VenomRAT_v6.0.3/Keylogger.exe.exe 10KB
-
VenomRAT_v6.0.3/MessagePackLib.dll.dll 16KB
-
VenomRAT_v6.0.3/Microsoft.Win32.Primitives.dll.dll 20KB
-
VenomRAT_v6.0.3/Newtonsoft.Json.dll.dll 695KB
-
VenomRAT_v6.0.3/PeNet.Asn1.dll.dll 29KB
-
VenomRAT_v6.0.3/PeNet.dll.dll 188KB
-
VenomRAT_v6.0.3/Plugins/Audio.dll.dll 23KB
-
VenomRAT_v6.0.3/Plugins/Discord.dll.dll 25KB
-
VenomRAT_v6.0.3/Plugins/Extra.dll.dll .ps1 31KB
-
VenomRAT_v6.0.3/Plugins/FileManager.dll.dll 32KB
-
VenomRAT_v6.0.3/Plugins/FileSearcher.dll.dll 278KB
-
VenomRAT_v6.0.3/Plugins/Fun.dll.dll 34KB
-
VenomRAT_v6.0.3/Plugins/HVNCStub.dll.dll 99KB
-
VenomRAT_v6.0.3/Plugins/Information.dll.dll 24KB
-
VenomRAT_v6.0.3/Plugins/Keylogger.exe.exe 13KB
-
VenomRAT_v6.0.3/Plugins/Keylogger.exe.config.xml 161B
-
VenomRAT_v6.0.3/Plugins/Logger.dll.dll 28KB
-
VenomRAT_v6.0.3/Plugins/Miscellaneous.dll.dll 82KB
-
VenomRAT_v6.0.3/Plugins/Netstat.dll.dll 25KB
-
VenomRAT_v6.0.3/Plugins/Options.dll.dll 378KB
-
VenomRAT_v6.0.3/Plugins/ProcessManager.dll.dll 25KB
-
VenomRAT_v6.0.3/Plugins/Recovery.dll.dll 1.1MB
-
VenomRAT_v6.0.3/Plugins/Regedit.dll.dll 280KB
-
VenomRAT_v6.0.3/Plugins/RemoteCamera.dll.dll 107KB
-
VenomRAT_v6.0.3/Plugins/RemoteDesktop.dll.dll 34KB
-
VenomRAT_v6.0.3/Plugins/ReverseProxy.dll.dll 553KB
-
VenomRAT_v6.0.3/Plugins/SendFile.dll.dll 26KB
-
VenomRAT_v6.0.3/Plugins/SendMemory.dll.dll 28KB
-
VenomRAT_v6.0.3/Plugins/Stealer.dll.dll 1.2MB
-
VenomRAT_v6.0.3/Plugins/Stealer.dll.config.xml 1KB
-
VenomRAT_v6.0.3/Plugins/hvnc.exe.exe 36KB
-
VenomRAT_v6.0.3/Plugins/ip2region.db8.9MB
-
VenomRAT_v6.0.3/Plugins/x64/SQLite.Interop.dll.dll 1.7MB
-
VenomRAT_v6.0.3/Plugins/x86/SQLite.Interop.dll.dll 1.3MB
-
VenomRAT_v6.0.3/Resources.resx.vbs .xml 17.1MB
-
VenomRAT_v6.0.3/SMDiagnostics.dll.dll 118KB
-
VenomRAT_v6.0.3/Server.Properties.Resources.resources.ps1 11.6MB
-
VenomRAT_v6.0.3/Server.Properties.Resources.resources.txt.ps1 27KB
-
VenomRAT_v6.0.3/Stub/ClientAny.exe.exe 69KB
-
VenomRAT_v6.0.3/Stub/Clientx64.exe.exe 69KB
-
VenomRAT_v6.0.3/Stub/Clientx86.exe.exe 69KB
-
VenomRAT_v6.0.3/System.IO.Compression.dll.dll 65KB
-
VenomRAT_v6.0.3/System.ServiceModel.Internals.dll.dll 804KB
-
VenomRAT_v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe.exe 8.3MB
-
VenomRAT_v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe.config.xml 3KB
-
VenomRAT_v6.0.3/VenomServer.p121KB
-
VenomRAT_v6.0.3/Vestris.ResourceLib.dll.dll 76KB
-
VenomRAT_v6.0.3/cGeoIp.dll.dll 2.3MB
-
VenomRAT_v6.0.3/dnlib.dll.dll 1.1MB
-
VenomRAT_v6.0.3/gbpast - Login.url.url 107B
-
VenomRAT_v6.0.3/learn all kind of hacking.url.url 121B
-
VenomRAT_v6.0.3/netstandard.dll.dll 96KB
-
VenomRAT_v6.0.3/offline86KB
-
VenomRAT_v6.0.3/online88KB
-
VenomRAT_v6.0.3/protobuf-net.Core.dll.dll 274KB
-
VenomRAT_v6.0.3/protobuf-net.dll.dll 263KB
VenomRAT_v6.0.3/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
- MD5 f0b3e112ce4807a28e2b5d66a840ed7f
- SHA1 54a6743781fd4ceb720331fce92f16186931192d
- SHA512 dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190
- SSDEEP 49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2603454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Charts.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 de682a0d612ec7d45a0accd8fbbb90db374d652ec68b52317170082a2afe7f31
- MD5 bcfa59a0896b924b2d8f1a50d4a1d970
- SHA1 5f0ad9f59f852023d5a1d3377bdf45ec2b45b52a
- SHA512 604f26842788e851822915bb9e80ca2af392b8e82ae4cffa0160cc761303098795615e00356665117b4ee1be421d74d46b8ca13bca220bd97f04f7b575a5f4d3
- SSDEEP 12288:bBj6U3pbVIy5rPW9s9d9r6AXe2w8jnHXRM1bnMLdvzL2bpujxZZyNdqTfFlL31XA:Fj3f6Mw8jnHXQe7S0yWTfFJQMXn3AL
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
6f:46:82:f0:2d:45:ca:51:3b:76:b7:bd:b8:e0:d9:3a:4f:d4:10:f2:41:74:28:65:69:97:16:94:fb:a3:e6:08
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 6, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1043702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraCharts\DevExpress.Charts.Core\obj.NC\DevExpress.Charts.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
1012KB
Virtual Size
1011KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.CodeParser.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aa74c8d4b98543a9f277860c7d11a64d762b4dd20d93acdbe0e4193fb69d5245
- MD5 ec3a80bc6de2d32444c582f31c14000f
- SHA1 e4d880a4845095b18cc13b98d2d8f46d2c894a36
- SHA512 7b469292db8fdb315a0647a060e28f6d2a5ff9fce81e4a5d8db9438b28fec7144b9ab02177fe8cb4bf7a54c407c8dca9dbfed437e8f0b71ead1bab2043b90eef
- SSDEEP 24576:O2pK1qXadH/E7i39l5/uwPSs/Eq9VtPRRJ/Jf/j6y0xkW9C3/TQjZU:G6K5/up6nPBt09CvTQu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
88:76:c3:d7:cd:87:9f:9a:92:4d:95:b0:5f:ed:da:d9:2b:44:3a:dc:78:5e:3e:87:04:a2:bb:f3:fd:d1:7a:fc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 6, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1707562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.CodeParser\obj.NC\DevExpress.CodeParser.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Data.Desktop.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d13e0c266cb9b98a911bbb87fd94cd9e5125e3bff93bb9b1032271e7507ef2f6
- MD5 e59c802bbbc1ebc554f3f7b6a3259ee1
- SHA1 fdb4fa99e15d6519f18f7afe972fb2b128c5caf4
- SHA512 34aa13fd54fa262405e68c5f915192fe02b9d2c6560f36c5a5c93ec399407b47996e2d4ed88c22286cc6d578a4356353a9540a729684272611350c4665119e73
- SSDEEP 12288:XzcvADexPaUb6wZPYj8vtvrlecLHP2+jXSwatzuHkrYCX1TSahOr1LZKHVoiXw+E:D5DexdNZPYj8zecLv2+jCXVGsYs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
864218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Data.Desktop\DevExpress.Data.Desktop\obj_netFW\Release\DevExpress.Data.Desktop.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
836KB
Virtual Size
835KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Data.Desktop.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d405116805f243c6852b06b70e9cfca68837a2eb918d53247c6ae69c21b093a2
- MD5 03c9a3454f296dba13b5d4a70c3f1504
- SHA1 0b19ead85b4775f44b488cd99623b7ae6515d0ca
- SHA512 a5c90806a68b6e1051a2d444a57ae216683ce42b419723fc1b9e29bf98149c7c9b2d7345e45cb3c76f57c7b8fd1cee7404c7c3ee7a39c4966db301c649ce30e2
- SSDEEP 24576:WkZ0Hy8pATSVJLTJ8esj+ye2L95PlYfBxgA9QphiP6sLDip:giGqesB+QpkP6s+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2b:87:a9:f9:0b:cb:e3:00:36:0a:8a:ee:16:11:53:73:a4:79:eb:26:3c:c2:80:6f:84:ed:dd:15:70:bf:55:7a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
931014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Data.Desktop\DevExpress.Data.Desktop\obj.NCD\DevExpress.Data.Desktop.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
901KB
Virtual Size
901KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Data.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8d4940767c992e14acb77ba1140d5dac56683afe5096e1b08408b0767466e33
- MD5 5c3017ec9073a7a4f3351440c3daaa8a
- SHA1 ee1f73f8618439fc8a42f38b32760367bd5ce6b5
- SHA512 5d98631f754067e659400183134024cc2a4c22ba4a43ddf592791e01eca5cf1530eabcc4ee34beb7507c56dd02a80ba4704db389753a3119657e1d822c68c02a
- SSDEEP 49152:fJJHcStFUzQUnI8id8LDaWdFH6cvmhHgVYFvFWcp/ldRzaxO0zC96S1qBdFBWhRo:fJJH1gzh9iSLDCHgVYFvFXTda
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5287662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Data\DevExpress.Data\obj_netFW\Release\DevExpress.Data.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Data.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 02653d88be212ba3753ee8e87c13159a2ce48250c6c7a05f21091924eb6953d2
- MD5 972235bfefa9a46cf8c4f3461546822d
- SHA1 1207b99cf9c961d756607567b321a2e3da0fa4bf
- SHA512 ad22e1a84ae11e132463b20453c0d482591cbfc923251c802a7ae4693f0475a043d1f03f411ecdcab015dd99914e63a1f9736680d91e6825bb4b53c0d30bcd03
- SSDEEP 98304:ZynaqG9bqBpIyn5f+byY7OCognQtqJnnC/wnnLs0mV52GFi8ajXXREyicBhydxbq:HXREyicBhsE
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
dc:f9:8a:a8:a3:df:5c:b0:e6:90:c0:b3:25:b3:c0:5f:da:ec:6c:2e:d6:ee:67:32:f7:46:dc:03:30:ea:12:74
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 6, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
5281378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Data\obj.NC\DevExpress.Data.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.DataAccess.v22.2.UI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f8a4f0ce3e38e1e750ce84231423600dbda276ba561f1a3bfc0ca142c7bc502a
- MD5 58d916af93509dd6242bb1a8480f1411
- SHA1 6c9be26a8b77c90df8b056828e2f0748e83fdb12
- SHA512 8be93d1131efed14fc3d1e788aeb639d2077cd8d664c269e4dd56836cda765bb663c67d6c17bbfb2262d9cd0041c5d2dddb6f27380b1f52e040db30bc8739a6d
- SSDEEP 12288:+1Bih715T8HAPj4LrUM+iTzbMUe7B+VBBDgipnI7fbPg2yEqWCpWw:Eih1Pj4H/FwjLeKqWvw
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9f:7f:13:4a:6a:6b:8c:50:89:10:be:d1:26:6f:99:3d:ab:ff:4f:16:54:ff:f6:65:57:f5:4d:41:1f:b4:0f:f9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1185978
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.DataAccess\DevExpress.DataAccess.UI\obj.NCD\DevExpress.DataAccess.v22.2.UI.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.DataAccess.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2eac960681b6b3193945215060cb3b4e2b7483304566dbbe74a683e893c7e022
- MD5 0f8e092a39ea088e3d6290f49d45d882
- SHA1 c3da5608855a9059f9239a610ea5a126510bf026
- SHA512 8df310efb3faed7e51d51a4ee52e96724a2a9f2903192fb6dd98910cfbc1b37dd23fe0afe6a2a6c449cc28d1552431addc63879bf26ea9cb3a95d2dfcfeb92e3
- SSDEEP 24576:EN+IqInpwDV0HS+0LODDUDaRR917/JjB5FJjzkt0GDKmlaBwJpDyRSa+Ya4FdY:EqPDdO0sjkOmlaBwJpDyRSWY
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e8:96:28:c1:d8:f9:5e:8c:46:f4:c2:28:88:91:5a:0f:72:3f:b2:6a:e7:55:0f:40:0d:db:3a:ce:30:14:5f:b4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
2422566
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.DataAccess\DevExpress.DataAccess\obj.NC\DevExpress.DataAccess.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.DataVisualization.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec3b83363fc251a586c5520f3d617b3f1702ee92995dcd6e4c68e2f44e0896f7
- MD5 22331e85e4541142c45e763572f53d34
- SHA1 f304bbfd451b2194d13fc537f398ce7c606f89b8
- SHA512 773ad77b36f247b4d323f0fb831eb71f0177381a983cdd2882491d07210c2421244a9cdd43f942105a364cb07dd358a119e43deb17297ae0a440c7c288e8abd2
- SSDEEP 1536:/jQQ7SIR8UJLZTLJweZ7MeZDGr3IqLlCqnh8ItkPxa:LQQ7SC8QLZTWeZ7MUDGDIjdIt0xa
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
40:06:54:e7:fd:87:42:39:5e:a7:db:78:4f:b9:ee:4c:14:a3:f6:3f:2b:48:35:08:d0:b5:f0:58:40:44:20:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
68166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraCharts\DevExpress.DataVisualization.Core\obj.NC\DevExpress.DataVisualization.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Diagram.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e971be0ba001e66a202c4486c1cfda6141fa9b62571ef00f9929f945e76229fd
- MD5 e3d5b8cfe35aa677e887255b39689b36
- SHA1 5bfe506461c19e296d22c10e864390d4db117092
- SHA512 92e011e92576d45e6e3a46634fbf55d4a0ef8e7c3656671fd135a7ef5c391977e812d86e6a4160626acf4f4592d6b0430af9a61cc54faba37f0774956c3bea0e
- SSDEEP 49152:kkd79qsLqsnV5OR6sgxzkmxdflHqkYoYmNpDlwb6GdYX2vYNWAOfraPH:w4scuYX2vYNWAOfraPH
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
75:32:53:d7:a1:eb:eb:f5:65:ef:0c:ca:3e:53:e3:95:18:4a:22:4d:1d:49:02:37:6d:d8:55:13:ee:03:9b:7a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
3124402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraDiagram\DevExpress.Diagram.Core\obj.NCD\DevExpress.Diagram.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Dialogs.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ee75eeabe9f077371a321077e0a6dd0a7b00d33794ff3b3b7210ac56a6b326eb
- MD5 b08df7e98f044fa024e8f2f21a8eaee1
- SHA1 46101821b2b4e41c08890c78f9f158478248b614
- SHA512 f12dedb1a36a964a5a57ce45c899eb50877d4ede21f2f48ace488e3ef57db51ea594461715034a58e3f4332b61c0c6b34f3c821e576f2917a411957d156c4db8
- SSDEEP 24576:wIxjKdIbP9b1vVfWsgNLZ/ZDTKq2lPOoeUzI:/WdIRb1JWBJ2lPOz
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
df:70:4e:2b:f9:8b:0b:bb:4b:99:be:f4:e6:c4:9f:fb:f1:9d:68:43:c6:56:b5:ce:94:55:10:b8:67:7d:3a:c5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
946070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraDialogs\DevExpress.Dialogs.Core\obj.NCD\DevExpress.Dialogs.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
916KB
Virtual Size
915KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Drawing.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bc0d40dcdcc9f3e2e7b7071ffb033811bb094cc6a63907c994acd5415b577930
- MD5 cb877cd3b77a37f8e279fe7dc6b4ba6a
- SHA1 a03989c1144a57e9088daa40f829a49298135b03
- SHA512 8dbbbe8606bd36c2efd4f456840c9cb5dd4966097f3a6a0e81104fe4a50695adf558612d74fd31978728455f699f6623e73dfd5e3fcd405e0afceebe83ddd97b
- SSDEEP 6144:4yeiVjwTvgD+Z6Rb3zaiG5lpvkw5zticHOmfvAbWqiWUvq:4yeiVjwTvX6NhclJiOfqiWgq
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
303886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Drawing\DevExpress.Drawing\obj_netFW\Release\DevExpress.Drawing.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
289KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Drawing.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 41b3baffaec9eed640cf10d917d3d912685001a7e3a963e2872c85a74d55100c
- MD5 5ad5e45bded230824ea84eb8a941a11d
- SHA1 092db1158f73529a650faacf82e7b08f812d97cd
- SHA512 dc443cba6d278a2a3d913fbd0d66ce3ccb0e08eb0cb6f947097f57b860a714a13fc0c21c315b70ad58c97f95e19a331d065998cd873f7e0b5bbaf495e19f6e04
- SSDEEP 12288:lDEOmUDROBNifcvBLhHX0vLt8wkqPfdEM52x:AAKifcvnXCtnfdEM5g
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
87:a1:32:a7:32:5f:32:59:64:b0:f5:46:76:4a:fc:ad:04:f8:b7:2e:7b:c6:0f:11:8a:20:b0:bb:31:9f:90:de
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
606638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Drawing\DevExpress.Drawing\obj.NC\DevExpress.Drawing.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
587KB
Virtual Size
587KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Images.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 67a7db033d6047d8345182233f6d314c3ff1547dccaf5b8c04d71e1c8d8faa57
- MD5 5246e412b204882fed4300efede7119b
- SHA1 f688ca2ff1ee91f6dbe0b52502ff0e1154210787
- SHA512 d35d52e848915f25a502115791bd947ad2a6374e602348d173a74dddc7fce5d42bed62576a819454d5fafc2a120a69d6fc254ab940c4263c65b53804cb48d866
- SSDEEP 98304:nuhlxpyY1Fp6bPIPxk7Q8unttuszubxv1h:nyGI6bAPS7XuttZatD
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
93:85:3a:00:dc:eb:b8:8b:b8:10:8f:d1:9f:71:96:43:3d:58:ff:be:43:59:f0:83:11:19:12:d7:d9:47:f3:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
8794850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Images\DevExpress.Images\obj_netFW\Release\DevExpress.Images.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
8.4MB
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Images.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 90d34d161ebadd1ebf75e4e10855635f8d5c83bac2829abdeebb6d082d9ce3ad
- MD5 58ab573a10017df4cd0aabc790711a64
- SHA1 a45f84e5b69768c9e0335f780e56a8e0f9003cdf
- SHA512 f954aa39d3ad8f68ec688cc9bac8e0b481f15e601af8dee8e6e18c0cd60cc6a0fc500f6cc1cb629e87e141982c12f1086011d383a025a22fa2ff416be639d0ae
- SSDEEP 98304:lDlxpyY1Fp6bPIPxk7Q8unttuszubxv1k:3GI6bAPS7XuttZaty
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2a:19:5f:a8:3b:26:83:6b:3c:7a:f2:b5:2d:38:72:d3:30:95:e6:79:f0:70:db:c5:74:9f:93:f1:e2:17:2b:84
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
8571902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Images\obj\Release\DevExpress.Images.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
8.2MB
Virtual Size
8.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Mvvm.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 efdae289d4215896dca0b74a4084d17926693e7555807a1373d015f6dd1a3e65
- MD5 1117ef703715898519a95ff4b3370fcb
- SHA1 117ebc2630c71270e0c3f1f96e98e53633e60bda
- SHA512 d960cabf2f15a18975c7cfd4af74cfb1147950b8a76e0dce8a3105af302fd9c1ea560607f0287c574663f8eb3ce73e9b7bdc22ecd22046621040b162986b9f92
- SSDEEP 12288:ngvcM+TrE0e7uX/tkk2vkf5DbQKGevXnJMjEEk8v/5ZZ5TUgCPTaq:Z2QX/eklQKGev3JmEEk8v/5pUsq
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1a:7e:29:d7:8a:9e:9e:e0:a5:b4:07:af:e6:86:ac:65:f8:2c:59:c1:49:ee:44:67:8a:d1:0b:e2:89:88:4e:48
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 6, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1589194
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XPF\DevExpress.Mvvm\DevExpress.Mvvm.Wpf\obj.NCD\DevExpress.Mvvm.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Office.v22.1.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 10c2ef3e11a2a2cdac160d4299cd541d6b1f75613ae7adec7689e71d365f7e21
- MD5 04481d41b4edffc33d43dc7b3c21879b
- SHA1 9bdfc1ae5bc61699e2705aa58e693ce745c35f88
- SHA512 76e6a7326e06c3a57d056fb139cb655382017336b422b606a3237d472e7a443d59c71e08a060b3c84a9129d507e458a8f990fef872e5f6e7600f62bd5b02a59a
- SSDEEP 49152:3eqp7uMm3b6vbhMVlddimWL1S1wUwyWFN:3eqRTY1WL1S1wUwyWj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
07:ec:11:81:92:3e:d8:ab:30:17:57:f7:0f:98:f4:d8:fb:de:95:25:43:11:98:eb:d0:17:5f:04:1d:35:09:78
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
3865110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Office\DevExpress.Office.Core\obj_netFW\Release\DevExpress.Office.v22.1.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Office.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ff553a31694d7043aacbbcda3ec41377ddc036c506520db7331fe3ba8e3a39b6
- MD5 f570b5c55a11bcacf973eeed57e0844e
- SHA1 f9fa8dbc1c8f7dc239d0b5c83aafdc54277c71c0
- SHA512 e91969f0a723347d788897f6d5d13a979d61d9fb51c21387d1eb746fbc38cf88119dfb3b1ca565eed1676cc8428cc48eb9ed4fd9d834bfe0ddfd89b2d0faa28b
- SSDEEP 49152:1Hi6ec84Z7Qzu8guVlDdimWL1S1wUwyWFJ:JirrwUzB1WL1S1wUwyWz
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b0:62:95:bb:3b:f5:2d:af:6d:bf:97:71:42:9e:19:34:c0:4d:7c:26:78:60:fe:ce:9e:2f:e6:9c:c3:34:fa:b7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
3870494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Office\DevExpress.Office.Core\obj.NC\DevExpress.Office.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Pdf.v22.1.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0704e6abdd582e23b37a7bdfd298b914038e43477f2e0bc271b012185a5e71c4
- MD5 3da62d7c737ee74cd7c039ec47780794
- SHA1 d3403fc931204f1a6fcd731ca3d65be571bc29b0
- SHA512 f39d3145d45b2221c1da05eccf8ca97e5aadc476526f0639b87b4289053b196f8bd282d8373e96f0b09aabbeb120d85cfc1247d7503fd10a74824c22a93adcf0
- SSDEEP 98304:KX8B3YZ5K3AgwJhuwug6mDxLAqq8n7OH2Ck:KX8B3YZ5K3AgwuhUVzDn782h
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3b:d2:e0:4e:d5:eb:aa:0b:b4:33:62:ec:9b:dc:f5:e4:1e:ee:5d:ad:47:4e:19:6b:36:f4:8c:1e:24:ab:7a:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
5286010
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Pdf\DevExpress.Pdf.Core\obj_netFW\Release\DevExpress.Pdf.v22.1.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Pdf.v22.1.Drawing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f98ad5274cc55f675c60a61d74a4d213a30c00e466537ee852d75c5f390ce7c3
- MD5 ba8bacdc0334943e942fcebb93c13378
- SHA1 7fdc8a6e619e21ec2c37aaa5e0caad031ba9392f
- SHA512 e8b6f6801735a672959ac5d5067735bdcb447b0f4fcaf222fdafbf1623b733dbe30684a7f65c259d63e5ea77c04d5625c85770b1442f201d68ec8fd9711ebc79
- SSDEEP 6144:xaZV+AVlOt4JKqEucWN+AZbewWw6JpnlmEMBP6PuhMWU7ktJP7/ejvfJN85qybkd:YuAViWNNpWwGpwJ6PjW0kPC7SrY9
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
31:7e:9b:b3:15:3e:91:59:1e:2b:18:38:21:cd:7c:4a:fd:d0:6a:f0:57:6a:e8:70:ef:ad:67:fe:88:0e:95:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
509938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Pdf\DevExpress.Pdf.Drawing\obj_netFW\Release\DevExpress.Pdf.v22.1.Drawing.pdb
mscoree
_CorDllMain
Name
.text
Size
491KB
Virtual Size
490KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Pdf.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 084983a6412c967de89f28ab605197d42f682485ac73ac31e2ed1b28533cc63f
- MD5 babb2a7abc59c29d026cea7a4546e367
- SHA1 be6105d8a0fe90483725a70cab951895c8ea7121
- SHA512 3d2cfad8c21eed7a64b7059fa2527da642f8067ae7678f977cb11edee21d725548bc9614897cee549ce0d56a3acf4977585c716dde650609d3500b102d68ee63
- SSDEEP 49152:5ohQrbI7lgo4X1CjWWRagLpTHr5ZnlgC1Jl5I63UxskL0H9qY+k1Iu64Q6mDxLAx:TrbmqJkqug6mDxLAqq8n7OH2CF
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
92:0e:cf:33:fe:22:d8:ce:fa:6d:35:aa:30:f7:5f:2a:95:66:03:6b:8b:38:1d:22:eb:40:a7:50:4f:98:04:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
5138710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Pdf\DevExpress.Pdf.Core\obj.NC\DevExpress.Pdf.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Pdf.v22.2.Drawing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a694db9952459b0d2de2a390a0def2607a56ffeefda17578cd944bdb312475c9
- MD5 0bcab7de0682bd86dce65e5f8b1c9800
- SHA1 a4696ebf4d72274b333ebd6c591f299cf8d6bfa4
- SHA512 5f2b4bbb6d72a01ef4c0a2206b48b8ea2c2ce38a8efc717856a97d84d2243dacede14d5c92f88b7ec52955183d0600fe3fe238ee68d0ab4a9f609ed82cee60b7
- SSDEEP 6144:ocyLi04H7Uks+m0MX8jfvstOjEogcu3zhjVi6RMLnnMuME+HXMul0w0ehcyfuYOI:YLi0n+mufvshdVCLnMeul0WhVOoubK
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
81:39:05:2b:ff:b1:aa:1f:06:f4:64:c5:9d:a1:a6:9d:ad:d3:dc:7b:9b:dd:71:b1:6b:54:cd:be:4c:97:89:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
509370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Pdf\DevExpress.Pdf.Drawing\obj.NC\DevExpress.Pdf.v22.2.Drawing.pdb
mscoree
_CorDllMain
Name
.text
Size
490KB
Virtual Size
490KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.PivotGrid.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a5a09245a3c18574de1797547b8685f596ceccf627cf7e530b9b8cb1e43011d
- MD5 436c0f4c5641573963083c22b538347f
- SHA1 b43803120b4f0be04a63ec34a64523e1c4e4269f
- SHA512 47cc11081cc176fce26aba5d91a2b0466f5764b548beb9f1c625541816600756c427c2d030c47135ee4a890397570a7649b04d917ce55dcb1842e414b29f4b17
- SSDEEP 24576:reTWk+n6AKdrqvX+xF1pKvHtS4ZcnMx+i4SXY9B5yzMKzstw54oylwyKsCgMm0I4:6Ri65FLc8UnkL90H2oWtVgCBvhiBZ9
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
25:ab:b7:67:39:72:f5:9a:3b:df:99:51:9e:c1:0f:4d:15:da:ff:8d:24:b4:d5:2e:46:5d:b7:01:f0:b7:fa:6b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
3789826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraPivotGrid\DevExpress.PivotGrid.Core\obj.NC\DevExpress.PivotGrid.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Printing.v22.1.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e4d60cac9cacde3cab841854b4c5348df89a4e4027b62de09184a3ddbb81a5a0
- MD5 9ec835a4e269f978eeefd7fd8bd5abb0
- SHA1 e36a07167bd83d713703a84f3c2c2b8f86cd38f5
- SHA512 2a72b3615215b94d1b7fce3c9ff28042c4c02ec655e3fdc42008217979b65f39fff9cb75a35ac1426a78aa2f8c0c00354369cdb5b5df155efcde8651878de4d9
- SSDEEP 49152:F5IL6XYTD+RZdNszyVqcrcDPG+axAXVnMWoi/KpzB7JvIVj4RPbXry4b5Paod9q7:fIL6ITDDmbDmv/Nn5DXgx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4670734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraPrinting\DevExpress.Printing.Core\obj_netFW\Release\DevExpress.Printing.v22.1.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Printing.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dde47834faa880478fc40fe9e2c021886ecc532ee064b163f93136bb85495452
- MD5 5bcae5b478c6a337ef075fb96faa0a73
- SHA1 a12eaae10af305ec8bc72e7ed4c6394363a0fa31
- SHA512 986611ef4f9ffec376921b1931cb00d459e026dd0ce98a36ac42a0cd776c5e9c7625ecad372d2f9bb9df1a87e9cb447f89fee892ea22a75aa87e8ed7f79a5e6a
- SSDEEP 49152:xicYrnYm8af3DHaQsQnfJJe9kpcrgtimwr+6XVnoICktBpKB7kvIVj4/RbXru4j3:xi9rnYm88DHPnfJJP6Nn5DXgxa
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e3:d8:d1:68:97:00:51:18:62:c1:32:ef:47:c8:d8:f5:52:d5:29:99:93:24:09:3b:0c:ba:25:38:ec:8d:ec:0b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
4692474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraPrinting\DevExpress.Printing.Core\obj.NC\DevExpress.Printing.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.RichEdit.v22.1.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 078551cc3b00963dcfae8bcf69f8e926cf67234fc3c688fffccc195b4a611976
- MD5 7ddf6749688dab11c14e464684346a51
- SHA1 dc3578c283b0728052125313f59e71deabe538ab
- SHA512 0087f1e7d85ea050fb860125ed65ca425c6509c23544a776a65a6cdb614d9732f0c99ec2fcbe5c33317053f2df7f839ad420bc2581b898a08c48d183d07d44c6
- SSDEEP 98304:HPb+G1Tez+HBpnafYPTW033ZNVMBkxVz6uuRoI196q:MOZ4BaVz6pRoI19v
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
56:60:f0:ea:bb:fb:b5:d3:94:d4:76:80:c0:bd:42:27:7b:4a:68:90:41:1c:f7:12:62:07:ef:0f:55:20:b7:08
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
8786614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraRichEdit\DevExpress.RichEdit.Core\obj_netFW\Release\DevExpress.RichEdit.v22.1.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
8.4MB
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.RichEdit.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aab6a1b65130888dbd2f64be8cf4b43049f4feb28d81e66b9ea62ae379f736b0
- MD5 6d473c395d6e89b936421a6df8a10095
- SHA1 20f982e5be5f2d42f09713a28b5bff1e2a78dab6
- SHA512 4c7dde968de3f2fd0e0f811d0917be2a4f96707963306c58a5be583da176726db599c86dbe215b66374659061d96937a0b42c3fec4a8830bf654004dc1672915
- SSDEEP 98304:LI/9z6yxQRo97rvhzf/tskSkTSF/ilFWNqeucIldOfio//2:gtvRmqeuxk5/2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b6:7d:5a:a7:ef:b5:ea:58:c1:59:5d:94:1d:d6:ae:b8:4a:bc:e3:aa:60:6c:69:e6:e0:8d:1d:52:d5:1d:95:c2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
8795974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraRichEdit\DevExpress.RichEdit.Core\obj.NC\DevExpress.RichEdit.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
8.4MB
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.RichEdit.v22.2.Export.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 40ec3f329794a78585674306f6645af386d0e0cef7accf6f3ac4b9c4f8511291
- MD5 c5dee63a484b6097af15bc6c9408d732
- SHA1 c39eb387075db45afba15fbeabfd54a297132e77
- SHA512 88c80af1943a7004717907bbfccc3972d486304443dec8566abdafafa044fe074239cb819bf728c755bf28dadd05ca93c9f9d12aeeaf7e265c22d6a1864d1418
- SSDEEP 6144:sF8dBOLERSXYvZt7OmdzmO4kpwdSaLFtHASEosefoa:NOLERSXYj732Ezefoa
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e7:5d:c9:89:9f:cf:ff:9c:8d:b2:4f:48:a5:aa:ae:87:c1:31:ef:91:a1:c4:6a:2d:4c:0b:56:6b:a2:db:a2:c3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
255398
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraRichEdit\DevExpress.RichEdit.Export\obj.NC\DevExpress.RichEdit.v22.2.Export.pdb
mscoree
_CorDllMain
Name
.text
Size
241KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Sparkline.v22.1.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf03f577ecb257067abee5e7b6e49803a309231701cd07a39caa210d5c886c4c
- MD5 ba1a701a6312c167ac6f2bf407faa237
- SHA1 6d98e694e34daef743e15270b635c3dd19fc3b0f
- SHA512 d9b543a7f7c52938965878c9eaf507d0a885f9646fb709a465140f7a9f6cfe8eeaf0618fb3ca716ddf2e98199c3b35551e40d0d963e51b67c3fbe1bea04a05d2
- SSDEEP 1536:4hn/UiKYDmlc/foBSGLzyexgEEjKAZxNHumV:4RKcXeSEZglWAZxNHuq
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f7:ca:9b:92:57:c7:0e:cf:a0:76:ae:5d:dc:da:4b:ea:ba:01:c8:44:3e:7c:e0:2d:11:2d:c0:36:fb:11:77:f8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
86466
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraCharts\DevExpress.Sparkline.Core\obj_netFW\Release\DevExpress.Sparkline.v22.1.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Sparkline.v22.2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 449953a7fb470b18a37c36d321dc61a1c6bed8e039ee8415cc37315ae44f60b0
- MD5 c44b08fc1e03055ade50d0e0cd5d4b8f
- SHA1 438c65f3f3eb957c38734a449b6c92b8db0360c1
- SHA512 51106b4bdbaa5643aadfdadfb81b4fbd8abde43de8e713b210bc640c838b19946a59a1278dd65b2c809aa77d699dbe85ef276896db8677c469d2a8bcb49e5363
- SSDEEP 1536:PJaqAz759G1wgGQyDql4td73FkLcerz6EwuSscrJjixSQDPx8:PJaJ7xgCKcQarNJjixSQrx8
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7d:28:bf:bf:36:72:46:bd:de:4e:16:ac:42:52:f2:ae:d4:a1:7e:ba:4e:db:eb:03:a0:ae:4d:fa:5a:b9:be:a9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
87482
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraCharts\DevExpress.Sparkline.Core\obj.NC\DevExpress.Sparkline.v22.2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Utils.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 50cba5304bf0a620c119a610e73f545fee688462860706785db507110739a093
- MD5 07adc748684fd33a198f2dc6eea12666
- SHA1 28f62a05673447a3a347aa6a01ae8cd518126956
- SHA512 893829cb3e1a27e5cbcab9a3b7ef290b1ec74cb21fc46358f2a08a3149d54bd34258046ac47387ad5777d794478230bf2605897e7259ac7a0241dc1272e121ab
- SSDEEP 393216:7u1M1d84WAOfraPyyLic2S0eg+/4/vK0CEo:7u1Mw4WAOfraPyyLic2S0Z+/4/vKz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20965630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Utils\DevExpress.Utils\obj_netFW\Release\DevExpress.Utils.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
20.0MB
Virtual Size
20.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Utils.v22.2.UI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0eb585844ece8f0a3ce37d008723019d90f2f7e0830a2e702415f70e31e7db68
- MD5 7f3b7c8fb94ff22372586f53e1a4a043
- SHA1 d7a701541016470ad057e766eb43112c4dfd87b3
- SHA512 15f4ff575d4bb624a484ed32b335bece6e0205a33bad22c80e6fab4ae514e67cb7a9638513a6fbec811e0089c3a8f3575bd656e450a945b66ddaad6f8e155bb6
- SSDEEP 6144:vddhmcLt/Zjzp6L/QIGMSZs05X4K6xTsidwbOy+5xIETtDlfllzBIKT:vldF67NGMG4K6xeOy+9tNzBIKT
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
cc:71:9a:fb:9e:69:e4:12:1f:b6:4a:69:22:7f:74:95:92:5a:3c:3c:8a:60:9c:65:5f:ae:4d:79:64:0d:d5:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
388854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Utils.UI\obj.NCD\DevExpress.Utils.v22.2.UI.pdb
mscoree
_CorDllMain
Name
.text
Size
372KB
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Utils.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 41d5ffec69488e985e7e73865693109155f09d72c7c830d2bdad21c2815ada7f
- MD5 b7e6bcd420e084e55a03a92a0e1d4730
- SHA1 f64988f40fa0354edf6d64fe2370632a91327e2d
- SHA512 de6b4a45602cd95fea349a80027ea8fd1c62e939d8e1d0bf2af2de40452a8e5c0c054e9ca787d1cb640e812c4de8cdb8fef14aff978e73071e7d4f6e9ef3778f
- SSDEEP 393216:WFK0ZYdVE7IQWAOfraP87Xxe8okEghkDYqglQK:WFK0ZYdVWWAOfraP87Xxe8ok7hkDYqgt
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5f:e7:49:99:74:9f:c3:89:c7:83:9d:8e:d2:b2:f0:d7:af:4b:41:fa:59:dd:a8:71:9d:8f:fd:29:13:af:cf:30
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
20366882
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Utils\obj.NCD\DevExpress.Utils.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
19.4MB
Virtual Size
19.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.WinRTPresenter.Launcher.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 76a868948e5b4df73f5dab5606135f6bf10b598bdaa991737224edcb8fdd58db
- MD5 de4449ac523ac31f66efe7f090360f71
- SHA1 de7fcb8c16c7cab8255b8e31781efb0ffc45acce
- SHA512 d43021c5878f08c38264e1882313959aa51b8dabf6649a64f476f3e7c0ba7fdaaac0f3edaa6fb3ea2e56889a5e78791236c1dfe8dbcd9218d7eab30a9ee4a56c
- SSDEEP 192:CWOsh9lqaOG7Uuri11x9OFzACQS5y2VL:rOsZTVrYTORDQ7y
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\2015.1\Win\DevExpress.WinRTPresenter\DevExpress.WinRTPresenter.Launcher\obj\Debug\DevExpress.WinRTPresenter.Launcher.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.Xpo.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0d127901647a1726edd42d7ab8c58efcf853531dd5c1d1a3732c97ff4ba6fc7c
- MD5 cc89a40f8868000c23e399cef26847e7
- SHA1 828e9151a3153e73df61d608fe588fb4fcd19d58
- SHA512 63815739d3e745777534bd503d60565f8f038163f7121c65b2d6d7f9e4619337809bc4dc59a10982839f3f4a31c6dfc668986093283c68e5cb4f212252d47fc4
- SSDEEP 49152:cuXkWJbA3zWFeZfFFGJOS+/VWhYB908aPUsWa:rhJbAyFeZjiOS+/ir
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
10:2f:62:b0:4b:6b:c5:a9:bc:11:ef:3e:83:30:da:37:6e:8b:b4:25:29:b6:f3:45:fe:3f:7e:bc:42:b9:3d:fa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 6, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
2347218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.Xpo\DevExpress.Xpo\obj\NetCore\Release\netstandard2.0\DevExpress.Xpo.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraBars.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f31296a5be7c607874f4fd3e66df9d2c460edbc5c4b41ee5ce93534786310ac
- MD5 8f335dc88eb706a7b50f45a3fd308dee
- SHA1 1bcfb26b7e945fe29f40a1f2ad19c4be4d590edd
- SHA512 0d42472c287497878a08393b1b39608c0f466520b1ed9aac83fdbd25171941d40d0d0eb1012503894aaac5a5b64db7ea8d280df6d5f7afdd15490d4cee97ea00
- SSDEEP 196608:qOzxEDLbulF29jaRtWAOfraPmWAOfraP0WAOfraP:jrtWAOfraPmWAOfraP0WAOfraP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6868926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraBars\DevExpress.XtraBars\obj_netFW\Release\DevExpress.XtraBars.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
6.5MB
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraBars.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c1891a835d86e770d93f5ff1f92a404848d54fe3d54eb2055186c95a9c7bb814
- MD5 41a81b477f5e16d9ea781519b54911c8
- SHA1 1e01e454ea8485e13728e8498f48f54a03f60604
- SHA512 3da2181851371bfc85cd5eb182e56a64877318c21b94d490a4a2a64168ae3a0375569916c3bd809a462fe68f09969c1786a4936a0d3fd2ed7319479194849c4e
- SSDEEP 196608:QNGX2LV6ZOJszeWocjpn4jCZUWAOfraPGWAOfraPxWAOfraPz:8WocajCqWAOfraPGWAOfraPxWAOfraPz
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ba:0b:82:b5:7e:6b:77:93:57:ca:cf:ed:c1:17:dd:7a:dc:f0:32:c9:cd:95:47:5d:bf:92:67:c2:85:68:69:2f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
6873102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraBars\DevExpress.XtraBars\obj.NCD\DevExpress.XtraBars.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
6.5MB
Virtual Size
6.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraCharts.v22.2.Extensions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 778b8b9990fb9c1b6eb2b500b7ef23960b96840440fa970a3f9d4a234aea4079
- MD5 bd02da3ec83ac2e175d49aa8edb212a7
- SHA1 c1b030d585d4bd6b7a4e4defaba1627c9bf5ff9e
- SHA512 f04a54dac7a56ccf9cc971a8d620a1a963fd6835dd04ad56e26a31914a00522c400c9cbc5d30a19a226a270876ae00436133bf213d4abe2ab8e23cbcd963ed8e
- SSDEEP 768:evhNrp/L+jJLqwTUAt/7J1UHJyb4fPPxWEe12:ejrpT+jdqwJzMHJyb4fPPxf
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
2b:45:ed:20:5b:86:02:c6:4d:e9:92:01:f0:d1:70:95:f5:a5:f0:5f:72:1e:6c:9b:72:15:a8:c1:b7:79:9f:22
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
36062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraCharts\DevExpress.XtraCharts.Extensions\obj.NCD\DevExpress.XtraCharts.v22.2.Extensions.pdb
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraCharts.v22.2.UI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d6a8e88e385e396df4f3ac3e3a8f7e403d6033b341059ab9387fea00ed279c13
- MD5 3bdd2c5ded90280761d88cbc0d4e267e
- SHA1 30203f8e7df42a78b684ee9746efce83984520ce
- SHA512 11501ac408504adf489ab9bcd1ebfbe11dfc471189519ea8bc85222539c8cf10d64421063830fcf3117e609910bec9e9274312250b2756705bf588ce9c14a393
- SSDEEP 6144:n1OWKJKHWYze8xUJKG7iCIcccccccccccccccccccccccccccccccfcccccccccz:1CJyWY68vGpo7Z1V4Y
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8b:bb:84:b3:1f:2a:c6:87:cd:b1:a6:a5:b2:51:46:32:e1:da:3c:8c:43:f8:bc:04:7a:e3:cc:f3:3e:bd:5d:b7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
547186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraCharts\DevExpress.XtraCharts.UI\obj.NCD\DevExpress.XtraCharts.v22.2.UI.pdb
mscoree
_CorDllMain
Name
.text
Size
526KB
Virtual Size
526KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraCharts.v22.2.Wizard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a9b9fecbe6962a4ceca36642004272bad28ca07bd74b186197510d68a760b633
- MD5 3ac87db1fdc6ac83eedc9dec3a2ebc7a
- SHA1 b7658a792492c8db64efa8e2a2029797f7cd9726
- SHA512 0411fa960262f3734ebb8457776f1f8111c72523cac6ae268992c733da492855d2dce8a6d76c9a762e8d09e857938ededc56c7c759516d3840aae12c45d0ade7
- SSDEEP 49152:855RF/Y4CizvishatdgP/B8uTmC4adDRj7GbsA7OoBZM3YgTIqv7lNiELVEJVrbx:q5RFg4CizvishatdgHB8uoe7DiIxQn
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
f9:a4:fe:0f:e4:22:e1:9c:4f:40:9c:1e:76:e5:1c:a3:14:0e:7f:77:dc:69:41:82:d4:88:45:6c:89:e4:59:09
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
7281482
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraCharts\DevExpress.XtraCharts.Wizard\obj.NCD\DevExpress.XtraCharts.v22.2.Wizard.pdb
mscoree
_CorDllMain
Name
.text
Size
6.9MB
Virtual Size
6.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraCharts.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 009e918376f7e8fd3c12f2e08d54b4103604b8964f908b57e6958e964334aa8c
- MD5 01458f2c74ec100abc65141f566ed6f1
- SHA1 2ec429231c515751b7a9ba5773bdb9455886f10a
- SHA512 feb97231934a069aa574e8c26a15d164e4615e691eff5b89465911f4db9ea34b1974d82c689d17e393abbb4047278facf73b6d1982a10f964577ecb04c722a0f
- SSDEEP 49152:sV2Oc/rpakg7jG+HBf/cEzC4o2TwmsrYzjhRlfBE3zpeb5QYhZt/btkUEn0lKm+j:snXCSBmslKm+fL
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
70:b7:b1:ea:35:0b:32:44:98:b1:c3:c3:d6:36:52:93:25:c4:7e:42:f6:ff:27:98:38:5e:4b:6e:70:0c:19:a8
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
5192342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraCharts\DevExpress.XtraCharts\obj.NC\DevExpress.XtraCharts.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraDiagram.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9b26bb8085e61617df650b90a85ef7f35afd379a52c50864b739184db100397d
- MD5 1543e261d09538b5dd5f36fd514f588f
- SHA1 f59c52d03b38c473361b356e21779b1a7f0297fd
- SHA512 349ac0a9c298685c3e56dc987b6bc91c29c4c9119a0e7710e1a72240a8fea6a7a1dcc5c48500a1be4dfb9123345011f7b63410ee1c4a00cdf44033a2d43c2dce
- SSDEEP 24576:l13OihCvbO1yAiewr5SebmroKYoYKYHIAO9A5OaP6Z0+xs1TcCyJ2R0L5k:l1eoCv61gUroKYoYKwO9A5OaP6Z0+xIh
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
52:14:56:08:6e:7f:6f:96:06:42:35:e6:3d:16:ae:24:cc:88:34:81:73:76:ef:0d:1b:6d:4b:c8:89:27:32:04
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1351302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraDiagram\DevExpress.XtraDiagram\obj.NCD\DevExpress.XtraDiagram.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraDialogs.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e4251a0e6c50c79009cb369586625d708602a8e432fe153a410e4cb2c804c60f
- MD5 4516359eaaff4511e7fb8a8f8a60de3f
- SHA1 af7f7f51cc582e693d50a1142a66f1a3a95e0c32
- SHA512 3d2e8c37d916f40c8ca3a1947544274309e469f9d46e94b37e0e885bc9ede8b879c1c32c27e56540f9ec8124bb3649ff5c830d4591c86efcefe1794d1d5aaed3
- SSDEEP 12288:PjiyBErANYE3klr5RAG4/W+8m4LL3sKHd:PjhB9Z0MJ/Wl
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9f:2d:3b:ba:cf:12:e7:b4:24:95:b9:65:13:4f:1a:de:3b:f8:b6:76:47:c7:1d:ee:a7:3b:44:70:0b:69:9f:2a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
919866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraDialogs\DevExpress.XtraDialogs\obj.NCD\DevExpress.XtraDialogs.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
890KB
Virtual Size
890KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraEditors.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fc4e229d2237af90eb1b76205b543098ee958cbc7558d7a6dab41b5210fdaef5
- MD5 9a4fa4e33d64f44451fc4223a5616355
- SHA1 124caceb4e82537403a4b5e9b21487c369b69559
- SHA512 869b25aa356a957ba361b4fcc1b3aa8363e7bd23a577538f904995ebaebb8a249398e35cf381f5ba06baed95c8dd3e5d6e3aea8efe5ac8e48ca2482c9d549bf9
- SSDEEP 98304:z6wGqxIwcrDMb9VcoXceu4arFZ+DY8kpV:2wGqxIFr4b9VJkf8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8092326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraEditors\DevExpress.XtraEditors\obj_netFW\Release\DevExpress.XtraEditors.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
7.7MB
Virtual Size
7.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraEditors.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e5d66bc5e6fd1d51ea480e31c9698437ebb2107b6b348d39c4e78634e121455a
- MD5 fdf81d98c172a0ccdd1d2170bac9aaca
- SHA1 cd06bb43d0f4a926c273b0c1c07c5789a0a90632
- SHA512 3aeddb4d05428e0f4a18ad0be3d5accf413b70e80cce6dadfd02c54405c7baeda82a3f044bcbad194444c31ae172f1a4f6b90249474fd7aeaa7cffade7c06e1e
- SSDEEP 98304:AGs0g123XlPXkQDM4cvDXqi/FIkqCWbHA1EtP4vnk4uqy5KtGbOBXLHHDY8kpVz:k0geXlPXFji/NA444vnk4uEKOJLH884
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
71:3d:d2:bb:2b:f1:46:34:1c:40:70:d2:e7:96:55:cb:e4:d0:97:81:65:2c:52:0a:83:f5:69:3f:d0:3c:13:d6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
8108130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraEditors\DevExpress.XtraEditors\obj.NCD\DevExpress.XtraEditors.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
7.7MB
Virtual Size
7.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraGrid.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ae22e7bebe5c4b59363c5980940c64608d1a35c6b5026e0e088605132187c8da
- MD5 8478f5aa3de612bd2cf5e9356688d0f3
- SHA1 84103d2abee8976dcaac172bcb9e064dfd06a890
- SHA512 d0f3cbf8144c733266e05b2513603f5b44bf6fa359bbff86c3d437e022ef1d6451ce7b3f335d116438346aeb3d93bc5a82a6a548a7b1795f72991112abe6750f
- SSDEEP 49152:E3V4oYwryT+upD8l23GW6Ed5qCXlo+/rqGQN:EXYwry6up3Gu5qI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3759542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraGrid\DevExpress.XtraGrid\obj_netFW\Release\DevExpress.XtraGrid.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraGrid.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f93f749d210a194dcc682d0b0aee7fde7cf8a10eb67312d6e8cd644412493323
- MD5 8adc329d03f8d95b220ae66d2380f6bf
- SHA1 10848f1127ea9d0fbf36d3056b9c70d0e2b064bf
- SHA512 19a237ebd2e86ee623f51e46d979b89f7c6a3cb3edbc08aa62d36f79c931a64e2282893c7e31e24a1de5fadc7159ffe4ff8ba79978573295138cf62939601688
- SSDEEP 49152:atP5dYwhpAw2RI7gm9o3SsqaWCRYG3g6jzacNN:A5SIE8aWw
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b0:98:5a:1c:ca:79:eb:99:a3:16:eb:d6:fe:22:e0:bd:00:6c:f3:49:43:48:12:9a:25:2d:a9:6f:8d:43:f7:2c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
3745446
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraGrid\DevExpress.XtraGrid\obj.NCD\DevExpress.XtraGrid.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraLayout.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e6e670bf76dc46e959f74b09d3c6e614b2121975456b00041e32bd7f5001253f
- MD5 45d8d7bd5e30d8b5da44f6a60e331c87
- SHA1 301d5dc4a8a1141234559df872ce219c1c7efccb
- SHA512 23b303f287e0b77d221e8cd24cf2933d4976e9b61dfc9bd03c9f365d44988a0a7ce2e81366466dcdff981931099964ebc04293de2de039e0322eed9ac911291b
- SSDEEP 24576:MLoM74ixRQHBoxT5Ig2o4ZSYlbkpcX0H1bwaetzI2pn:N6xWoxT5Ig2o4Z/Jaetz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2147106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraLayout\DevExpress.XtraLayout\obj_netFW\Release\DevExpress.XtraLayout.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraLayout.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d06e880b5f969b29b48ebe058953dee6fab499e4bfbfde560ae5793b4680770
- MD5 d0a87092415321f75bbfada6c088c80c
- SHA1 1483464121f925d8120e0c894d9c64ab63149ee1
- SHA512 9a68b122768fb32cf7a5eb7781780c7f66733af7e92f83657c7383c2c0163785b24aa3f0ca090416f70a66fc3685fabdd6a3861cb02aaaae737bf3fb9230424e
- SSDEEP 24576:o+fwyNVEz+XJegdVJYLPraI56Vpyc/kZ8tuqOVAetdEdzGyf:NwyLXRozraIgl/csuqwAetd4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ed:c2:d8:00:43:4f:eb:0f:e7:ae:d6:31:57:54:c9:85:5e:d6:13:61:bc:d4:7f:6e:61:5c:43:a8:08:d0:35:63
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
2148894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraLayout\DevExpress.XtraLayout\obj.NCD\DevExpress.XtraLayout.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraNavBar.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 466fa524cd3442ce42f2e7043c2c371ba415837e4fb81bf6a58b711e9ac10bc3
- MD5 f48ce9692618c7641c4f25d32a424a7d
- SHA1 9b3cef2da5e47f4239bb8fe922dabfcbe23054d8
- SHA512 74aa6d3e3dcd86e17a807e80a57d65278e2b625e39339eb659cba42dd280ee9129a48ddd0db6c0d73ce17a0526412c78020c8bdc7a5d4e2c05a72b70f1d6ee60
- SSDEEP 6144:YtyYmJe2vafX3v8wYJwd5jXYr0VFAeNP//jZKnB/bLDWAOfraPEoa7:YwJejvvtJ/jYBLDWAOfraPEoa7
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
fb:90:9c:f1:b1:d9:ce:f6:c8:1a:c7:44:b6:f8:26:3b:90:2e:60:5d:2b:ea:dc:d6:c1:64:af:5a:45:af:02:48
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
440910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraNavBar\DevExpress.XtraNavBar\obj.NCD\DevExpress.XtraNavBar.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
423KB
Virtual Size
422KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraPivotGrid.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e0063ceb0e5e30b93193d196182279c33a0d32402d1545c26cfdd8ce05bd88b8
- MD5 6beb8d993107cfd05041929737d1310c
- SHA1 55c80c0e4905b3f90b319d6bd700fe84a3583617
- SHA512 7195c600be8845a4a6e80cfd1d082b60b6e69e97a74231df8b970fb5fa60b792b070c840d06c34db6434386121873e267caaf0e541b06f8bda6d8014d08e9c94
- SSDEEP 12288:kyJKRjy+7WoZm3bS/kS1ciAgbewixdrJvBv4Ci/0hsmpXsEk:kyE3/mchFiwixdFBNfpXS
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1a:ff:e2:b2:d7:72:41:76:8a:9e:20:d9:7e:51:d1:55:87:d6:99:10:0a:8c:cf:b8:37:7b:0b:db:3a:9b:50:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
911342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraPivotGrid\DevExpress.XtraPivotGrid\obj.NCD\DevExpress.XtraPivotGrid.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
882KB
Virtual Size
882KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraPrinting.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a361dae0ce4896e3303f0814c6bf5cbb6779dc40eb438ebc6382c8c6b7b84614
- MD5 bc099d2cbb3a85f8b4d8f848241e59b2
- SHA1 d2f1dbb214161f3fcc0e3967ecb4ca235b87e10c
- SHA512 87d0ff2ad4ee2120c939a31619635ca7618fcc54e00ba215a5de057dc61d64caef5e66af4263490f83e5b14f5848d076d5b03b313ff6de77988577b5b9a3de5a
- SSDEEP 12288:ocXVO0aVSCR4H4McnEid11/ct8+gWYEijHfpNdbXDBmknWgtaAS3Xpj1:ocXD0oZgO+HfpNdokWgtaAC11
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
dd:4c:8c:bb:42:a0:0b:4e:fe:dd:e3:d0:16:6d:de:26:6a:05:5b:5d:ba:36:0a:f2:5f:d2:15:47:0f:76:42:64
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1120390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraPrinting\DevExpress.XtraPrinting\obj_netFW\Release\DevExpress.XtraPrinting.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraPrinting.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a4070f7fa8ce0877bcb690c43ff78c4a9b51fe628fdce68834fe84b2cea1bf18
- MD5 b71e8518bfcd69de0410cc8b8191c5ca
- SHA1 e988b3fdfdf50e3fba5bf8f2e725329612a581ac
- SHA512 efbb2f31ed3e20f97022cab35294fc63bcffa642e80ca8ddb9b4a4b633a59e7d91bf6b0c7ec2dde84061358e7307a7c18a5ac802a759baef3b75526b6faf5142
- SSDEEP 12288:WjQ6In4cbOKFjGf2lfoEorIC//FVcZgnAuZ+LxqjSMiWBxK:WQ4ciocwfUsCwCAuZ+LEXPK
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
1b:ee:ee:5c:54:34:3f:19:12:f4:07:48:88:87:98:cc:8b:8c:01:3d:94:33:9a:8d:ea:cb:80:a8:5e:09:e9:ad
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1014770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraPrinting\DevExpress.XtraPrinting\obj.NCD\DevExpress.XtraPrinting.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
983KB
Virtual Size
983KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraRichEdit.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8a891d4cde599dfb4d21556690dd7233b17d24442ae59e0eb704bbca46f0b68a
- MD5 4d702be37811ae34bd6de94d71ab9e95
- SHA1 7cbaae67d844dbee29e885c8be42938a7a8e05cb
- SHA512 d12b6a25a12758b182a4a496d0c183f45c38f0a0c5fcc66759f4ea1688eefe906cfb2a8b8d72956dd94eca6b27b3de73ba3f4ca7ddbed81ba28555059c2cf03d
- SSDEEP 24576:/gg8byhG+YrQS4mCKk7y9KTUETPFAIvYLAVV2ee12GRgJd2qFPoIdecNNgra8nYt:/gHbyhJYv4lV7ZTj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b5:28:a9:f8:eb:06:9b:9f:ed:98:d0:f6:48:d8:64:02:a0:a6:e3:b7:7e:29:8a:9e:ca:66:90:13:8e:c3:29:ee
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
3074330
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraRichEdit\DevExpress.XtraRichEdit\obj_netFW\Release\DevExpress.XtraRichEdit.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraRichEdit.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 54a3de6ff3f4a2b347c6f860467a3d1eda7ac2abbfa585597592161ee6a725fb
- MD5 82e7e741729f1e4f40dde95a491e61fd
- SHA1 08c71d302e8d9ed945d7e39cef3884d8f0eea474
- SHA512 6d1d5c026af295767f74942f55b9c39ef9db78f5967715dddfa47ff70d768ef2532340c6a1f20ab80df1a95c547b916115bb7468226feaf39c7f9c1cfbbf1066
- SSDEEP 24576:/8aO8jHGUNeFr37FLmgY7DIvYLAFLl6SmHAjePlB1wNX23GVeQzAEw10pXt:/8aO8jGmOrraRM
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
03:02:cb:fb:24:82:ff:2d:94:cb:d3:c6:8c:56:bc:e4:a9:4c:4c:c2:ed:df:ac:f4:94:55:bd:3d:9b:18:85:21
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
2614990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraRichEdit\DevExpress.XtraRichEdit\obj.NCD\DevExpress.XtraRichEdit.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraTreeList.v22.1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b611389621a70130b62c0248a822f691984d0724c5897a39f0c82ce9814d11dd
- MD5 b92b3fbc94c954f3e2277c2bc14d385b
- SHA1 c4cbb96da577b04ae3275871235da450e8fc1b50
- SHA512 7e5737b1727684cd91719db9d86b4d1bf011834610346a081ec0bb20c4935b44f64870d138d3d6fa5910cece3835cb1c388431ee49fe522f57c3ab86b4f00121
- SSDEEP 24576:JYPOiR0q2llOGk74S0BfruAuKHZ4gjstK1Tnnw/butE6Ep:JwiAn7AH70r
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
79:27:da:fc:a3:52:8f:21:9f:91:66:8d:c0:6e:29:75:b1:68:85:5e:7a:e1:c0:4b:b7:45:5a:30:37:5b:3e:6c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Jul 26, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 9, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1650682
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraTreeList\DevExpress.XtraTreeList\obj_netFW\Release\DevExpress.XtraTreeList.v22.1.pdb
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraTreeList.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 abc1802219835da3ad98ee4e49ebb145b481be7c2a907f855c4c5b0578f40fb1
- MD5 02d9a1832664503293f9dbe52799c2a1
- SHA1 df01ac30ec9c8f862892789a0ce5e18ef701ad42
- SHA512 3b61c9c8a94d98970de216ec13ee9b9bbcec4c1616fd1d34acac53c67da16c72e492d868ab78e435faf78ab50e81dcf3c7496ca73e26d3818529c3a36977ae9e
- SSDEEP 24576:pztZ9L9lx1QgLB2DhYmEtMRw8Wr0e3mA7VpP1VE/:DfrlLa
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
96:b7:cc:2b:6f:fb:1e:8e:85:bb:59:95:23:a9:29:4d:22:e8:23:a9:71:2d:c7:99:fb:62:b3:b6:8b:b7:e6:23
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1648202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraTreeList\DevExpress.XtraTreeList\obj.NCD\DevExpress.XtraTreeList.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraVerticalGrid.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 75ddcc73312ab86853f49c4a74a96be3039542dd9aa388f364b008f1b67846bc
- MD5 c514f1fd0b63ba9ba1179378f8247d0a
- SHA1 37ef0902ad8e7d5b830a6f6ae7536dbe769c56cf
- SHA512 f667e584923ebb5754067fdae6edbb550b0a1d8c0c4b36a2b5c8dbfd80448538bd764cd9db0279a67cdc37ed2b9569d25726c4773c1be32fff6d54e5d2f8fa41
- SSDEEP 24576:yaxQP+r1AmqMGhMaz5Gb6tIt3FzJeZzXP:EJqt3Fz2P
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
81:80:87:01:9f:d1:fe:b0:1c:7e:9f:e1:2c:cd:51:9f:03:bd:d9:73:38:2c:89:1b:3c:79:76:5c:3f:dd:71:d0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
1268338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraVerticalGrid\DevExpress.XtraVerticalGrid\obj.NCD\DevExpress.XtraVerticalGrid.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DevExpress.XtraWizard.v22.2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1851bb8ecced0f713c2cf7e6c9f1df5f5d437ff5e0804b66042341815a528fc
- MD5 807e09981b3490876380f6e757ea50a2
- SHA1 3f9832ce40f7be136b0aa79fbd26b7b3b2e2d26e
- SHA512 9e571194245b74b3318b75c990767507efda2d901786e1e1476d15adc989ef0d883e571dac81f60ed940b872082aacca790aa98c3dd1532770d18b9448bcfdb0
- SSDEEP 1536:k2HldTXPaxMADDb2noj+iOykAxTmXyd86/2EZR7Hqk0JGcRRPx9G:BLaWGn2Y+iOyfTmXydPu0qRJzRVxM
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
7d:c2:06:44:cf:ae:66:4f:34:09:f3:e7:79:58:94:7c:31:fb:be:19:65:a8:59:c1:0b:a4:9d:fe:91:72:b1:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Chains
Dec 7, 2022
Subject
CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US
Serial Number
47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Issuer
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 15, 2020 - Jan 20, 2023
Subject
CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US
Serial Number
71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
101094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Win\DevExpress.XtraWizard\DevExpress.XtraWizard\obj.NCD\DevExpress.XtraWizard.v22.2.pdb
mscoree
_CorDllMain
Name
.text
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/DotNetZip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3
- MD5 a999d7f3807564cc816c16f862a60bbe
- SHA1 1ee724daaf70c6b0083bf589674b6f6d8427544f
- SHA512 6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414
- SSDEEP 6144:DuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:3QL32ikCaUS4csRBse6sfW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
465934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb
mscoree
_CorDllMain
Name
.text
Size
459KB
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
336350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
320KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Home - blankhack.url
- SHA256 55dfe247f8fd6a8b0b66b3cb61feeae96d0b357338cd95771e89897aac1a6839
- MD5 4a4418c24d2f2a9deee8046363bdd28f
- SHA1 4532c81bb5e66e2f976581a6cb251ab642ada551
- SHA512 b6f01a2b8333dc1926a829271a557ed99f6a69bef5fbc9c32231da11089ef1190981f7ad5de377a6b928988609bee38322b6b4e0e9cfb813e98f7a807b062764
- MD5 SHA1 SHA512
VenomRAT_v6.0.3/Home - cybergoons.url
- SHA256 59ac2d12ea4559253fa25f2d367f75b7689bb7b772965101903063f646ae9b4d
- MD5 ef51820e228c5bbcf9aabe92e747782e
- SHA1 b33c7c782205e69471257703f6cb70b1357ce474
- SHA512 3d2e8ce0d822636ce3a78edf63d4935638446a9bd0eff88e85daeab4d6be00f10d32a9f74afa11af56fbefaebb7534a64339a2de3f416cc0c670122bc5b9abd9
- MD5 SHA1 SHA512
VenomRAT_v6.0.3/IP2Region.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b0c2a6951dae794c210fbe68d7f42081e5da0f7cbb926cf986c3d453f9920f37
- MD5 cd5a0b0d309fd5837ddacbf4c1a65cda
- SHA1 65fbc931f4ba8c5e3b26719665ee9ea6015f402c
- SHA512 84e4e1aa3f6c3014b39b0ac0da3db41e086dfab4e7d38a154f0ff2d0c65bae87039175e54cf950a57f21f5c56c19a62d6f98b2143f14a21d743867a2b37243aa
- SSDEEP 192:6ITtdNU7r6Au3QI7iPxM02ec5puRpZd7awXJPhbUIx9fwiwMH17Gv2u0lXkV/+ft:6BrZe7sM0Q5puRJTn5wiwMV7t/ftVl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\GitHub\ip2region\binding\c#\IP2Region\obj\Release\net46\IP2Region.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Keylogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b2a992052d32a5b9d3702350b133289b45a8d209acd0161d9c3b0bc6fd702b3c
- MD5 b8607b7921cd9cba78058fcb56bcfb9d
- SHA1 1344f12ff7e23122b62fcc7f3be548c73d3c3efd
- SHA512 dd36040e57f2744437684e257caac0987a90deac0a60536f1cb8d690e256505d427931a3beb8d58f87c2c1bf5beb0a40c4b09417c451a07e5856044efbac1449
- SSDEEP 96:c+B5YocCSrXU1k1YhsadP1LH9xvXh3D6IQE6yonbMpGtzIon7CKe8m7zeQzNt:ZB5YgOd1Yh9dtnXh3D6/QAzn7f5m7Cy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15486
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\28718\source\repos\WindowsFormsApp3\obj\Release\Keylogger.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/MessagePackLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 669e42b6c6e94dc2735f281aa5b33c0d398b91960158ec556e521974b3be5843
- MD5 06247396be54c6ebb06fd6ca84ee80cc
- SHA1 51fb23ff498a47c0be900ae43a7030f98794eb59
- SHA512 03d93f22aaf1bc0dc4d26b130aa1cb1668c14b854ff84803c8b2cc74625cda44970dd5be1b17865986eabb6966a7d65c226282becfd7963b72b8035990ffc299
- SSDEEP 384:MmsTuBHbisehGr8LuUaBRWAHQLGS4EIp:n+uhvHaAwCxv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22450
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\MessagePack\bin\Release\MessagePackLib.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Microsoft.Win32.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5eaa2e82a26b0b302280d08f54dc9da25165dd0e286be52440a271285d63f695
- MD5 76b8d417c2f6416fa81eacc45977cea2
- SHA1 7b249c6390dfc90ef33f9a697174e363080091ef
- SHA512 3b510cdc45c94be383c91687c2cb01a501ba34e3fbb66346214fc576d6f0e63c77d1d09c6419fc907f5b083387a7046c0670377ad2e00c3ec2e731275739f9c7
- SSDEEP 384:/N9VWhX3WsQBm0GftpBjvmaQHRN7YlgaGn7rJd0:1GmViYL0Gff0
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
62:33:0e:4a:80:b0:fd:cc:2d:11:aa:19:f3:99:ee:10:47:c8:57:69:6d:7f:a7:46:07:49:d4:bd:8b:fe:c6:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 16, 2024
PE Signature issue
Digest
76:25:1b:cf:c6:bd:95:e2:68:2c:e3:7b:0a:8d:2d:17:11:85:d7:4d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 13, 2017
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
10406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\582\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.3.0\Microsoft.Win32.Primitives.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
- MD5 715a1fbee4665e99e859eda667fe8034
- SHA1 e13c6e4210043c4976dcdc447ea2b32854f70cc6
- SHA512 bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
- SSDEEP 12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3a:57:8c:7c:68:8b:18:66:50:3e:ca:01:8e:c9:25:ce:98:4d:c3:92:f9:6d:09:57:64:2e:4c:79:0e:24:5a:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 24, 2022
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704522
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/PeNet.Asn1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0abc6f616481c2bdbb3e982341f021e471ee088e8eeb8c4f415cb439d22d7d03
- MD5 5cfadd5ec612b4b36cdf18eaa1554dc1
- SHA1 8417c2bd434bcd9eadcdbdb75c852459e0b9e819
- SHA512 4854ae800af037b5fdeeebc013997190d76a0f84274de4f79f2c7632d4b0225aee889ab1e0cbc349d1f9b4f3c10b7da6b418558db582ff8884f32970f114fd03
- SSDEEP 768:FLGjBy25KKDuLYVHz8bj94bvsvL6HrgfcWIAgqgZD:lGjBy25KKlVH2q4vL6LgfKAyR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/Users/hausi/repos/PeNet.Asn1/src/PeNet.Asn1/obj/Debug/net461/PeNet.Asn1.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/PeNet.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fb83efd9af58d7149629437514d64a936de8ea5979693e65220ddcae908b03eb
- MD5 3053c9351218a87a6e03b48f475ff548
- SHA1 5f673de5f302ba1aceea63e0eeff87f923feb66f
- SHA512 b08ddc3ba79ca168d81fe9591baa9cdf4ded8f91e41072142e4bf9640bca20f891159733071f18f292ffbbd90e659dde80f19d7cf8b2eee221a523207e8500d7
- SSDEEP 3072:jGsKf51Chv6dJIG7GPs8G3/7of+zIw6tH+Ac1DHhn7R:Cdf5kQSG7GkRrIr87
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
198190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\src\PeNet\obj\Release\netstandard2\PeNet.pdb
mscoree
_CorDllMain
Name
.text
Size
186KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Audio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 158e664b0976c0ae9594d7f57ff44ba298ca50dcf43fcdb76df5ff1893537800
- MD5 c16fccda2cdcf374df662c8035ed287c
- SHA1 ed32b20dde3c884d80eab36a7096fbcb9432fbeb
- SHA512 50a8b94b4089f59113a92033f685aa8037131d96423d412b53326a1c9f46529654e0776858977aae1448b4be3b16cd83c9eda5cf5352464a156f2343ff7c5480
- SSDEEP 384:f+Oj1/WmR3sAAzI+6PpdsehGvfsCDzufBRApQRPhOJWBpJEwFPNmc3/TbpKAOJVO:f+Oj15VsAAyR0rQTRkJWBpJEwpX3/TbD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Audio.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Discord.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 84c4a1f90507955ce9ff3e8c260bbacdb57b4d230853d2fe1379fdbc98938c7b
- MD5 7a9892f86badfa7560fd9182a775fb73
- SHA1 4ac58c122bdf7ad51e3ba8ff6151b545a258ec34
- SHA512 6b646d83011444972c8b9b38f886035d4bef498d40299ebc3f80da1fc7b3d3b02fbdff1fb355574059f1a6309ebaeeba7aa8f7aa26c99b7452bcaa1ad04259ec
- SSDEEP 384:Z2+6IXW/pSma0QN9KG5+TFm/tvdeBdsehGEDh+JaL6EpBRfgVuc5FocVtlyGRzCW:lQba0f2ec0jpUB5Fdtly9rzFE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Discord.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 42b16d214b9336027c3e854c119739fac4cceac6e91045f69d1db18144b538bd
- MD5 f5bf218ad015cae03530be7c8f0868a9
- SHA1 d47c3936fded28dd4330f1aac7881d8bb17a1d02
- SHA512 a6c5a0cf8834de88b8df202c94de30521af3e7f8edfa213e896dac1c03096faa128fa38555bd9683d3d5819cdd34572f7cf061b9f841b823e13db9325cb5f090
- SSDEEP 768:VkAk+7J8jc7uRXkV4FA9K7xv5x9SXtjnU1:Vkk0RSrav5yJU1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Extra.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b2417948b649d6575597e82c87903a83b0d575776180b5aa3f4c2fb03504b488
- MD5 5d429feae7e6513205802ccdd0012a90
- SHA1 0262c5caa56e33af56ac1e2799bfe9fd5f4f5977
- SHA512 db865c7262330818682e3d6a011e07ff6b79c70ba3507e1206cbf2b88b9d9e4bbf888384b71ce27993296c21f2a883aa8de6f435aaf9a7a8a6e8a2c80720b468
- SSDEEP 768:R7lEH9lRd3TyXSyXqOsEi0ldlxyAl2dFFQGZsX:ROdx3mX1JlldlxyAl2dFFQG6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\FileManager.pdb
mscoree
_CorDllMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 05ee33a9f85545c43fbab3443751cdd0b151147f4665cfd3a661bae610b8e6b0
- MD5 965f3d108d5995ba6214b32ce416d669
- SHA1 3c2c219e053b3a692e37a59cd28db702da2af8d9
- SHA512 f6d041219f5f5f1ee270812e5b4565465ce7c245636661d296a4dbd93b672bf1c3eaff890f84766c8f6b81ca14d5680e9bf8ed0c8a470018733c38dcb3897753
- SSDEEP 3072:+IIeD5QBSGRv0tdyVTQ30guyTOvqxdVs5Tccc9k1v4IWcSCSLeyYcEeI/KQ73Wmw:+MH0Y+vM649k1oeoXuciK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\FileSearcher.pdb
mscoree
_CorDllMain
Name
.text
Size
276KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1aacbe29bc2ba2fa3b23e632ba4d0f31b21d9b7517230af75b943eed06e42c10
- MD5 6498fbaa8d0f46e9cc7eb5350db0d226
- SHA1 2b6502e636cf3a307fdd9417c33215e95fe133ce
- SHA512 3df2476cff49da2e322693ff5751d8cbbbffa03e063e9a74b3141e95f99e03a6ddc84d4ded4d2bd28937135e73615f6b9d810741a864d196c7aab4089d744c6e
- SSDEEP 384:BfiWoJk2+a5WVmbscgZEur8zQdsehG0jR5uhimwya1VABRvh340wZ/pmphJc3jEj:Ba7JLn5WMf2QQlF5rVAbho0spr/Ql
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/HVNCStub.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b4bd45ceed51bd8242575be1a804c96bde28e23603e29517ab87ad2fb21ecbc3
- MD5 7aacab605cde7921393717a7e8166dc5
- SHA1 ee682cadb9ff61e752a20bd1a58bd415a9ed0c70
- SHA512 e1bb3c39094e550a0e92f0ad678d078594f7ae8a06941574415444a900b8179bf2073035f5bc7e834d8aa8f06cc12aa0b325b0718e8ba9f5acbb3fcc3be11e16
- SSDEEP 3072:3BPNu96ehbigCW5wPNu96ehbigCW5qi5ey+yC:3Bo9DbiTWqo9DbiTWEfl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
107790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\HVNCStub.pdb
mscoree
_CorDllMain
Name
.text
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Information.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7e5626e056b7cc14515f9736ff02f7d102f585f256da388c650900ed333455f
- MD5 09659d665bef5d2b13064ddbadbf9c3a
- SHA1 0bcf0c1a8d83ed569eeb78e61e1977f39c76a304
- SHA512 5c5e7ad42240d05c4dfdccf2eaf3f34a25a5bc40e06194a7224c28036d5031161f724846785919a7a0824b5709014af0cdaff70f62d7518dbdd712015a890937
- SSDEEP 384:qQjmkkoJimLOZdsehGrjhDYLuqInXxoBRrMcBjZLlhPU:9akkoJTyZkqInCfXBjvhPU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Information.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Keylogger.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b0df63466dd20c4f860263eafba2feb255bf31ea43264a142f8e9010b27d016c
- MD5 b891f6eac297cc501c01687a041e2ca5
- SHA1 2dd0748b0952dc7d73943f0b24f5036a2773bf24
- SHA512 d525c84a2ab967d65c5538aa46c0a126221582c820bde9c101105f27ea8d0c819161a1764872bb6e469c07bc2f53003e7a453e518ffa59aaa919370687bd90a6
- SSDEEP 384:A4MtOoYttncuYsLhH3dF5L18GEP8Tx/NoE:qEbtQO5LS/P8Tx/n
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18522
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Keylogger.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Keylogger.exe.config
- SHA256 68cbb1295389a1bd6b830debfd0a8bb0a88bee2522304f5894c710912021194c
- MD5 8810b832f11b6e5a1afab929618059f2
- SHA1 5e198d58851231b69595a5800739f06b875cca3d
- SHA512 b7ff97e5be1a9585a53a570445f25070e2124f3a8d8eed760dc062ca41a9828dc7e3a53136faf68673cabedfc8512cc02333ec5556c62050232f9be8e8337b64
- MD5 SHA1 SHA512
VenomRAT_v6.0.3/Plugins/Logger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e7a9d37812c43e9d557f509f1d240bc3d3b0732d2b951606e0260a7de66130e3
- MD5 c8508a8572731ab5ad12642fb866cf20
- SHA1 1d919365597a4e6799dec2308686391bd378f484
- SHA512 8c22c9a0cac8c2d3675d553c1cc3ab504005f759346801c98e795de4eb89667d8c9cf76417e60740a15b5a5b745485136d99ecc7c582294d12adad227265ecab
- SSDEEP 384:ciGo2+alb//mJLf5SFyBdsehG8e+hDaI+RZBR8a446j2ScDWwvhwBFd:ciGoEuZxZBjVGw46j5b6wbd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Logger.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 329937d550d1f28c77dc26c45b97dd701565a58d1f60f7e3a35790c4cf87b9d7
- MD5 d7d72ad5575c1b8ad9b6c170ca2ba53b
- SHA1 51e0d8f952f22a29f92c2c37dacebc8b46e9cc4e
- SHA512 4838176ee94e1d7643eecbae46dd57bb7d8c264ec127ff0b4443186893c17854158d1576645bf2a7d5bff3f2cb5e91a5c5242e5f236b6ed8c2e18f1ecaf2d1e5
- SSDEEP 1536:UfcvW8lMJ36WbolgVe5JnUs3O4PyamuD5KLbyywITRZcUnoKk:Ufcv4qWcqVep3O4Pya/sbyywITRZcUn8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
90302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Miscellaneous.pdb
mscoree
_CorDllMain
Name
.text
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e06ec5cfd60b3312796135820cba9d230a780aef97fdc0f8da6207e8c8e5e000
- MD5 016439dfdeab850df3845ec000f48eeb
- SHA1 84d88f7ddd216365aae2f44806caf1f52427309d
- SHA512 c671c70f25883e5cb25266628947f3c04d7054fb916ac72c39a759b4ec15e3b51008604b3554779a8dd25ab318ae369980e9a5cead22fa88151350cf153e32c0
- SSDEEP 384:qEPYiWmPHmWSNnneMHPwfssC0odsehGmhzReDmYu/BRLJ+0ZB9iMNUVIt+AH:qZiTG5Nn14pAaqHFB9iDo+AH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 759453183cb7b6e64ff834b3f6643fd5e8b8f2ee826d662871ad417097bc16af
- MD5 6d598f254cd76db5b465d8a5d6244c96
- SHA1 a8b716c7bdab3b5ddba5f06d66462cde2654d961
- SHA512 8de61efac210139fe8839be69772ffdb83e8913ed26c3fbc93270f3ec3270b1ba392d5612416459aa7563957f663669248b15a773dbe6696746827d0b8076597
- SSDEEP 6144:wLEsb4D05mkOnVN6N68fKk9/FiKRcztasuG/JrI7sitpwoTa:NgA16w21rexdiG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
393702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
376KB
Virtual Size
376KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d664a79caa45f63a3729c25859eeaf11d7692866c9438316ff3443b754c9d86c
- MD5 85ad68e55dfe03e679b650e2a689b905
- SHA1 172c79f1006223e130e63ff7370d9dda01c3a87f
- SHA512 672cc61423b79b96cfb97ca83ec9f379666fbb9003c6105d170b89d7da85da443d064624421de4da6112746d240d709f7af7a696b64be8fafaaf83c8402ea0df
- SSDEEP 384:bL3RGwZcsum1T39T9JZNAgSkguRvhCE/dsehGqG6ZDWl9UZ5QDB/BRiqFujdZ8Uh:bL3AJQ1L9BKSvhjXO45Z8UXPd/JBD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31626
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\ProcessManager.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bea19e2dece602ced1d3df8c825a993f3d412c2a4d4d87eaa39f44ba4fb39e82
- MD5 cdb0f455ed9d8243479d84930016b594
- SHA1 e49842ddd267c8f0731090f56c16878564a1c196
- SHA512 ba5bab867d6ae8a20c9c20f9203a3cb348a0cfa411a2f03b05c698b4b7b569b31a037b72a285c2725330a10ab02532dcdb904941531839f03ed01a941f457825
- SSDEEP 12288:oGdphbw/ZHENa9L3ofky5J0wh2vgj2FNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFq:iJY8vmRWO/vjyK/Go9aSRmT
- MD5 SHA1 SHA512 SSDEEP
-
StormKitty payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1170626
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c9db48c701d11ccea315e72da8482e1b00ea5472c1235f6b4e21bfff73b2e941
- MD5 1311db472a7d6214c081d1570ce26cec
- SHA1 97c69429b40f5413092522a8b9277e89ee9ad0d7
- SHA512 2e7c7e9403b4e93f5047a08b5b9f0d017884840d0473f9def1b0ec23173b7dea697a4a02ed6b3e8e09a3129151385b9b3ec5c2da8793be908151f125e7114deb
- SSDEEP 3072:tCf3TYGASJcuPma/XzwfDo6I0oWFKgboh3xTBAk0rklCGl9O7Y7T:Yf0CVMZosKJh3l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
292266
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
278KB
Virtual Size
277KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 083b7be903110cbe07e367df7f1ccf0283fb25a3561969dadca319c5ee580865
- MD5 0c856c12a57ec760d42beb7c7aa9f654
- SHA1 fb2344188d90ae256782cdf3814e8cb2d82353bb
- SHA512 cecea1ae8a904d54a9841ba043708668bf98b904a7b1e5ca096efed04f2e1e88b713e2f43b5021033c74481e3052b641553f5bd1df2898c3feb26d43adc457be
- SSDEEP 3072:OJMMGGkkad8SHHhh//dIC44CCwwOCoYWJsCOtuUqIpQkodrY6Jj0au:cMMGGkkatHHhh//dIC44CCwwOCmJsII/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\RemoteCamera.pdb
mscoree
_CorDllMain
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 82bcf176d913f0776418319f42dc5d04ed32e1fa7228cc3802d41e62b5147256
- MD5 7ce57602a56e0c140569e80e6bdca112
- SHA1 66efe692b9a866c29eafd5f49f9b87ddf30e249c
- SHA512 5b422783c8971a8ccaf4fcab6fc5e3f494bc74d575b57d209c5c826f8438a73480bbe178d13cc7ce66036ac9b5fd7b033d8f811436e7f88a9b49785e343ac8fd
- SSDEEP 768:genZgEDOUu72ffjm9k0T0dDxZDlOxmVfl:ge4+fCRT8DxZhOkv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
41150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\RemoteDesktop.pdb
mscoree
_CorDllMain
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 839728b1c09a00907e3efc67de957600c59d6a03afc8f8880160e9ede8ed93a0
- MD5 d560dc1d671c9f63341eaa2e82e8da3e
- SHA1 f4a241eb751c8bedb329db709addc799481d7347
- SHA512 1f3730857c918ab8aabb8beeca48d1be2db05d78f105f1fcbd156aff04068492d75b995af92f639e5944859f73a8c6aa9302749f9d0c361f0523b25f69b433bc
- SSDEEP 6144:aXfUJwJRSekrGXdBr/kRCUkAk7mt4Jx0outpvikG0WbuNIlTV0zANjLJ6N0zTdIa:yuqhwNUxOWdzvN1oi9tcUkUnj56CfAJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
572006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
551KB
Virtual Size
550KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 54c537118656e6c56c55e5894d5798cf4ed495ba7992b46050649ff660dfe7d5
- MD5 7b93b63734901d7a5c40e06c6706c1e7
- SHA1 3c534fbfade38a1f1b90ce463cdef404c1330234
- SHA512 7711ea2c15dcaa0503e5fe92ee9f03af32d8ed37dc5ea4a40c46e77ab65ecf0321dad1ad11b73845d7dc94ca6f261769d4dafd538abb4be0d70a0a2153fb4a32
- SSDEEP 384:mZD+IRbL8m9j4lzfUVugdsehG8QThiU7eugRZLBRphrcnlTaOCq3zqn+D9fnB:K5939j4lLGugttvprQndCA3RvB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d179e1d3e1f46c85bb4a03e9c9069e8b529999e776b7b12c2d4a47f622535f8c
- MD5 afb9b0c9bb59fb128406ae3f9fb71c78
- SHA1 820c24c6a252639f6d92130a4a6c83db53f8f3e7
- SHA512 23102da3a25695c45a20f6bcf8ae82d58b00a92c359db9de5ff1584775fc521ef46ee9468032cd771afd87c035e2181c3d15072de1738ea0665e39294c638f80
- SSDEEP 768:SDFB3bs7TngUza7xesycCcB9D4WEI7I+HmMn:SDFB3bl7CcZBZ4WQ+Pn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\Binaries\Release\Plugins\SendMemory.pdb
mscoree
_CorDllMain
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b68d9d96af261cd1103255a35838e4d8112598f1a15d860c7b932ee098ee143c
- MD5 148df73fc5c660433a2f879623e20200
- SHA1 37876b040a553b27cb8adba4e6d36a578f4aa6f8
- SHA512 17434fa00756bbed7c0a426580f771e59d7f4e7ae0858f1daed0c9b38cfe0adac7f1c52bbf664c51cf4c1b1bd62a8e3e981cc2585fb26fde278e3101401483a3
- SSDEEP 24576:gatZD2Q9NXw2/wPOjdGxYjm0h7u7FIwgk5jfIgW5kA24:gatRTq24GjdGSjmUzitbv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1244414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/Stealer.dll.config
- SHA256 63837bde3bfb609d59002b88831786e7b0bf285a6090f9252c35af9ee3f75ff6
- MD5 ee37d8dde7f969b007430b18386ef45f
- SHA1 5dadec5c0ef36d2511d9e4943ea5a59462a657ab
- SHA512 76bde199f18744451eca542084de6819c1033bd28495c5a458be242bc00b4b05027de6358965c2357772216ec7afa55ef459ebe7b9e48bc5bd8baa60ba1f9d21
- MD5 SHA1 SHA512
VenomRAT_v6.0.3/Plugins/hvnc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 995eda42ca6298269c8ce9e6c6fe857704ceec211911bae8379f8e905eae6d32
- MD5 fc73d7d3f06595cee03b6d5c8d7f1288
- SHA1 295e40e9b723ca96bbfcd7e2e9f4c57f9cfe31fb
- SHA512 ad99172ca8c444b8c8473522d8c40229426b5cf9c7db49cd42d92804bc3d197ca9ca947fe8d77ec9abbd24cc386c7fa40128dd3b724d26a235d879fdf9c60fc0
- SSDEEP 768:fB92a2NJWV2D2i/BLJUxGAPqpWupz/CTRtYnhbnpwgCWPL2Pi:7fPqAupz/SehbigCWjl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42426
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\fastf\Desktop\Venom RAT + HVNC New Update\NNProject\HVNCDll\obj\Release\hvnc.pdb
mscoree
_CorExeMain
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Plugins/ip2region.db
- SHA256 5948907df4a4782d5954499b65ab011e257fc5775f81e0b8b4dea6fa10e6fcc5
- MD5 c8f4c82b2cbe02d7797dd6568533ae5a
- SHA1 92893bf95436d087b55ad3bc1ab6b8a349adc2d3
- SHA512 151ef56eb99cd29e02dd04b2dc19284597df2feedba1e1fbb6bbdf65f5f66fd2f9caffc48057ac1cb684270739ecddff6098b9b97b80ecfb98e277917f174c96
- SSDEEP 196608:ShLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95UhS1nUzBPeXQtG:DP+Zw6NLIsFfskh1BmXGG
- MD5 SHA1 SHA512 SSDEEP
VenomRAT_v6.0.3/Plugins/x64/SQLite.Interop.dll
- IMPHASH d0e920f0f19a6bb30b14317da522b487
- SHA256 7bf956ba8edbc7358398707afddafa3acfcb212796f4169130d7cfa557653e67
- MD5 c2d9e689c9b7dbfbd6266430fcce1add
- SHA1 1ce680f48d19ab31f4af39c261451804a2858a11
- SHA512 24867f191cb91e1a6dc7dbcfba02881dcb9bf49166315508bcfd331f51495a536431d33b5444fcfd270adf6def4691301c17c328cd8ef779819429437f590e08
- SSDEEP 24576:DLTtHBGpRMWBny2uuf/PWEkOgwCyWUMZ4Gt+bQ6QjwUJFN:nGpi8d/vZLxjnQM
- MD5 SHA1 SHA512 SSDEEP
Digest
d1:1b:84:5a:15:7c:da:46:54:03:54:83:b1:95:19:2b:08:6c:e4:d3:ca:cb:91:fc:26:ab:f9:b1:75:18:56:52:40:5d:8c:94:89:41:e6:f4:c1:dc:ab:37:94:e3:a2:ae:8c:91:3d:39:4d:ae:fc:5a:e2:56:35:d9:7f:95:00:4e
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Jun 1, 2022
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
65:22:c9:32:35:ae:9e:9b:71:e9:31:cf:82:31:f5:49:08:c3:09:fd
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Jun 1, 2022
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Minor OS version
2
Major OS version
5
Entry point
20320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2010\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameFreeBuffer
StrongNameErrorInfo
CorBindToRuntimeEx
StrongNameTokenFromAssembly
wintrust
WinVerifyTrust
kernel32
GetEnvironmentVariableW
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
SetEnvironmentVariableW
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetModuleHandleW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFullPathNameA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
lstrcmpiW
lstrcatW
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
SetEnvironmentVariableA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
GetStringTypeW
GetFullPathNameW
SetStdHandle
WriteConsoleW
CompareStringW
GetFileAttributesA
OutputDebugStringA
ExitThread
CreateThread
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
EncodePointer
DecodePointer
GetTimeZoneInformation
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
RaiseException
GetConsoleCP
GetConsoleMode
user32
wsprintfW
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptReleaseContext
CryptDeriveKey
CryptAcquireContextW
CryptHashData
SI02815e94e2c315f7
SI039413da2b10b773
SI054e3c8468772b2b
SI0628e029b7e108db
SI077534168313d3ed
SI0938f783b19237a0
SI0a886fd4c720116f
SI0bdc6d0c384d2e10
SI0ce1fad4c4f4a7fb
SI0cff507887d45bcd
SI0d6b1c4a8f9f99d4
SI0da8b85fb82501d5
SI11726a584883eb5b
SI13396627163b7740
SI157f8e08193aa53b
SI1773c1143669a2d4
SI179fdc030276548d
SI1d81196412d3ef05
SI1def9b218f2b4647
SI1e14e4ca4a95bf49
SI1f188bbd4af5db07
SI21a888837ee363be
SI2205f161df7092bc
SI23fce3fb79cbb177
SI24f086e117ed378d
SI255d44cceccc3fc7
SI2560e79b9e8e0efc
SI258150823cbe6bde
SI2711207af0065fc8
SI27b50b0098946eb0
SI28dd7560c8be508f
SI294b84466eaff39a
SI2a4d8b6ad44eebf1
SI2a62764d0ab77e14
SI2b645959c9369085
SI2d11646dfe5d0c6a
SI2eb4079ca3a05cbf
SI2f014207a555e535
SI33ef63550c5242fb
SI341218eede1b5e9b
SI37a08ac191c978d9
SI386737cd2a0fdd19
SI3997e7de4e90e1b3
SI3ae1edd0b6623730
SI3c17a08e4bd9b715
SI3ce20b46a489236f
SI3f6b70ecace50eb3
SI43bfa22e745af6d8
SI44d6ee46b9c95458
SI45fe9413d5eae770
SI473a804e6f038305
SI475081909f1229d5
SI47e966d3c8ed1d1c
SI486b02ac296e0b17
SI4b285cf3ba62c252
SI4ca8ca7236e6114c
SI4d5fafa34f690772
SI4edf79ad44a9cff4
SI4ee0a8e4fbaae675
SI506e50fb03c2d89a
SI528b790fd6ac4633
SI55f8c019b2e5ed58
SI56aabcf29f5e6720
SI56bf96ba405a1160
SI577edba978146092
SI57cb62b7ae61cb1b
SI599b44278adc9bc1
SI5b8ed01c5811b4d5
SI5bb9251d9841cbec
SI5ca7a2a9e7f1b871
SI5f6198a74f6a66c1
SI5f81f83484be3abd
SI5f8c56b9ec22dac6
SI609a818d5fbe9ac9
SI61339d837097a253
SI6199891c0152daea
SI61ebe33d35212c42
SI6527c62a1dabea11
SI66864656aba1350f
SI670f4f88bee34d06
SI690e97ad40a6d636
SI6986c52c0c452cc1
SI6b1ea8359a4bab8f
SI6c336868b0a5fe32
SI6d1c17b1fb262865
SI6d7b2699ee23d3f8
SI6e43416f0f0e0e16
SI72ec7143af42ede1
SI74043e952a2cd403
SI7520d000053e0d14
SI772bd4b1b0106e5b
SI782e3aea35580db5
SI7a5090ee686ee20d
SI7b32bbd817c65bb8
SI7ba05ce94ad6ec39
SI7c80035d85f12db7
SI7cec4139b0e05c44
SI7d59e220321e2f41
SI7d92c115a9fdcf4b
SI7e589f074eae40b8
SI7f61887459ad69d9
SI7fbe039e0a0a9e80
SI7fca2652f71267db
SI8181a48bde70c668
SI870da7e43adb4ee2
SI89eaf1bd7a956980
SI8a4e5681c1906ed7
SI8a4f24784a6e0dd7
SI9086cecb6f6cb06e
SI9142d5013e275b68
SI917c1d969e6de20e
SI92a9d705cf067ce9
SI95b0bda85d917b2e
SI962c27000aacea2e
SI98872790d4e8efd1
SI9a7f75f0346092f5
SI9a83e170c880ff66
SI9cb60bb60df261b3
SI9ce43ab9f0988669
SI9d59c342e257f634
SI9ee262799bd281d7
SI9eee50437bcc1191
SI9f7fed40b32f2518
SIa2d290f3cce83950
SIa3d8d3d7074939f8
SIa3f72e1fcd28493d
SIa487294f7b3982b5
SIa56f9b6b87626f82
SIa6ac334abbe174be
SIa6adfe554ffc7cbf
SIa97f15c7a9a3fcec
SIac17d6653268c29d
SIac40f022a187cea2
SIac721dd2e74c9941
SIafaf563ba75328fe
SIb01052dff9582bba
SIb3a01e7c57f0fe15
SIb3a698858b4f4c1e
SIb3adde975ae37b85
SIb4c632894b76cc1d
SIb534977cefbb73a0
SIb7ca6c18f9b627e3
SIb8b2ca972163fd1d
SIb90da090982f4b08
SIbadadf3b9880be1c
SIbae16952f377e56d
SIbaf8241fbd0ce62c
SIbbb652829bd5e949
SIbbe901f293754481
SIbbfce5c96068face
SIbcc66e0ffc3a4a1a
SIbf23d3c9d85dbdc9
SIc15bffd7e1940157
SIc28680a63df4f588
SIc2f1bb5274db50ad
SIc5e7050b98faec6c
SIc62437a375ae6e3e
SIc6bf4b86ca97d9ec
SIc6d60081c2db6a17
SIc8187efca8c1cb7a
SIcd04f8e391a31c9f
SIcdd4568419784a8a
SIcf8c2c23760a4499
SId02b7e5e97e1e93a
SId2c7880f24f06d7c
SId2c89445431c35db
SId644b1bddd2a2bbd
SId6fdbb9d0d4025e5
SId81be8ee89587e08
SId81cf9ee807123a7
SId8f3329973466732
SId8f792fefa4b5275
SId93ded5c6e4c47cf
SIdeafee00e45abdd7
SIdff2308d05ffee18
SIe1f990609c49e19e
SIe2c7699ad7342993
SIe43bdb992e04bab8
SIe51ef6b50d4bca6d
SIe8488cc730a7a082
SIea4bbb6d1ee2a307
SIea85a8543a7ed080
SIeab73374c21d5265
SIebbb430d08e906d0
SIee287d5c749c90fb
SIef4f0710e0d4fe79
SIefe0985609bde5e8
SIf17d2cb586e5ed0b
SIf317063645427306
SIf36d68994f8a3dbc
SIf55420fc5e7a71c7
SIf5788ad6b55cce99
SIf78f8f1191d53f8b
SIf7e752fd3d0936c7
SIfc766c3d655f3fe2
SIfd60417394c54f67
SIfdd143ea824fb4f0
SIff65f01991d44537
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
220KB
Virtual Size
220KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
30KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
Name
data
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=133, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=18, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=145, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
VenomRAT_v6.0.3/Plugins/x86/SQLite.Interop.dll
- IMPHASH d7c5f86c3fc85be3e472e29f7bd1903c
- SHA256 29f4c07e9c5b265976967d8afe435b0e74bb6169c20090d856fbcc42a4bf48f0
- MD5 730e57d00a8699352cfb15ec1159afd0
- SHA1 3ce30190d1f64dcb4572f0dd0efc065d58407dd9
- SHA512 b5bbc861884d4ce0a0846688d493f7a84b97076849ab81fdf3631a525dd99a12c7156a9d43b3019f91a912ab102669b651c5f6c2967142c29d2b41e76aefd3df
- SSDEEP 24576:mf/6v6+dsbLxvHMX3zaW8Z2VCGt1mGkFadPRjp5506GygUI:mn6UbEB8Z2cGRXDg/
- MD5 SHA1 SHA512 SSDEEP
Digest
d4:e4:b8:c3:67:48:e4:95:39:b8:18:47:19:bf:c1:6f:ec:1e:a3:77:0c:4d:46:54:ed:9f:dd:09:31:d2:68:09:3e:7e:c5:83:6b:6f:ce:14:71:b6:59:b2:f2:79:14:06:0d:07:d8:4e:32:d7:9f:b2:3e:7c:6b:7f:ca:f3:b2:43
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Jun 1, 2022
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
d2:ee:bd:b1:30:7f:f0:41:c9:94:e7:92:10:17:a3:dc:52:4f:39:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Jun 1, 2022
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US
Serial Number
0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 29, 2022 - Mar 14, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Minor OS version
1
Major OS version
5
Entry point
13331
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet-private\bin\2010\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
mscoree
StrongNameSignatureVerificationEx
StrongNameFreeBuffer
StrongNameErrorInfo
CorBindToRuntimeEx
StrongNameTokenFromAssembly
wintrust
WinVerifyTrust
kernel32
GetEnvironmentVariableW
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
SetEnvironmentVariableW
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetModuleHandleW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFullPathNameA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
lstrcmpiW
lstrcatW
GetFileAttributesExW
DeleteCriticalSection
SetEnvironmentVariableA
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
GetStringTypeW
RtlUnwind
GetFullPathNameW
SetStdHandle
WriteConsoleW
CompareStringW
GetFileAttributesA
GetCurrentThreadId
ExitThread
CreateThread
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
RaiseException
GetConsoleCP
GetConsoleMode
user32
wsprintfW
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptReleaseContext
CryptDeriveKey
CryptAcquireContextW
CryptHashData
SI02815e94e2c315f7
SI039413da2b10b773
SI054e3c8468772b2b
SI0628e029b7e108db
SI077534168313d3ed
SI0938f783b19237a0
SI0a886fd4c720116f
SI0bdc6d0c384d2e10
SI0cff507887d45bcd
SI0d6b1c4a8f9f99d4
SI0da8b85fb82501d5
SI11726a584883eb5b
SI13396627163b7740
SI157f8e08193aa53b
SI1773c1143669a2d4
SI179fdc030276548d
SI1d81196412d3ef05
SI1def9b218f2b4647
SI1e14e4ca4a95bf49
SI1f188bbd4af5db07
SI21a888837ee363be
SI23fce3fb79cbb177
SI24f086e117ed378d
SI255d44cceccc3fc7
SI2560e79b9e8e0efc
SI258150823cbe6bde
SI2711207af0065fc8
SI28dd7560c8be508f
SI294b84466eaff39a
SI2a62764d0ab77e14
SI2b645959c9369085
SI2d11646dfe5d0c6a
SI2eb4079ca3a05cbf
SI2f014207a555e535
SI33ef63550c5242fb
SI341218eede1b5e9b
SI386737cd2a0fdd19
SI3997e7de4e90e1b3
SI3c17a08e4bd9b715
SI3ce20b46a489236f
SI43bfa22e745af6d8
SI44d6ee46b9c95458
SI45fe9413d5eae770
SI475081909f1229d5
SI47e966d3c8ed1d1c
SI486b02ac296e0b17
SI528b790fd6ac4633
SI55f8c019b2e5ed58
SI56bf96ba405a1160
SI599b44278adc9bc1
SI5b8ed01c5811b4d5
SI5ca7a2a9e7f1b871
SI5f6198a74f6a66c1
SI5f81f83484be3abd
SI5f8c56b9ec22dac6
SI609a818d5fbe9ac9
SI61339d837097a253
SI6199891c0152daea
SI61ebe33d35212c42
SI66864656aba1350f
SI670f4f88bee34d06
SI690e97ad40a6d636
SI6986c52c0c452cc1
SI6b1ea8359a4bab8f
SI6c336868b0a5fe32
SI6d1c17b1fb262865
SI6d7b2699ee23d3f8
SI72ec7143af42ede1
SI74043e952a2cd403
SI7520d000053e0d14
SI7a5090ee686ee20d
SI7ba05ce94ad6ec39
SI7c80035d85f12db7
SI7cec4139b0e05c44
SI7d59e220321e2f41
SI7e589f074eae40b8
SI7f61887459ad69d9
SI7fbe039e0a0a9e80
SI7fca2652f71267db
SI8181a48bde70c668
SI870da7e43adb4ee2
SI89eaf1bd7a956980
SI8a4e5681c1906ed7
SI9086cecb6f6cb06e
SI9142d5013e275b68
SI92a9d705cf067ce9
SI95b0bda85d917b2e
SI962c27000aacea2e
SI98872790d4e8efd1
SI9a83e170c880ff66
SI9ce43ab9f0988669
SI9d59c342e257f634
SI9f7fed40b32f2518
SIa2d290f3cce83950
SIa3f72e1fcd28493d
SIa487294f7b3982b5
SIa56f9b6b87626f82
SIa6ac334abbe174be
SIa6adfe554ffc7cbf
SIa97f15c7a9a3fcec
SIac17d6653268c29d
SIb01052dff9582bba
SIb3a01e7c57f0fe15
SIb3a698858b4f4c1e
SIb3adde975ae37b85
SIb7ca6c18f9b627e3
SIb8b2ca972163fd1d
SIb90da090982f4b08
SIbadadf3b9880be1c
SIbae16952f377e56d
SIbaf8241fbd0ce62c
SIbbe901f293754481
SIbbfce5c96068face
SIbcc66e0ffc3a4a1a
SIbf23d3c9d85dbdc9
SIc15bffd7e1940157
SIc2f1bb5274db50ad
SIc5e7050b98faec6c
SIc6d60081c2db6a17
SIc8187efca8c1cb7a
SIcd04f8e391a31c9f
SIcdd4568419784a8a
SIcf8c2c23760a4499
SId2c7880f24f06d7c
SId2c89445431c35db
SId644b1bddd2a2bbd
SId6fdbb9d0d4025e5
SId81be8ee89587e08
SId81cf9ee807123a7
SId93ded5c6e4c47cf
SIdeafee00e45abdd7
SIdff2308d05ffee18
SIe1f990609c49e19e
SIea85a8543a7ed080
SIeab73374c21d5265
SIebbb430d08e906d0
SIee287d5c749c90fb
SIef4f0710e0d4fe79
SIf17d2cb586e5ed0b
SIf317063645427306
SIf36d68994f8a3dbc
SIf55420fc5e7a71c7
SIf5788ad6b55cce99
SIf78f8f1191d53f8b
SIf7e752fd3d0936c7
SIfc766c3d655f3fe2
SIfdd143ea824fb4f0
SIff65f01991d44537
_SI0ce1fad4c4f4a7fb@8
_SI2205f161df7092bc@12
_SI27b50b0098946eb0@12
_SI2a4d8b6ad44eebf1@12
_SI37a08ac191c978d9@12
_SI3ae1edd0b6623730@8
_SI3f6b70ecace50eb3@44
_SI473a804e6f038305@8
_SI4b285cf3ba62c252@4
_SI4ca8ca7236e6114c@4
_SI4d5fafa34f690772@8
_SI4edf79ad44a9cff4@24
_SI4ee0a8e4fbaae675@0
_SI506e50fb03c2d89a@12
_SI56aabcf29f5e6720@16
_SI577edba978146092@4
_SI57cb62b7ae61cb1b@12
_SI5bb9251d9841cbec@4
_SI6527c62a1dabea11@20
_SI6e43416f0f0e0e16@12
_SI772bd4b1b0106e5b@4
_SI782e3aea35580db5@12
_SI7b32bbd817c65bb8@0
_SI7d92c115a9fdcf4b@8
_SI8a4f24784a6e0dd7@4
_SI917c1d969e6de20e@12
_SI9a7f75f0346092f5@20
_SI9cb60bb60df261b3@32
_SI9ee262799bd281d7@4
_SI9eee50437bcc1191@12
_SIa3d8d3d7074939f8@12
_SIac40f022a187cea2@12
_SIac721dd2e74c9941@12
_SIafaf563ba75328fe@4
_SIb4c632894b76cc1d@20
_SIb534977cefbb73a0@12
_SIbbb652829bd5e949@112
_SIc28680a63df4f588@12
_SIc62437a375ae6e3e@8
_SIc6bf4b86ca97d9ec@4
_SId02b7e5e97e1e93a@8
_SId8f3329973466732@12
_SId8f792fefa4b5275@4
_SIe2c7699ad7342993@36
_SIe43bdb992e04bab8@8
_SIe51ef6b50d4bca6d@8
_SIe8488cc730a7a082@12
_SIea4bbb6d1ee2a307@8
_SIefe0985609bde5e8@12
_SIfd60417394c54f67@12
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=60, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=131, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=145, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
VenomRAT_v6.0.3/Resources.resx
- SHA256 b00bb37106f449417db0d3d9e4e73d35755e89fa9ce94582b74612bad93cecce
- MD5 f5881e9cf9d84fc36268f71a8f496c6a
- SHA1 4e12b92b28cbfd4895da48a71f82a4848b926613
- SHA512 0bce7d6e7a210744ff254ebdd6f792f85cd31c11a07d0581ff8c8722011d73a542b23e89dd628f3c1a19988ad145064af7a45acf0193f0a9c44d9bab0a81951d
- SSDEEP 49152:baQuFaQu+Aw2M3gzMVP56jtDLig9WRQZYnxNKQP60ot6DghhVD6R3Lr+SqMckGpC:i
- MD5 SHA1 SHA512 SSDEEP
VenomRAT_v6.0.3/SMDiagnostics.dll
- SHA256 e7c76c52a3e9f751ed6ed9c9231e35228a636ebd68726241a843f31c5a41ec0c
- MD5 2612a0586acb1b3e7b5c13aad79504fe
- SHA1 8a8ac9ce4b3a174f46b69fd16bad04c5f3044e24
- SHA512 fb6d49a3c5051c12a9bdc23f5d0b0450cada30b54fc557e83b55280a5ccefe00a30f9a641c65bca42f2cc1eed30ada4eabd07e97814df715f1ce9b2f046aefce
- SSDEEP 1536:jcWGmG94OjPC0tO8KrKd2VI5FzAiVdJ+nD2D+Fye43GN9+ckLRoCDQ76Kj:j4jO9rKRVVVdJ6D2DIH42fYeCDWb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
SMDiagnostics.ni.pdb
SMDiagnostics.pdb
Name
.data
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
VenomRAT_v6.0.3/Server.Properties.Resources.resources
- SHA256 db0da3c4c367aa05193b918d91fc731ccdec0241532b02f544891547bac61976
- MD5 24bb6bf569b7b8b8b2743f1b4ec138d9
- SHA1 0ee96dead026dad2413cad1729c44da82e9aa0a8
- SHA512 6dc0ed583a468ae2e649e6abca910f4f58ff7f0d3f0cf42effaf33b276ec520a2e6d37cd3a702a86265e537fdd570fcca5bd55cc049c8a7396ebee895101b71d
- SSDEEP 196608:j7aIBhLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95UhS1nUzBPeXQt0Z:fT+P+Zw6NLIsFfskh1BmXG0Z
- MD5 SHA1 SHA512 SSDEEP
VenomRAT_v6.0.3/Server.Properties.Resources.resources.txt
- SHA256 ff90e7f24c52af8cc22ab93484a90edb26f92bb0cd07f5f9f3e11565e516b38a
- MD5 87e6db607c89f5fcf8465995f84d2aec
- SHA1 8a81e3e5f963a85c85187d1d23fa9b18144d8090
- SHA512 2366206e46ac317588b6b8ea3a1b511d8fa13fb4234585dafd396c740105d4916768c294d90c24a60301ac2ff582d728eaa8e6661bd6b4d7c77f14db2f821f05
- SSDEEP 384:eokwkokwbokwvokwMokw3okwpokw2okwvokwmokwMokwOokw4okwtokw3okwcokU:Ub4+djF
- MD5 SHA1 SHA512 SSDEEP
VenomRAT_v6.0.3/Stub/ClientAny.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 efc3192e9c1193f50de52db0d4d578922fdc8e91d2d267cea6f8bf0e84ca49d7
- MD5 73d9313ae1fe7087365b1e8c5064da8d
- SHA1 9d26fc79ca9e9e0521c45f5d76516cce94e59b2c
- SHA512 f8e30df1e3852ae8e5e578bc11103ec5ba6ccf488284f1e735eb529ed0577d3703705a054999a75645daf2f8b5bf75a6d063700b16d012743ec1ad94919898cd
- SSDEEP 1536:NWURcxPw++Zxz2IkDzj+rBGI+z1bf/5PDKBLVclN:8URcxPQZF2/D+rB+z1bfRPwBY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
74734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Stub/Clientx64.exe
- SHA256 23905e48fa50d3228cb79fc475da9d6a05be7b98eef3fd61703dacda9b591392
- MD5 50fe12d9ea040a8820dee9e9d6e44e72
- SHA1 2d6d0fd1614ee8ad801289e5d6b81e6758ef0d74
- SHA512 49263c1cb17c35e4e0e8845ac7903d12c450dbf0236e333a00dcb2aebee963beaf283ce904b2ca71031b1dcbdab8fa201926306ec2e1760f19373366d054aa46
- SSDEEP 1536:5WURcxPw++Zx3xa2u4AEHgIdNz1b//hPDK73VclN:wURcxPQZJUEH5z1b/JP2lY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
VenomRAT_v6.0.3/Stub/Clientx86.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e9538bc4d1dd9a6d8f502592af6796ae9d394b2e9ac66bf6e026cd013308e159
- MD5 dcc12676515c05367b21d6298168cb21
- SHA1 7ad95d680b7c948af91aa70db1cd8887eb9ef5b6
- SHA512 22aa5efdcecdbdeefdc818d7273e532d2b396f17be0536ef93ad33ef8faa49ac002cb97a3867b417ed2348b9c7913fe15bedf32fea5ae7e72082ab2904db79b6
- SSDEEP 1536:mWURcxPw++ZxZxi2ogEH2IdvW1bH/YPDKR7VclN:XURcxPQZ/ZEHdW1bHAPgxY
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
74734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/System.IO.Compression.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 10a7c576a8bc639b63b9a1c6b5f8d38f85e34b3f020106b27076d395ac3d82be
- MD5 24e74963a68d66fcfae334d91f5c5b33
- SHA1 c0cf3df19033cdc055c627867795d8e458a67ccc
- SHA512 6d28dd711ab97924a2e807d7df61dece98df9f262b55093e5d58117740316dfba33d329a3e75662aeed5c396e8a67afe62a099f5e6887ed23cd0d082718fe7ac
- SSDEEP 1536:1TABDIGPGNWQT7872ea/LSbqfMY2ZztUZzQ:mxIGNQTQqesSu0YcAU
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
30:d1:45:a1:4f:fb:d4:e0:14:c2:be:06:4c:0d:b8:2b:ca:63:69:2b:9a:28:5f:bc:2b:80:e5:ae:5f:fe:91:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 16, 2024
PE Signature issue
Digest
30:d1:45:a1:4f:fb:d4:e0:14:c2:be:06:4c:0d:b8:2b:ca:63:69:2b:9a:28:5f:bc:2b:80:e5:ae:5f:fe:91:1e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 16, 2024
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:39:f6:1f:7a:67:6d:a0:00:af:00:00:00:00:04:39
Issuer
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0c:52:4c:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 6, 2010 - Jul 6, 2025
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:55:18:1d:a4:2e:e0:86:fc:15:00:00:00:00:02:55
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
51690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.IO.Compression.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/System.ServiceModel.Internals.dll
- SHA256 805d9e2c5cd2f2b17e68763ae4eb1db0103bd278e526de32f98e0cd336541e14
- MD5 7f35e0251f45807e872ee0a354a8fe81
- SHA1 74cebb21cb95165774ea0ab082cb85cd3458ca8d
- SHA512 c5dfd9e43295b786eae9869ac1ede564d9d86255a58b3cf2f9af313c355fab8d5c3c4bd41291da65729ae510000446290588e9d67b2e65aa6da10777c6f5d38b
- SSDEEP 12288:Nk6q80n+FoAY2aScs0pbpcCqunbh9Xj9OtCXK0VWLmYss:snhATaScs0pmCq8YtCXp8mYs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
%!f(<nil>)
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
System.ServiceModel.Internals.ni.pdb
System.ServiceModel.Internals.pdb
Name
.data
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
601KB
Virtual Size
600KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
VenomRAT_v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5
- MD5 d3731f0b18e95da5c477cce1c13913ca
- SHA1 10870da4f1880f7b48ce2530c929f4d5c8760cc1
- SHA512 3d273cd7bc73fa03d8c498c1ac3d423cac7e23fe266e3a1b32f93ab1e9c29c341e1ae8e1305d310486762998bca2ec8d711698a73428d2180f683ecbd2364865
- SSDEEP 196608:R4HkUqgBKkUYp81IknE2eZnl5PrT3KUwaUmcmSKgge:2MgBKkUYp81Ik1eZl5jTawUmcmOge
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8667678
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
8.3MB
Virtual Size
8.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe.config
- SHA256 0aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5
- MD5 a1c2a2870001b66db41bcb020bff1c2d
- SHA1 8c54c6a3564c8892aa9baa15573682e64f3659d9
- SHA512 b3bf53120203cfaa951f301b532849cb382d2404c9503916bc1ca39925a9a1530b01045f341fc75d47d65130d0187dcbbf4288b9ef46aa81624b59ba7802794b
- MD5 SHA1 SHA512
VenomRAT_v6.0.3/VenomServer.p12
- SHA256 c40f74c79715de4c5265dffd643d7bd5dda2caa09ca84e620bc78f7d27df51fc
- MD5 65efef16af8b2bb993e24ca1fdb3f3a7
- SHA1 e205dcc888582eb51d0ee9690d37a7b75138f715
- SHA512 29581484c44849ccd0ad9bd2c9058fc56f3589019baf4b833a5fc8ceea0e488a357639c92cbaf977f74d5f2d59abb2b8ee7a607cdc67c6c14592b4bd9c3a5215
- MD5 SHA1 SHA512
VenomRAT_v6.0.3/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/cGeoIp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 648950f725fb0320e09c52dcaf81764916df96dc62e7429ba67daea0acb784ea
- MD5 5cc2bb48b5e8c8ac0b99669401d15456
- SHA1 02e9ae08f3ec364834eb3ffc122f1c90e1b0e95e
- SHA512 2867e94cee9f89f1cf85ad01083d75f4bc0bc0e551b2ffae05581828994f2b01a458ac7a7c94a45e8c40858ecce197f7ec23482ee13ef3f1bf82b33b89b3b420
- SSDEEP 24576:/bN7xZgKVl/N12pljD7DM2l8xs5A/zYv7flNcK:DyJXn3ML7G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1172690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/gbpast - Login.url
- SHA256 210f2ee620fe51acdbe59bba7bb4acbde397034818b09156f6f0874b016a5b18
- MD5 4a4f5be9370e206241bb73bfc2367f3c
- SHA1 3d837fdcaa5e3bf04b57600cecb56a9ff34dd8f2
- SHA512 2ba13fe029ac6c5bcfdecf4f9ff6bdbcd64a1129e845c94944b3b35143b8270b8e024b28302750b2214ef82371a70e59fce4226907af240f60d6ad78fb668054
- MD5 SHA1 SHA512
VenomRAT_v6.0.3/learn all kind of hacking.url
- SHA256 cc7649ed53c65e4851ace414529564fe16801bb2bed4cb15588bfd6b4ac13616
- MD5 7ade4a739cbd8f44d0ef52a2f1bc6e7b
- SHA1 20753d483e1a84cb248ba2c0fb72d44137d7d73f
- SHA512 5850c3d064c9d616854a47b4bd398b76494f1fbe9b356ec5e15879f97dc67970168196ec6b177fa71d15d25d25757a29319cbf9697f3a80461aa62b431d53851
- MD5 SHA1 SHA512
VenomRAT_v6.0.3/netstandard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8be4a2270f8b2bea40f33f79869fdcca34e07bb764e63b81ded49d90d2b720dd
- MD5 0adf6f32f4d14f9b0be9aa94f7efb279
- SHA1 68e1af02cddd57b5581708984c2b4a35074982a3
- SHA512 f81ac2895048333ac50e550d2b03e90003865f18058ce4a1dfba9455a5bda2485a2d31b0fdc77f6cbdfb1bb2e32d9f8ab81b3201d96d56e060e4a440719502d6
- SSDEEP 1536:Q2Ec05j4eAH64rh5fSt5T9nFcI94WiVQTjpu:nlK4eA7mDmWqQXpu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
8e:56:4d:05:69:0c:fa:09:46:27:ef:0b:e8:36:5f:b0:7b:27:1c:55:01:fc:39:d0:19:d8:78:be:b9:ce:56:66
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 16, 2024
PE Signature issue
Digest
8d:e0:1e:69:c8:d1:ea:17:33:ff:e8:81:e3:03:2e:80:ff:4c:05:f6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 11, 2017
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
87550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/offline
- SHA256 21b4173439bdcb6338d99a8f060b98426cca95b2830b62965a72c94bc6c77236
- MD5 829c84c8f69856aaba8dfad042bc1cf4
- SHA1 0c9e6169aa58542e60807405d12ac226888c282c
- SHA512 9a670fa71f795efe96bd61cad7e731ef9300e93c44b8109f89678b7db10bfebe386e694cdba28047c837d907ae73090252900ec0b315aa74509f826b3cf403ce
- SSDEEP 1536:QRRoZn71yIjszK7ugL1Fa6OdqZbDqmXOaWv8QsKSM8QwZIABlHp5:cRIT7ugxFzOdK+mXOaFQsKSzoI9j
- MD5 SHA1 SHA512 SSDEEP
VenomRAT_v6.0.3/online
- SHA256 c2cfbabf111d231fb2531b6c0759c5191fd91f767059790ff53aef87fab2280f
- MD5 4e642f0d041d6ef79d7701e599e4bbe9
- SHA1 e82bf57ee1d78070506d08b16d79991ae2b069c0
- SHA512 79064943187cf61fadfc315986c71cc500e21ee1f8b9e81c6978f4ae555fe492153ca7c727935004fd5b2f90b30f2c1d15bcc95cc25044e861e1309fdf4b4ca1
- SSDEEP 1536:NzrZcbrBsJy8ig8jPBlrUz+qIS8s/N1yg5ty0WwNHAzJvfvTyrzqAhlAeclHn36:NvZWOJp8PgIS8s11y4c0FAVHvTyrzbl1
- MD5 SHA1 SHA512 SSDEEP
VenomRAT_v6.0.3/protobuf-net.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c7ea80a04d604ad816a58dd21ab2fe765c1f3c36ddc82ee00e55705e316522ba
- MD5 455b9dae976a4c36e8ff5f5410fb19d5
- SHA1 9ff8128e0ea3a38e96783c7d1c5972af3e31532c
- SHA512 e468f1295f9316195d5241aa7262ad1a311e541a9da6f98e8a726805e9001fb1e21df42f6db5c18c7f755649d20cb0a16e78e0f50784fddd2ec0cd66f11017f7
- SSDEEP 6144:pi+J7CHEvQA8POLEimpJ6t4palxKQJrY+elOI:nZoAuqc6tt5rYlO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
285722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
271KB
Virtual Size
271KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VenomRAT_v6.0.3/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2c93e48721089d468fc844a46365d7b160bac49f93cda07a8a956f918aebf158
- MD5 9fa500dd5384ba90daf82ae3b55a3418
- SHA1 e542ab2a9c8e09ae967011098805586689dc98f3
- SHA512 3c026b1934df3afffd09aa018b842eefb9446b402d6df0a807f65609ca3ff738f815dda4ec9d02089a0b910ceaac807c66d5fd698db17fbc42df624a4ea3826a
- SSDEEP 3072:suX8HlAtaCHC2J7j+ryZpII4NSe3OzyA8hw44/CMOzw0aJOjBWrVwg9D/FO3KZXP:5MqaCL+uZpr4NSEfhnOOzw0Vti9EKR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
275294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
261KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ