Rebel.zip
- SHA256 7d95f2dbdfffd9227cc5832d6ee21c385a18c43b4155edc3a9fc1d988c63bf78
Overview
overview
10Static
static
3Rebel/Bin/...or.exe
windows7-x64
5Rebel/Bin/...or.exe
windows10-2004-x64
5Rebel/Bin/Rebel.dll
windows7-x64
1Rebel/Bin/Rebel.dll
windows10-2004-x64
1Rebel/Fast...ox.dll
windows7-x64
1Rebel/Fast...ox.dll
windows10-2004-x64
1Rebel/Rebe...ed.exe
windows7-x64
8Rebel/Rebe...ed.exe
windows10-2004-x64
10Rebel/Syst...om.dll
windows7-x64
1Rebel/Syst...om.dll
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Rebel/Bin/Injector.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Rebel/Bin/Injector.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Rebel/Bin/Rebel.dll
Resource
win7-20240705-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Rebel/Bin/Rebel.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Rebel/FastColoredTextBox.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Rebel/FastColoredTextBox.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Rebel/RebelCracked.exe
Resource
win7-20240704-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral8
Sample
Rebel/RebelCracked.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
36 signatures
150 seconds
Behavioral task
behavioral9
Sample
Rebel/System.CodeDom.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Rebel/System.CodeDom.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Rebel.zip
- Size 21.3MB
- Sample240824-rmlmhstfrd
- SHA256 7d95f2dbdfffd9227cc5832d6ee21c385a18c43b4155edc3a9fc1d988c63bf78
- MD5 a9961347c2bf461935d49b18c44de4d8
- SHA1 b0e6467d491a08800c5ba22c850150f12f9469e9
- SHA512 3f1fff87139c40c36d73a84067b0b6714a2899d4d15207c9def07ddb70ae1aeb718546fc1e7092b3e709fe5cf0022be716f4bef937d89d4edab0d1f4c23bc1ea
- SSDEEP 393216:N1gER06ohhz3+cMDTvxqIDhVYZT/cXP+Z/ZRcWOt2nZLOhpLD4PJUF8XlhlchC3c:N1Elh9Mv0ahKh0faTcOn1OhpP4RUF8Ve
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule static1/unpack001/Rebel/Bin/Rebel.dll embeds_openssl - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Rebel/Bin/Injector.exe unpack001/Rebel/Bin/Rebel.dll unpack001/Rebel/FastColoredTextBox.dll unpack001/Rebel/RebelCracked.exe
File Explorer
-
Rebel.zip.zip 21.3MB
-
Rebel/Bin/Injector.exe.exe 4.8MB
-
Rebel/Bin/Rebel.dll.dll 8.6MB
-
Rebel/FastColoredTextBox.dll.dll 323KB
-
Rebel/FastColoredTextBox.xml.xml 132KB
-
Rebel/ReadMe.txt13B
-
Rebel/RebelCracked.exe.exe 12.0MB
-
Rebel/System.CodeDom.dll.dll 30KB
-
Rebel/System.CodeDom.xml366KB
Rebel/Bin/Injector.exe
- IMPHASH 076acaa656f74379ef1e60670f0fed54
- SHA256 7450c90fad1d9ed73652c7fee391adb41ee2c62d5d43f3bdcab945e3fdec5485
- MD5 8da7ffaee1e5988d56e536d37a5e5d7d
- SHA1 ed799e5ec866ec3dff0bffb306de4b1ab2ca2361
- SHA512 34579bfbee7ec802322b12cc91276dc440d2df63d8e02b55ec303a19b4a198810a97157cf82739d0c30a509928d797142cee133aec994f0c8f5c58c5a6aebd16
- SSDEEP 98304:2sscM3M0egRUUYdiVF0Zx5NMEuRdvwp1cpY1t83Szkkak0jIiGELfHNz:Vrf0egyUKiVF0rF+dmcQtQSzkkakuR7V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6808283
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteProcessMemory
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegQueryValueExA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
6���t���a�%���q'�?W�.(m�lH��
�5<g�RMm2%; (����|pP�s :OT>�9G+׃�X�)�&�%
<��3��� H<�R澋�m�b��+*c�x��EҮ���>��a%rW:7� H�=[}|
;��^1�gK�NE�-z�Qa��v��H
��� C�RY��� }�� ���:�<.�Wˑ/�#E C.W���Kʰ�܃;��`e&�@6��M�ON3�������ڟƨM4���7?�P�*� C'F>z:�����&g�gI
[n����ۉ!.(װ۬�8��7�u?˾Ї��� �
Y�9r&�O@B�\L\[���ȋ�������3�]t�O�hH��/�0Z���L�4XT>X�
���i�<�������|���͓�`GϖD���l`�G�.吵ѹ�Q�� rtri��y◧*��[�)�k���%�D�s�o�������UE\�����.��#ʏ iK��b�2b���]�D���~0*��OUȕQ�9� p�����C~��#� ��B��!>��s�.+�7֩������o�iE<ZgO�̸�M���J����7��P{�б�D���0;���@=k��kX��Ř�r�%�pM��1�]�{�
�pc\���r
���O��XW��_��W��&����,O��w%���gNb.�+�M� "5�I��r%+���̔Mw.n���r������3�7<�9�rп9����a�P�o��֤��IO�!VO� ���b�Ld�����L��L�c)��T�=�+�8�ۤ���+�Q$w���ᰙ�Ą}/�������I�7x��3$c�� N(��s`�䢿�.���X[�9�s^���s�4$%���D��B���M' ϥ��N���+`^���i �� g��,����2�[���F-4�k[Ƒ]F���LT jZa ��<�_�}Ƿx=��#�W�tF ��(��y�se'E���7z�y�Ԕ� �k)��&&� ;ߟ����k��a���qg،|���8�$9a���?_=��H�� ��U���q�PTZ i4N�X�� YR���3��h��Uvs>.�G���m^��]�T�����}<����4���!�a������fgȆ� ��wЃ�?�]F�����x.���#�{QO-B�߶Q����v��+�Å�@H)^-cS�J�8�J:�]`ӕ��-��D��dC����zgz��������t�<k
G���o�W��ym���P�S1b�;����V
ƽ����H��]�������h��'�`�����i��0e I��G�U��Y�Z�t)D|f��A�����S�7�WN���3BKj���o��>�<,� �b�}T�@������W�>㇋��9�����Z2%����W��M"&�,�Th5�;*r8äl�cM�P�xM+7��L
�t�Yc�pe���Ŝ�` 5R�\�P<����4GN�
v
[L��)@뜑�H���1��W� G�.3N��.� F?fbߐ?�Y4}�M�=dm��%@b㪞,�J�q�x��V��&Eyp��te�`8����d�ˈA�Q>qy�`�rǴ #��ֺ���4|`���5{� ����T�� V p��)�wb ��q��ӷb� 7X�F#�0���P��[��7���I~�ô��ul�]��F � � ��9��jVDε�0�3;���˸+��\�i����97� ;���~��@^
� ��]�18bqw��G cw��e"N�K�.,����a׆(&�92�J����c@H���|��,ա[DBԈ?��V�ư��3�4 ��>�Վ�h���ps�)����&~4�A��y�E�F�^�����^g�<Y�؉2��J�n�Uy������7�k�/]�y���L����X�����&��Zm��<a��J���#�5mA6(�q&XDL oۘ����j�l�b@QF�}BD�d�9e��8��� z���c �)��8��� �t�k�����A�=�,Jφ��*���p������x뒅�i~�����#-�=����*��05��&�o�j��S�m��-/Az�X"tѸ�JX>�/�>H?��G@��iH�>VBO(DL�VS�;���O]�� ��F�V��M�n9���o!e����k���s&�펖"��uQ|��!;���%���6�mqVp���3#f��@�>y�Bt�CøNmҖnÝb��~�$���I��a��7)�a�L
.��*^����6i���6��ǁY��z�f�5��%��e��&Z���b%�ډ�W���m ��c�A����?.>xO*�ۺ�rF:/ԫ�Pa�KJw^TH����{���u͙A��>=�A]Ld"��8����
�`@�]�<ډ}��I�6t�t(uPW&�=�.����;)���-�3���Sϋ$�'4ğ�Š�tX
H�w^�Px���7�:��ԲJ\���
o2 U�B�- ){D4:�KQ���MO7���a��Zm�� �X�e��{",�BwP�;� T�飖`7��J�ZL�h+����
垘؆ ~��N��i`�������n�F�I��l�@bLj�G5 �C2Ðy��:��>-f���u���E�S6s�zS:D� ��q �����|���-"с�Z�?V.kM ���Ӭ��-Н��rN�lkv������H#�P��D�%z��U3 ���G�W���su>W�Z{��Cx�K��:�AV6��Nڢ��l�ac3<뎃fD�M/���d�D�?:�v��Oy4���Gf�~`#�>_/�����]�)���,����e� �sX�vA>�HMN�4��p���� ���b"1�ܴ�E�v�ٶ#mY W�V�/���A��Y�F��b�����hv��� �g5N�C��eg y^������,�F��*9[�GcH@���1��wn�����������9`q"-ԋ=�W���G����͕��~��> ���i ���B5k�X���V��F�n��8?ʂc�뿉�ztrGg����s�8q����7��;X ��{ɍ��:�: ��8��S���3�BnL �.�ȁ��S=��|�z��,>�
��Ijr��R �$��E��,t0����rY+��<�W} =�!I�,��z��� T�U�
Name
.text
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.acedia0
Size
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.acedia1
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Rebel/Bin/Rebel.dll
- IMPHASH 5dbd05d0457a91e7c32b011f85e7842c
- SHA256 c9b95b9204234edfab46912d21953e3a6985a6b7d50c4fd63372e3d5361c7f3d
- MD5 660d2429fc5f088bd197fb0958303936
- SHA1 4189d1ba115f9e00caceb286f22655c6988e1eb6
- SHA512 9875fff045460f77dfc21cecd1de326d67778efd12fe8f53fc09bacfec807a9309752ed4bbb23653060fbee9152dd7c9a9bfda3a0c13c0375a1db932a02a197d
- SSDEEP 98304:kz+S5QwKbQLCsjIpdUqsQf3/sfRMyxl5dn5Sz29f49EzFgfVp+t:WrS2LXjIpyDS3/0aWfmC
- MD5 SHA1 SHA512 SSDEEP
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6845885
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Nezy\Desktop\Rebel-Mod\x64\Release\Rebel.pdb
user32
keybd_event
GetProcessWindowStation
GetUserObjectInformationW
ws2_32
shutdown
crypt32
CertGetCertificateContextProperty
advapi32
CryptDecrypt
kernel32
GetFileAttributesExW
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-math-l1-1-0
floor
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-time-l1-1-0
_difftime64
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-multibyte-l1-1-0
_mbspbrk
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
callback
Name
.text
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1004KB
Virtual Size
1003KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
143KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.acedia0
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.acedia1
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
233B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=253, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=27, id=261, version=31935,
count=6, id=257, version=31935,
count=789, id=260, version=32217,
count=35, productName=Unmarked objects (old),
count=13, id=257, version=29395,
count=525, id=1, productName=Unmarked objects,
count=94, id=260, version=33812,
count=21, id=261, version=33812,
count=51, id=265, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Rebel/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
336350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
320KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Rebel/FastColoredTextBox.xml
- SHA256 f3f2e537065317b6ce66dac64042e925bbcea65f00561f9860b7172c9ca07027
- MD5 70d49dec6a333f1d94fb1e77c663525c
- SHA1 184b544e672f4c4cb9ed9cf010da568eed16623d
- SHA512 b78a3c4418a7c5014eb16e72f2113f00353e9e566942f7160067c826c47f1ec2752ae7ede796fc159fb9bae499d347f822401fbc4446e2556cbd680cd595c2e2
- SSDEEP 1536:45SVw7sekyF7o//t3zEzacGE5xa5lIV1/P5:45Sm7sekyxo//xzEz3GlM
- MD5 SHA1 SHA512 SSDEEP
Rebel/ReadMe.txt
- SHA256 4ca7414e2aba6d74826403afb6ccbcc1752297a1b61aced8808b75d80d212f2d
- MD5 1c6c20f0c324e98e38272f1245d24e11
- SHA1 bbb5dc3a18a532529ec6fa88c86542288dd979f7
- SHA512 a30aed5a54580ad73f16ad237f82e2dc99c99d9645d40d1fbdf88a7d6c10c238b6967c011ba46c6084d409e4a37b41983d600146f93cd9250a810b7d784d8246
- MD5 SHA1 SHA512
Rebel/RebelCracked.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 11b8d77615bf67f99ff344792f5739eb73157866f548c59ebcfcac70d5a6ef88
- MD5 f000635d073452067c4cb62e5b86dc89
- SHA1 9b0738a6b5ef860f99b1c1c63051ec9df64c00ad
- SHA512 ae3627afaf1678cf9707ebc97aa0f052ec9cda45e278edc8ca58236ff39c034f65d5391071545188bbe8ea5a6ca863cf9a52c03e334d7edd2f52889d25ebf6e6
- SSDEEP 196608:pUOSVLnGmLiOwurZtOtvPpEujDSRZjBybLqDDFZhZNSvg23fQnXXOw8sUl6Q/+qS:peVLGQiJurZtO71jDSvVyXqfFbZCbQfL
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12560254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
12.0MB
Virtual Size
12.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Rebel/System.CodeDom.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8c88b0448083663910587efeacb6a1977749fe3ffe83b263fc01f7b63d7dfd2
- MD5 59c830ac0d99f8c906292de85f804b84
- SHA1 68b6740e6ce97de8b1398f3a6e320940a0e16458
- SHA512 4028fa6b68eb3a48bb9625e6755c8e3022283694bb603905af3db54c31bc2f7291aec11f7c42a033703f84c3ff265a19416eb8798058cc42ee3c14c633e9588f
- SSDEEP 384:FuE8ujCiLMTPji3h8241EEqYC0iIcwBxehzsCtZ7U6r1fDMqyt5/WduWTTb2HRNq:FDBCi4TWaveEqYChzZpgRoj/iP9zgBV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
87:e1:77:0b:a1:e0:aa:d7:46:49:65:d7:07:3c:14:3f:a3:84:a8:14:c6:a8:32:6f:ce:06:e0:61:56:a3:c7:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 22, 2024
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
25326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.CodeDom/Release/net462/System.CodeDom.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Rebel/System.CodeDom.xml
- SHA256 92287105a0987fc6ea2404e799da13f2d57b228a1fa3039a6d0cded00d4344c5
- MD5 91af6294c77371e6773c35cfa7edd068
- SHA1 0c24bfafb91ab69a3a7a4bfbd15a9c346341c487
- SHA512 bdfb5c13ee54b88d029bae6a65f932bcf27b1d71a5c373325b2e7484d21d49745c2f3983da85d50aeb6e31febbf0bfcb3cbe46415bae15877c20d54522b65904
- SSDEEP 1536:l2e3vRrYxV4Tm0/Y/LFC9YmXVT2Y3mBhuzRKqn/gCOIFnffP6Ks5ATTglg2PLaAR:lK+c9
- MD5 SHA1 SHA512 SSDEEP