Stealerium.zip
- SHA256 49d8c623abc37dff7af7d7ea15fa66b27504f166b5bf7a2d486c41ce7923a722
Behavioral task
behavioral1
Sample
Builder.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Stealerium.zip
- Size 2.8MB
- Sample240811-lnxtaayble
- SHA256 49d8c623abc37dff7af7d7ea15fa66b27504f166b5bf7a2d486c41ce7923a722
- MD5 c956487c81dc16555e9232408efbe44d
- SHA1 9272088c2dc913b3c6e779a091755b07e7fa3050
- SHA512 1d1f77372991544e502bf6076a2e5c9cea0d80e2afc00a0f4efe97ebf9b74bb18e1b52b3ec02dd3de441fe3114dd3aa15f21fc421ddf93204571acd7b56af64c
- SSDEEP 49152:TLJVKzIWdYcV84L/iexLO3eVKxR96nmWbVdXVPYiuX7lT6wxkyq1Pdr+1DUeYrxR:TLJA1dbF8ussn1Vd9YBbxkyq1PF4UPR
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Stealerium family
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/Builder.dll unpack001/Builder.exe unpack001/Mono.Cecil.Mdb.dll unpack001/Mono.Cecil.Pdb.dll unpack001/Mono.Cecil.Rocks.dll unpack001/Mono.Cecil.dll unpack001/SixLabors.ImageSharp.dll unpack001/Spectre.Console.ImageSharp.dll unpack001/Spectre.Console.dll unpack001/Stub/stub.exe
File Explorer
-
Stealerium.zip.zip 2.8MB
-
Builder.deps.json5KB
-
Builder.dll.exe 216KB
-
Builder.exe.exe 146KB
-
Builder.pdb14KB
-
Builder.runtimeconfig.json253B
-
Mono.Cecil.Mdb.dll.dll 38KB
-
Mono.Cecil.Pdb.dll.dll 87KB
-
Mono.Cecil.Rocks.dll.dll 26KB
-
Mono.Cecil.dll.dll 351KB
-
SixLabors.ImageSharp.dll.dll 1.7MB
-
Spectre.Console.ImageSharp.dll.dll 16KB
-
Spectre.Console.dll.dll 693KB
-
Stub/stub.exe.exe 1.6MB
-
Stub/stub.exe.config759B
Builder.deps.json
- SHA256 d6a04809c3737f76818082a2caf9b80ac7f0e14bc73b2fabdea2df46d9e25a52
- MD5 d41bff259e1ebb625fc788fa681377ad
- SHA1 b5c8b7725d6f885db30e9237682abfec72aa65be
- SHA512 8aaed8b1b2e40c5a631753789fcf34dadf95a4aab29f852a98ecb3dc30dc5c1df11d69081fb17282c78e0310e65567ab7339bc58efba6fc7b6f729f31fc040e3
- SSDEEP 48:nC00u5rEsIXhpXhNXh3JX178dOmuOWhTV7H+qLSYHByD3cHIco3aHEg3HwHf1LHL:YuNEHx7HLSYgD3cIKkQQcsB1vd
- MD5 SHA1 SHA512 SSDEEP
Builder.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dcd0162524ce4ae11f5c5e9b496e35ce6a096e5dea8e63b45fa835069737f87c
- MD5 41dd506cd0525197e69d9c8592aed2a7
- SHA1 5d04b134c8f1800fbcd664898d34dee8d10d8fa8
- SHA512 16ba073d871eb9a244b8e733c101e9fec98699d881440e0dfa661e9f331fda0789f232e4abd70dcff3649a5428049590461da83ab7f0078e3ed9c7fc2fbfb28b
- SSDEEP 6144:Klx3eDAIbr0K3xybL1tAj4PhFqFVfrRbP:Klx3mbr0P1tAj4P6r9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
226702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\Stealerium\Stealerium\Builder\obj\Release\net6.0-windows\Builder.pdb
mscoree
_CorExeMain
Name
.text
Size
213KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Builder.exe
- IMPHASH 6dbf27f4c70fe2c8ed3e0122ba75d641
- SHA256 8bf6beb962bf051de009059554aa265012342bd6ec841abd2aa94ba1335a333f
- MD5 6c898b9e5467f6d3442a579b7856bdaf
- SHA1 9522f2f219deaf4bb52262c2a5d23393037ec35f
- SHA512 df35d776b2df079a9440ac1b0435e0fe9e4f1c17ee0790b1057ede8f146d90889c1fe727cd5112b27b2f4e96903c83f8ef7d61bc359aa762b708d17ad7676c41
- SSDEEP 3072:Iczkitvo4BpYN/6mBPry8TXROLdW5m4mURQ9OOGJ0kj:IA4NCmBPry/N2cOOI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
80992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_exit
__p___argc
_initterm_e
_initterm
_get_initial_wide_environment
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_set_app_type
__p___wargv
_seh_filter_exe
_register_onexit_function
_cexit
terminate
_errno
exit
abort
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
setvbuf
fflush
_wfopen
__stdio_common_vswprintf
__stdio_common_vfwprintf
_set_fmode
__stdio_common_vsprintf_s
__acrt_iob_func
fputwc
fputws
__p__commode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_locale_name_func
localeconv
_unlock_locales
_lock_locales
___mb_cur_max_func
_configthreadlocale
__pctype_func
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=77, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=29395,
count=162, id=1, productName=Unmarked objects,
count=10, id=265, version=30152,
count=1, id=258, version=30152,
Builder.pdb
- SHA256 7091aae963e00fcc11461cbcd53f46a4a004f748ede5defc82724811a8879800
- MD5 76d1e4255ca2b642bceea0d1fb5dee22
- SHA1 9b704b1463159896d3294fae21ee3ac91795c9a1
- SHA512 ca0d6aa9352e6a2f85f208464ad8030f5576d82cefabc093bdb1a2c47e18d3bf1679ae369f3e7f0906d8b350fc8a878f0f2e62f0b3064a7d89cb7b4c56b2feb5
- SSDEEP 384:MMtVmNTLyD5ayqNCXNLJ4R2TDO7YSUdIKHLfzsAPWW0tSucUZ6:JtI75c
- MD5 SHA1 SHA512 SSDEEP
Builder.runtimeconfig.json
- SHA256 ded3aeb5856a11db0b654a785574490cab55839ebfb17efe9e39b89618fc5b91
- MD5 24e4653829de1022d01cd7ddd26e2f22
- SHA1 9160a009cb381e044ba4c63e4435da6bfeb9dc6d
- SHA512 efd4bbba1baec0b47003831510e3aa539db9ef468e0f06ba9d7ba6d0b3800035f7c818d7d90171bfd377ec97d08c4617555bcff635dd83efceb412b1a9cca820
- MD5 SHA1 SHA512
Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2bda97fc302904bf235d631e698a0c81324872dfad2a38e63ef66389155bfcf4
- MD5 0c2d7a3d146e193d7b8e50f0fe398568
- SHA1 bf0a6ab31388eab1ffd3cd87fae62b45e90cba24
- SHA512 5fdc45ae536955e6f66970b35008ce15c5c5624d0b31bd41c79d6548d0d1b950042f51fe7dbbbc33a6256f90f5db23bf0070abe24502a050505be66f086d6df0
- SSDEEP 768:ArF3HuZyOt78PeWSTkazhOOgfGNOV/pVxPRpaCCrHpTFuzL4oWB:ArFecOt78PeWC8OgfGkVh6pTcL4oWB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\mdb\obj\Release\netstandard2.0\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 333397769114ffd13046a25b9cfffd41c44a3450ea9ea1fd13b76eec28e1a815
- MD5 625ce2e8be214194a161fe80e6eca7d0
- SHA1 58944e03ee249618e9440545623c4545777377f7
- SHA512 c324ea36e4a89a6052f685e4f96527323ab6f4eea4f4c70c71f08a84df2d46332d91c3f289463502887d9b098dc6e69036c322630b770531927d5329873b250f
- SSDEEP 1536:mffXkeOyX+6C5S6R7nQSALYKXNgJGsZaBcLevjCXeo:ao5S6R7nNArWJGPBEeveXeo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\pdb\obj\Release\netstandard2.0\Mono.Cecil.Pdb.pdb
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a6d3e6eab8d89dbd6fcf34268a08a6544ea142b6bcc5f665bee62317786b7892
- MD5 6fc634673b94c7ddde6e2ba277f7e7c7
- SHA1 f29feb86a8595d104b3b1b4be809f6e9fbc8f042
- SHA512 51f4782d7a8e2b3ffbb8fedddcfe85379e5adc499a2fd55c29e29628ca9519c33a33daf806eb3b8d01cfc10c964c1cd2558152c000c7ed2a8584f36c58f31c51
- SSDEEP 768:tkU1iy+QMBCocUuk0ThROoUheLXG99gmIt:tkUCCo/KjOoUhpg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32450
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\rocks\obj\Release\netstandard2.0\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c2908709da6761e9b5b9d4d46102d65851145bac987787d6c5a05ffe5689487
- MD5 6d8d43c5d7dbe36ec01ff8b951cf1e0a
- SHA1 d6b8214419870770e1ce398ca06a6a9f0e9e62a3
- SHA512 221955b05d83513fadcb79721c96fd467ea871cfa401b279dc8ade426c88df4cadc884dae7a9c418c1012af202263f31ce8b63ca919e1f725eb7c7e8008c3a57
- SSDEEP 6144:eCDxMlG40kOSV1L6RWDv2F2AEJHwBI+aB:rG1J1LQFLE0I+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
363046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\obj\Release\netstandard2.0\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
349KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SixLabors.ImageSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0d19e3bc90153b7d0360360422355daa569209180dd1e4337f2431148d1d7219
- MD5 523dced95fcb0120698fc194b159a5cd
- SHA1 9f6e4c7269caaf2e09b6961551102b1ec16e60a0
- SHA512 325c9c3a316852ea6156a07317a64e369048dc7cfea21e9ea87f8723cf37515f0dfc0a31ab3bf07155ea27938d426c9832c1fcba1ab6c96573cc44eacfa05255
- SSDEEP 24576:3ruzK1lGe+34AbXwX8WcaMX07Bpu39DhpsRalM9FHBjDkck3IegDkspo4fVz:3oo6WcaMX0zYUkY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1775990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/src/ImageSharp/Release/netcoreapp3.1/SixLabors.ImageSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Spectre.Console.ImageSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 52fef316879f90a3897ec33b8a6ca955bd720c8fe53b4479be01b70fcb7d26ee
- MD5 099edbe28aaacada8a7a12a414a1d68b
- SHA1 0cc1b8ed4448f4c7246dc859a6359fda20c2d927
- SHA512 07995720bc9e5d3b253b5cbe3f2700978950a81819d5064c25fbb6fe860c1cd1b32379136a390ab85f4612d82d4b256ba2d8c46cccdf9de04aab16135c2d6fe5
- SSDEEP 192:SZPAaThmPOaYDr59CUkZNd2AFSm8gCHWjPWfNx6CzOiUYvj4WLwTMVGqy5L5BR5/:iPAaWhq2PX2B1gC2KD6lY8WETKEX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Spectre.Console.ImageSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Spectre.Console.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b9617847d85b8efe32d07c4c28f1d16cadd4bfe45a09fd1e24eb82505f913257
- MD5 46684228e7c345a3368e8a475ec573b7
- SHA1 aef278fbd7b3f6a65227c7b6b64eb6d88f6cc433
- SHA512 ce3ca4c8250bca3e97713d4047d0d874b3b6430014fbc3078b34a9f701a9eaa4b5e990ff99864c19b41eba1dfad74e0f6f1a464bef7b3d5ad825dfcb91b3da31
- SSDEEP 12288:YqVvbKRNvezf2ZOIyY37mkrGpmiv+Y66i7oE4z6kX:nURNvU+SkUQ6icEl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
673238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Spectre.Console.pdb
mscoree
_CorDllMain
Name
.text
Size
690KB
Virtual Size
690KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f
- MD5 6627adf7167ee571e8fd6c8b1a0e8ae3
- SHA1 03b9112660ee73c59d84e219f15bf24ae9df48db
- SHA512 e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60
- SSDEEP 49152:19Tq24GjdGSiqkqXfd+/9AqYanieKd0U:1YEjdGSiqkqXf0FLYW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1630126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/stub.exe.config
- SHA256 67818858dae8a4d85a158d68ca50bfef345a730dbf12461cfb700f30edee460c
- MD5 a40b70b19e717b2628d2662b61e69f99
- SHA1 c3d59349659cd82fb6b8c093a3df72846541573a
- SHA512 2dfca6af0d7daeafa4803fbf971843e70678eb2ecc73f8559d39a617721c3a9362eba9fd4d158a1227a50d96b6711a9bd9f694eb10532e7caa9694aefa81b794
- MD5 SHA1 SHA512