shit exec.rar
- SHA256 282cd620e1f29caf572622043e5eaf96d9e025e0e442d2a44ebb0413e651d6ce
Password
infected
Overview
overview
3Static
static
3CeleryIn.dll
windows7-x64
1CeleryIn.dll
windows10-2004-x64
1CeleryInject.exe
windows7-x64
1CeleryInject.exe
windows10-2004-x64
1NiggaSploit.dll
windows7-x64
1NiggaSploit.dll
windows10-2004-x64
1RoSploit.exe
windows7-x64
1RoSploit.exe
windows10-2004-x64
1RoSploit.exe
windows7-x64
1RoSploit.exe
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CeleryIn.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
CeleryIn.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
CeleryInject.exe
Resource
win7-20240704-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
CeleryInject.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
NiggaSploit.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
NiggaSploit.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
RoSploit.exe
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
RoSploit.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
RoSploit.exe
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
RoSploit.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target shit exec.rar
- Size 691KB
- Sample240704-2arccavdkf
- SHA256 282cd620e1f29caf572622043e5eaf96d9e025e0e442d2a44ebb0413e651d6ce
- MD5 efc52323db08ce117ff6959cefee0052
- SHA1 0201f4513252765ce8859a15fb5bff312dfae7ef
- SHA512 2272d66706b5b6d13c4ea9a3e0df8742777faf2f780664f8a6c6429508f2d6d327aa86b405edfeba509d71a274795ce149560828a3b12a6fcccd8c71fe9a3679
- SSDEEP 12288:E8p0woTkZBAE4jsaILsHMFMwiQFs3/ggNEkjrYzaGrnDWdkGm09N5JQTQ/LAcTS:E86wQkZBj4jR+sHMF73FG/ggNEK3G2qV
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/CeleryIn.bin unpack001/CeleryInject.exe unpack001/NiggaSploit.dll unpack001/RoSploit.dll unpack001/RoSploit.exe
File Explorer
-
shit exec.rar.rar 691KB
-
CeleryIn.bin.dll 44KB
-
CeleryInject.exe.exe 3.2MB
-
NiggaSploit.dll.dll 143KB
-
RoSploit.deps.json807B
-
RoSploit.dll.exe 8KB
-
RoSploit.exe.exe 139KB
-
RoSploit.pdb13KB
-
RoSploit.runtimeconfig.json386B
CeleryIn.bin
- IMPHASH fe78118d64d767d704fee2343d26ea59
- SHA256 84b82453bbda410b7f53521eb995dbf486b1cce4706ab8504bc5ca35e93eb426
- MD5 1345cbc437e118c1d7dfa6cb77c35e1e
- SHA1 03ec05eb1622cb15a2a2c3335241ab26925afc11
- SHA512 2b1bad24f3f6bae30017a4edfad8c86701e8d9c2091ed866a54faf59da2a83dc0163ffed8aebe7eb8dd0ee3d1d5484c520218af28b62a379c6fba9c04b5a2a0b
- SSDEEP 384:DpCav8/g6q0MEe7T88ckOUm9FqlHGoMFRGjGO0t8HBIovSsgoDl2B6wQa8Ko4:DYXSXlcklIaG3R/OdIovN2w
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
34608
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcessHeaps
HeapWalk
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
vcruntime140
memset
__std_type_info_destroy_list
__C_specific_handler
memcpy
api-ms-win-crt-string-l1-1-0
tolower
strlen
api-ms-win-crt-convert-l1-1-0
_ui64toa_s
_gcvt_s
_itoa_s
_itoa
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
exit
_initialize_narrow_environment
_cexit
_configure_narrow_argv
_execute_onexit_table
_seh_filter_dll
_initterm_e
_initterm
celerycmd
icallback
init
test
Name
.text
Size
32KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=12, id=261, version=31935,
count=7, id=260, version=31935,
count=3, id=259, version=31935,
count=3, id=257, version=30795,
count=42, id=1, productName=Unmarked objects,
count=8, id=261, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
CeleryInject.exe
- IMPHASH 46310f9cc3d737e79880b9e8a77b58ec
- SHA256 873312f41195180840e7e1711e1bfde66d5fc805169454ce3a755d0a28cc7314
- MD5 b377734e92c27995715957f8d4c83189
- SHA1 1647d894ddf9c0e579eb459f09987bdef84576ce
- SHA512 f0ab58a404603e55a8e0a4d2bc0fd6370423ccb071de459b88a7d664f296feaf5fca8eeee362f7eda2e0913f429e95a25e2d7d6dcaa6babdad0bdabb1dc81c5d
- SSDEEP 24576:m3J15YpXSZeqjdyEpvDK8PSyFaSBSFjiSQOazFcDGjaNYcpEGp3f8+pET3lTCxy2:m3hWSQqj8LSwfQuDGjaNlpxp3fUlTC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
2155440
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Javan\Desktop\Projects\Release\CeleryInject.pdb
kernel32
GetThreadContext
VirtualAllocEx
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
lstrcpynW
lstrcpyW
lstrcatW
lstrlenW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
K32EnumProcessModules
K32GetModuleFileNameExW
K32QueryWorkingSetEx
GetCurrentProcess
ResumeThread
QueryPerformanceCounter
QueryPerformanceFrequency
VirtualQueryEx
OpenProcess
lstrcmpiW
Process32FirstW
Process32NextW
SuspendThread
GetThreadPriority
OpenThread
GetLastError
CloseHandle
GetTempPathW
GetFileAttributesW
DeleteFileW
CreateDirectoryW
lstrlenA
Sleep
TerminateProcess
InitializeSListHead
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
user32
FindWindowA
FindWindowW
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
?rdstate@ios_base@std@@QEBAHXZ
?fail@ios_base@std@@QEBA_NXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1_Lockit@std@@QEAA@XZ
urlmon
URLOpenBlockingStreamA
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
NtQueryInformationProcess
shlwapi
PathRemoveFileSpecW
vcruntime140
memmove
memchr
memcmp
__std_exception_destroy
__std_exception_copy
_purecall
strchr
memset
__current_exception
__current_exception_context
_CxxThrowException
__C_specific_handler
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_set_app_type
__p___argv
_seh_filter_exe
_cexit
_crt_atexit
system
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
terminate
_configure_narrow_argv
_errno
_invalid_parameter_noinfo_noreturn
exit
__p___argc
api-ms-win-crt-string-l1-1-0
isupper
strnlen
strpbrk
toupper
_memicmp
isdigit
strspn
tolower
strncat
strncpy
strncmp
strcspn
islower
isalpha
isalnum
iscntrl
isxdigit
isspace
isgraph
ispunct
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
_set_fmode
setvbuf
__stdio_common_vsnprintf_s
fwrite
_fseeki64
fsetpos
fread
__p__commode
fputc
__stdio_common_vfwprintf
fgetpos
__acrt_iob_func
fclose
__stdio_common_vfprintf
__stdio_common_vsprintf
fflush
ungetc
fgetc
_wfopen
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
atoi
strtod
api-ms-win-crt-filesystem-l1-1-0
_waccess_s
_unlock_file
_lock_file
_wstat64
api-ms-win-crt-time-l1-1-0
clock
_difftime64
_gmtime64_s
_localtime64_s
strftime
_time64
api-ms-win-crt-math-l1-1-0
tanh
_dsign
cosh
sqrt
floor
frexp
modf
sinh
round
floorf
acos
sin
cos
pow
asin
atan
tan
atan2
log2
log10
ldexp
log
fmod
__setusermatherr
ceil
exp
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
735KB
Virtual Size
734KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
100KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=253, version=31935,
count=10, id=260, version=31935,
count=4, id=259, version=31935,
count=34, id=261, version=31935,
count=6, id=257, version=31935,
count=1, id=262, version=30795,
count=19, id=257, version=30795,
count=411, id=1, productName=Unmarked objects,
count=65, id=261, version=32217,
count=49, id=260, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
NiggaSploit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e9b24dcb22928806fc1eb59a51e4e7c20c694c8a1eec88b2592e2b5303c594b
- MD5 9cf1b8c685352d0c941dda696e5ae021
- SHA1 0344d3c5f14546b68bcc53bbf790730cfd02e663
- SHA512 017dcdf92fd1e82e27e0a9c884a80bf7983ed1a81a3957d2cebcdb242ecd60dba35e61f58e4ec62f65de05c79300d5b7401279e4fb0bce95698e16d0c59b9208
- SSDEEP 1536:EPfPxthoKI2FIivn+MR4mq2Yr4/CDFAhmBfH2mtZWnTF51JZKgVH85CzNpnqA+gz:yfPRI2muVGmW4/4f2meJIkkI/H
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
152318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\White Cat\Downloads\km\EvolveAPI\obj\Release\NiggaSploit.pdb
mscoree
_CorDllMain
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RoSploit.deps.json
- SHA256 7d776f356f71e6ad0cefbae2a15ec2fb7c449e14d8cce87141ce6abdef91bed6
- MD5 c9815ab49b603d4ccbbeacee6a1df013
- SHA1 81a2fcb4a205dd4f9126dcdc811645297155c1d7
- SHA512 2b7efceea18922144fcbe233ad8f98e62b57e048de6421b8f3d4214350137b5a6c7dc5edfbba9bfbd8588a394b1ae58ebcc34fab2bfea98981cd077a7bc950ca
- MD5 SHA1 SHA512
RoSploit.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 20a1d8455121ea50ab105ce0b39017d59aa2380419669a770408016cee482a96
- MD5 8539b5dac4160679fcc746420d1e71d9
- SHA1 be68d5a07f917cb9f80b1d63b6d818c4335ff11b
- SHA512 6091e6f5ade4d5e47089550b86d28fbf297657cfcbbabe0f460b46234eb31c03ed64caa6ab7bd5615bf05cfce917047e70f8e8c66c45b1ccc52a39244dcd1021
- SSDEEP 96:yugnlTDWgTCSShPvZuIaiS00HqwNUM9zSmZyDtkrwD9/LRSDQAFcPIwUzNt:ypnl/WgjSinJFK+5SmmtkkDdLmBFTwe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
13410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Admin\source\repos\RoSploit\RoSploit\obj\Debug\net8.0-windows\RoSploit.pdb
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
RoSploit.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 9bf1776613038ee9d8b61920a397a1a17d80efdc110c66c3444a057c04fbceb1
- MD5 1409a2a49a1c2c9c9c08774f5aa3eff6
- SHA1 c48b95decffc7418c2080ccd3684b71bcd613f25
- SHA512 c283aa6683bb42e22ba162b61998774bfa87ca5f0ece6245a292c99c662a482bbda8593bb49aab9a1266b70d2d3720d04c463cdcf9c401c8ad84e86d08812b44
- SSDEEP 3072:niS4omp03WQthI/9S3BZi08iRQ1G78IVn2sbS7cJw8lti:niS4ompB9S3BZi0a1G78IVAcyct
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
70496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33218,
count=18, id=259, version=33218,
count=86, id=261, version=33218,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33523,
count=1, id=258, version=33523,
RoSploit.pdb
- SHA256 1f8edbc0e9b27160111bdfdb10f6ccd801ec08295c5340dc2eee70ac5fbe20f8
- MD5 ae1ab7ef2808b8dcccb21d71b32c60b5
- SHA1 818089b0335c830c08a03c50f2cf4465a4be7867
- SHA512 885bc286ba3333c32f7bb1edda3921bfb88f65a2c97223733e62da434c5e7e10ee923220346e31da9cb6d52cfcabbad8fd13f6197f61317ecc4f35dd771c2069
- SSDEEP 384:rIWL4JzOnaJlKkavSI6qIzefh0ZC4szl79kLBQ1IcENZG02LH0fbeasb9wR7qNp4:rLqS3CZC4sl9EQCHqk9
- MD5 SHA1 SHA512 SSDEEP
RoSploit.runtimeconfig.json
- SHA256 e1e0974d0e8833375024eb7c78521b3b5cad4228aad22b23d506cbe702445844
- MD5 186a65581e2f29258f54d396660409fa
- SHA1 6f998d3be2e85cb5419205f867135874f27c0a3a
- SHA512 7dea87b523aab01ea3c794779b71bc0b52179e1d5e7b9a45539ddd39c775969ef22853c4c193699aec1e3fa3cbe26e90e3a4881226c52a3aacae1eac260ff896
- MD5 SHA1 SHA512