Stealerium (1).zip
- SHA256 52bd450723364176402cba89d3618f122c4106d6d4bd8f0eb183c098daa5f14a
Overview
overview
10Static
static
10Builder.exe
windows7-x64
1Builder.exe
windows10-2004-x64
1Builder.exe
windows7-x64
1Builder.exe
windows10-2004-x64
1Mono.Cecil.Mdb.dll
windows7-x64
1Mono.Cecil.Mdb.dll
windows10-2004-x64
1Mono.Cecil.Pdb.dll
windows7-x64
1Mono.Cecil.Pdb.dll
windows10-2004-x64
1Mono.Cecil.Rocks.dll
windows7-x64
1Mono.Cecil.Rocks.dll
windows10-2004-x64
1Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1SixLabors....rp.dll
windows7-x64
1SixLabors....rp.dll
windows10-2004-x64
1Spectre.Co...rp.dll
windows7-x64
1Spectre.Co...rp.dll
windows10-2004-x64
1Spectre.Console.dll
windows7-x64
1Spectre.Console.dll
windows10-2004-x64
1Stub/stub.exe
windows7-x64
3Stub/stub.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
Builder.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Builder.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Builder.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Builder.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Mono.Cecil.Mdb.dll
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Mono.Cecil.Mdb.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Mono.Cecil.Pdb.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Mono.Cecil.Pdb.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Mono.Cecil.Rocks.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Mono.Cecil.Rocks.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Mono.Cecil.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Mono.Cecil.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
SixLabors.ImageSharp.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
SixLabors.ImageSharp.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Spectre.Console.ImageSharp.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Spectre.Console.ImageSharp.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Spectre.Console.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Spectre.Console.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Stub/stub.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
Stub/stub.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target Stealerium (1).zip
- Size 2.8MB
- Sample240919-d2mlgaydpc
- SHA256 52bd450723364176402cba89d3618f122c4106d6d4bd8f0eb183c098daa5f14a
- MD5 9d0982db376228f60b5088be486b3732
- SHA1 2d857eef9fa7c1106aa8fb27d0ff8cefdd8f81e2
- SHA512 7732971a9f3f17baa48605711f2fe072655f0a02f0e95702b0fb53d8786966cf9436e35fdc5c6e8ab11308f68f00ec830ccf2d65e4abcccebf61a79231c921a3
- SSDEEP 49152:tiEhIWdYcV84L/iexLO3eVKxR96nmWbVdUhlNOY6AuVHJ78q/9dVCazO4jC8Yz8M:t3HdbF8ussn1VdUh2tVHt8q/9v5G8YzP
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Stealerium family
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/Builder.dll unpack001/Builder.exe unpack001/Mono.Cecil.Mdb.dll unpack001/Mono.Cecil.Pdb.dll unpack001/Mono.Cecil.Rocks.dll unpack001/Mono.Cecil.dll unpack001/SixLabors.ImageSharp.dll unpack001/Spectre.Console.ImageSharp.dll unpack001/Spectre.Console.dll unpack001/Stub/stub.exe
File Explorer
-
Stealerium (1).zip.zip 2.8MB
-
Builder.deps.json5KB
-
Builder.dll.exe 216KB
-
Builder.exe.exe 147KB
-
Builder.pdb14KB
-
Builder.runtimeconfig.json253B
-
Mono.Cecil.Mdb.dll.dll 38KB
-
Mono.Cecil.Pdb.dll.dll 87KB
-
Mono.Cecil.Rocks.dll.dll 26KB
-
Mono.Cecil.dll.dll 351KB
-
SixLabors.ImageSharp.dll.dll 1.7MB
-
Spectre.Console.ImageSharp.dll.dll 16KB
-
Spectre.Console.dll.dll 693KB
-
Stub/stub.exe.exe 1.6MB
-
Stub/stub.exe.config759B
Builder.deps.json
- SHA256 d6a04809c3737f76818082a2caf9b80ac7f0e14bc73b2fabdea2df46d9e25a52
- MD5 d41bff259e1ebb625fc788fa681377ad
- SHA1 b5c8b7725d6f885db30e9237682abfec72aa65be
- SHA512 8aaed8b1b2e40c5a631753789fcf34dadf95a4aab29f852a98ecb3dc30dc5c1df11d69081fb17282c78e0310e65567ab7339bc58efba6fc7b6f729f31fc040e3
- SSDEEP 48:nC00u5rEsIXhpXhNXh3JX178dOmuOWhTV7H+qLSYHByD3cHIco3aHEg3HwHf1LHL:YuNEHx7HLSYgD3cIKkQQcsB1vd
- MD5 SHA1 SHA512 SSDEEP
Builder.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6265fdfcd3704a0e32fb60909cc165ca6e2b9dc179076d3ac9ae98b75ca3db73
- MD5 d111fef0621b1fc9ce2e295c1a68166b
- SHA1 6f4a4121e354a2731a05f94c003c62392fb690d6
- SHA512 81957e0632a06bc2c5392463fec30ef7dfba9d040f6c4040b116e747adac8852c8e826c913594100f4efcf57195228a3f306e9e5145941a3f7011adb15c496ce
- SSDEEP 6144:SU53eDAIbr0K3xybL1tAj4PhFqFVfrRbP:SU53mbr0P1tAj4P6r9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
226702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\Stealerium\Stealerium\Builder\obj\Release\net6.0-windows\Builder.pdb
mscoree
_CorExeMain
Name
.text
Size
213KB
Virtual Size
213KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Builder.exe
- IMPHASH a8308de57fce070f4cb88c7f43bf4b27
- SHA256 9a6c4f9fa40505580860859641650846c0e7df493105c85074fd3b3de0f4dbf3
- MD5 0c31d6cbe8f564cab8d3dce01decd6de
- SHA1 83ccc26f982d9f7d8749ccb842f73caae578a4f4
- SHA512 0c67d0ce9fdcb9758ad5d5ef32c334d44950a342bf41fb88eb93f7a10d20ef2bb013be86a97c8530638a1fcdc7d54ffbf2802d6a8895da3d27c23f5bf9eb9a95
- SSDEEP 3072:A5vnr5Tbx829UOeKnn2LFzZBp13u36wKp40ULCgot:ABKjK2LFzZNf/ULl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
82000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___wargv
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_errno
_configure_wide_argv
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_c_exit
exit
_cexit
_register_thread_local_exe_atexit_callback
_crt_atexit
_exit
_initterm_e
abort
_register_onexit_function
_initialize_onexit_table
terminate
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf_s
setvbuf
_wfopen
_set_fmode
__stdio_common_vswprintf
__acrt_iob_func
fputwc
fputws
__stdio_common_vfwprintf
fflush
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-locale-l1-1-0
__pctype_func
_unlock_locales
localeconv
_lock_locales
___lc_codepage_func
___mb_cur_max_func
_configthreadlocale
setlocale
___lc_locale_name_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
frexp
api-ms-win-crt-time-l1-1-0
_gmtime64_s
wcsftime
_time64
Name
.text
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=83, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=29395,
count=205, id=1, productName=Unmarked objects,
count=10, id=265, version=30154,
count=1, id=258, version=30154,
Builder.pdb
- SHA256 d6da06a138f981bd414c6e1e0f1ce30ec15f604f02e14dd4fa6c90ee7dd01f3d
- MD5 d64ed21127d75c8de11dc369ac3c8eb1
- SHA1 72b52d74c89b7eda3c601d2c32f7c3a26c6c1864
- SHA512 9a78035366e173393e3fc22dabcfd6a223a333500098983dd7fbc09f8406522527b26e98e7dad0dc7142e630f76a56cf4a3d89ea1800dcac2be797c08f3755ba
- SSDEEP 384:eMtViWxonIaiaBs4PlGgeHynNttf/teJOWNHFfPwMBUYNSucwZ6:zt6fn5ntePq
- MD5 SHA1 SHA512 SSDEEP
Builder.runtimeconfig.json
- SHA256 ded3aeb5856a11db0b654a785574490cab55839ebfb17efe9e39b89618fc5b91
- MD5 24e4653829de1022d01cd7ddd26e2f22
- SHA1 9160a009cb381e044ba4c63e4435da6bfeb9dc6d
- SHA512 efd4bbba1baec0b47003831510e3aa539db9ef468e0f06ba9d7ba6d0b3800035f7c818d7d90171bfd377ec97d08c4617555bcff635dd83efceb412b1a9cca820
- MD5 SHA1 SHA512
Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2bda97fc302904bf235d631e698a0c81324872dfad2a38e63ef66389155bfcf4
- MD5 0c2d7a3d146e193d7b8e50f0fe398568
- SHA1 bf0a6ab31388eab1ffd3cd87fae62b45e90cba24
- SHA512 5fdc45ae536955e6f66970b35008ce15c5c5624d0b31bd41c79d6548d0d1b950042f51fe7dbbbc33a6256f90f5db23bf0070abe24502a050505be66f086d6df0
- SSDEEP 768:ArF3HuZyOt78PeWSTkazhOOgfGNOV/pVxPRpaCCrHpTFuzL4oWB:ArFecOt78PeWC8OgfGkVh6pTcL4oWB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\mdb\obj\Release\netstandard2.0\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 333397769114ffd13046a25b9cfffd41c44a3450ea9ea1fd13b76eec28e1a815
- MD5 625ce2e8be214194a161fe80e6eca7d0
- SHA1 58944e03ee249618e9440545623c4545777377f7
- SHA512 c324ea36e4a89a6052f685e4f96527323ab6f4eea4f4c70c71f08a84df2d46332d91c3f289463502887d9b098dc6e69036c322630b770531927d5329873b250f
- SSDEEP 1536:mffXkeOyX+6C5S6R7nQSALYKXNgJGsZaBcLevjCXeo:ao5S6R7nNArWJGPBEeveXeo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\pdb\obj\Release\netstandard2.0\Mono.Cecil.Pdb.pdb
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a6d3e6eab8d89dbd6fcf34268a08a6544ea142b6bcc5f665bee62317786b7892
- MD5 6fc634673b94c7ddde6e2ba277f7e7c7
- SHA1 f29feb86a8595d104b3b1b4be809f6e9fbc8f042
- SHA512 51f4782d7a8e2b3ffbb8fedddcfe85379e5adc499a2fd55c29e29628ca9519c33a33daf806eb3b8d01cfc10c964c1cd2558152c000c7ed2a8584f36c58f31c51
- SSDEEP 768:tkU1iy+QMBCocUuk0ThROoUheLXG99gmIt:tkUCCo/KjOoUhpg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32450
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\rocks\obj\Release\netstandard2.0\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c2908709da6761e9b5b9d4d46102d65851145bac987787d6c5a05ffe5689487
- MD5 6d8d43c5d7dbe36ec01ff8b951cf1e0a
- SHA1 d6b8214419870770e1ce398ca06a6a9f0e9e62a3
- SHA512 221955b05d83513fadcb79721c96fd467ea871cfa401b279dc8ade426c88df4cadc884dae7a9c418c1012af202263f31ce8b63ca919e1f725eb7c7e8008c3a57
- SSDEEP 6144:eCDxMlG40kOSV1L6RWDv2F2AEJHwBI+aB:rG1J1LQFLE0I+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
363046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\obj\Release\netstandard2.0\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
349KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SixLabors.ImageSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0d19e3bc90153b7d0360360422355daa569209180dd1e4337f2431148d1d7219
- MD5 523dced95fcb0120698fc194b159a5cd
- SHA1 9f6e4c7269caaf2e09b6961551102b1ec16e60a0
- SHA512 325c9c3a316852ea6156a07317a64e369048dc7cfea21e9ea87f8723cf37515f0dfc0a31ab3bf07155ea27938d426c9832c1fcba1ab6c96573cc44eacfa05255
- SSDEEP 24576:3ruzK1lGe+34AbXwX8WcaMX07Bpu39DhpsRalM9FHBjDkck3IegDkspo4fVz:3oo6WcaMX0zYUkY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1775990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/src/ImageSharp/Release/netcoreapp3.1/SixLabors.ImageSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Spectre.Console.ImageSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 52fef316879f90a3897ec33b8a6ca955bd720c8fe53b4479be01b70fcb7d26ee
- MD5 099edbe28aaacada8a7a12a414a1d68b
- SHA1 0cc1b8ed4448f4c7246dc859a6359fda20c2d927
- SHA512 07995720bc9e5d3b253b5cbe3f2700978950a81819d5064c25fbb6fe860c1cd1b32379136a390ab85f4612d82d4b256ba2d8c46cccdf9de04aab16135c2d6fe5
- SSDEEP 192:SZPAaThmPOaYDr59CUkZNd2AFSm8gCHWjPWfNx6CzOiUYvj4WLwTMVGqy5L5BR5/:iPAaWhq2PX2B1gC2KD6lY8WETKEX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Spectre.Console.ImageSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Spectre.Console.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b9617847d85b8efe32d07c4c28f1d16cadd4bfe45a09fd1e24eb82505f913257
- MD5 46684228e7c345a3368e8a475ec573b7
- SHA1 aef278fbd7b3f6a65227c7b6b64eb6d88f6cc433
- SHA512 ce3ca4c8250bca3e97713d4047d0d874b3b6430014fbc3078b34a9f701a9eaa4b5e990ff99864c19b41eba1dfad74e0f6f1a464bef7b3d5ad825dfcb91b3da31
- SSDEEP 12288:YqVvbKRNvezf2ZOIyY37mkrGpmiv+Y66i7oE4z6kX:nURNvU+SkUQ6icEl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
673238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Spectre.Console.pdb
mscoree
_CorDllMain
Name
.text
Size
690KB
Virtual Size
690KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7b7fb709fbfa417617beda6fdceb611b51f7d4d76881a106c0edf683fd170e36
- MD5 02c88fe38285c217f895ff539c631fc5
- SHA1 b0d560a11ce564c5272e879f321688b97561f55c
- SHA512 45498d421c5f13af6382a2ee54c7e2a044a25334c4186450426e52b96c21b9fb97b17d6ddb515f47c9fb19ab5dab37e7bef0cfe0f544f9bb5896ea5ea18c667e
- SSDEEP 24576:v4XJi2Q9NXw2/wPOjdGxY2rJxkqjVnlqud+/2P+A+ZecdyFoBkkAqmZywr0G:ZTq24GjdGSiJxkqXfd+/9AqYanCLr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1645182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Stub/stub.exe.config
- SHA256 67818858dae8a4d85a158d68ca50bfef345a730dbf12461cfb700f30edee460c
- MD5 a40b70b19e717b2628d2662b61e69f99
- SHA1 c3d59349659cd82fb6b8c093a3df72846541573a
- SHA512 2dfca6af0d7daeafa4803fbf971843e70678eb2ecc73f8559d39a617721c3a9362eba9fd4d158a1227a50d96b6711a9bd9f694eb10532e7caa9694aefa81b794
- MD5 SHA1 SHA512