FurkUltraExecutor.zip
- SHA256 4558e5347818874f767466464daa78d5fcbf4180e2e4214e8bcd241cf8cf4288
Overview
overview
10Static
static
10Furk-Ultra...ss.bat
windows7-x64
7Furk-Ultra...ss.bat
windows10-2004-x64
8Furk-Ultra...ra.exe
windows7-x64
6Furk-Ultra...ra.exe
windows10-2004-x64
6Furk-Ultra...it.dll
windows7-x64
1Furk-Ultra...it.dll
windows10-2004-x64
1Furk-Ultra...on.dll
windows7-x64
1Furk-Ultra...on.dll
windows10-2004-x64
1Furk-Ultra... V2.js
windows7-x64
3Furk-Ultra... V2.js
windows10-2004-x64
3Furk-Ultra...ock.js
windows7-x64
3Furk-Ultra...ock.js
windows10-2004-x64
3Furk-Ultra...der.js
windows7-x64
3Furk-Ultra...der.js
windows10-2004-x64
3Furk-Ultra...ipt.js
windows7-x64
3Furk-Ultra...ipt.js
windows10-2004-x64
3Furk-Ultra...rer.js
windows7-x64
3Furk-Ultra...rer.js
windows10-2004-x64
3Furk-Ultra...Hub.js
windows7-x64
3Furk-Ultra...Hub.js
windows10-2004-x64
3Furk-Ultra...ass.js
windows7-x64
3Furk-Ultra...ass.js
windows10-2004-x64
3Furk-Ultra...ode.js
windows7-x64
3Furk-Ultra...ode.js
windows10-2004-x64
3Furk-Ultra...ce.dll
windows7-x64
1Furk-Ultra...ce.dll
windows10-2004-x64
1Furk-Ultra...ss.exe
windows7-x64
7Furk-Ultra...ss.exe
windows10-2004-x64
8Furk-Ultra...s1.exe
windows7-x64
7Furk-Ultra...s1.exe
windows10-2004-x64
7Furk-Ultra...er.dll
windows7-x64
3Furk-Ultra...er.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Furk-Ultra-main/Bypass.bat
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Furk-Ultra-main/Bypass.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
Furk-Ultra-main/FurkUltra.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
Furk-Ultra-main/FurkUltra.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
Furk-Ultra-main/ICSharpCode.AvalonEdit.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Furk-Ultra-main/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Furk-Ultra-main/Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Furk-Ultra-main/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Furk-Ultra-main/Scripts/Dex Explorer V2.js
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Furk-Ultra-main/Scripts/Dex Explorer V2.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Furk-Ultra-main/Scripts/FPS Aimlock.js
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Furk-Ultra-main/Scripts/FPS Aimlock.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Furk-Ultra-main/Scripts/Hitbox Extender.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Furk-Ultra-main/Scripts/Hitbox Extender.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Furk-Ultra-main/Scripts/Kick Off Script.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
Furk-Ultra-main/Scripts/Kick Off Script.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
Furk-Ultra-main/Scripts/Old DEX Explorer.js
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Furk-Ultra-main/Scripts/Old DEX Explorer.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Furk-Ultra-main/Scripts/TopKek ScriptHub.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Furk-Ultra-main/Scripts/TopKek ScriptHub.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Furk-Ultra-main/Scripts/[FE] Chat Bypass.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
Furk-Ultra-main/Scripts/[FE] Chat Bypass.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
Furk-Ultra-main/Scripts/[FE] God Mode.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
Furk-Ultra-main/Scripts/[FE] God Mode.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
Furk-Ultra-main/System.Diagnostics.DiagnosticSource.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
Furk-Ultra-main/System.Diagnostics.DiagnosticSource.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
Furk-Ultra-main/bin/Bypass.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
Furk-Ultra-main/bin/Bypass.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral29
Sample
Furk-Ultra-main/bin/Bypass1.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
Furk-Ultra-main/bin/Bypass1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral31
Sample
Furk-Ultra-main/bin/Helper.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
Furk-Ultra-main/bin/Helper.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target FurkUltraExecutor.zip
- Size 32.3MB
- Sample241105-fd79daxmbl
- SHA256 4558e5347818874f767466464daa78d5fcbf4180e2e4214e8bcd241cf8cf4288
- MD5 998b9a7b04bedb14456b5d56a761fd28
- SHA1 76e2a9dcf2fac8f222ab2dff87dd4be8d174a312
- SHA512 f3251d4deb079412f78bc5f30d20a38630830295870c0e33741cd6f56d7b4c2d4a945c7034b0e82c0ade9fc285b80b26864f68fbbfc7dee228e6019413689643
- SSDEEP 786432:fa4kjUaA57jjYiVhFJBSV3EkG7l1KbDf3ezicMn:fa4kjA7QMhFjSdEkG7l1KbDf3ezZMn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/�[^c `.pyc blankgrabber - Blankgrabber family
- Detects Empyrean stealer 1 IoCs
resource yara_rule static1/unpack003/main.pyc family_empyrean - Empyrean family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Furk-Ultra-main/bin/Bypass1.exe pyinstaller - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Furk-Ultra-main/FurkUltra.exe unpack001/Furk-Ultra-main/ICSharpCode.AvalonEdit.dll unpack001/Furk-Ultra-main/bin/Bypass1.exe unpack001/Furk-Ultra-main/bin/Helper.dll
File Explorer
-
FurkUltraExecutor.zip.zip 32.3MB
-
Furk-Ultra-main/Bypass.bat61B
-
Furk-Ultra-main/FurkUltra.exe.exe 939KB
-
Furk-Ultra-main/ICSharpCode.AvalonEdit.dll.dll 605KB
-
Furk-Ultra-main/Newtonsoft.Json.dll.dll 683KB
-
Furk-Ultra-main/README.md1KB
-
Furk-Ultra-main/Scripts/Anti-AFK.txt253B
-
Furk-Ultra-main/Scripts/ClickTeleport.txt493B
-
Furk-Ultra-main/Scripts/Dex Explorer V2.txt.js 636KB
-
Furk-Ultra-main/Scripts/Enable Reset Character.txt418B
-
Furk-Ultra-main/Scripts/FPS Aimlock.lua.js 10KB
-
Furk-Ultra-main/Scripts/Headless.txt519B
-
Furk-Ultra-main/Scripts/Hitbox Extender.txt.js 70KB
-
Furk-Ultra-main/Scripts/Infinite Donuts.lua128B
-
Furk-Ultra-main/Scripts/Infinite Jump.txt740B
-
Furk-Ultra-main/Scripts/Invis.txt1KB
-
Furk-Ultra-main/Scripts/Kick Off Script.txt.js 194KB
-
Furk-Ultra-main/Scripts/Old DEX Explorer.txt.js 623KB
-
Furk-Ultra-main/Scripts/PrisonHax.txt154KB
-
Furk-Ultra-main/Scripts/PrisonHaxx.lua10KB
-
Furk-Ultra-main/Scripts/Spawnkill.txt1KB
-
Furk-Ultra-main/Scripts/TopKek ScriptHub.txt.js 81KB
-
Furk-Ultra-main/Scripts/Unrestricted Btools.txt839B
-
Furk-Ultra-main/Scripts/[FE] Chat Bypass.txt.js 875B
-
Furk-Ultra-main/Scripts/[FE] E to TP.txt389B
-
Furk-Ultra-main/Scripts/[FE] Fly.txt2KB
-
Furk-Ultra-main/Scripts/[FE] God Mode.txt.js 182KB
-
Furk-Ultra-main/Scripts/[FE] Infinite Yield.txt155B
-
Furk-Ultra-main/Scripts/[FE] Invisible Character.lua1KB
-
Furk-Ultra-main/Scripts/[FE] Invisible Fling.txt6KB
-
Furk-Ultra-main/System.Diagnostics.DiagnosticSource.dll.dll 34KB
-
Furk-Ultra-main/bin/Bypass.exe.exe 7.3MB
-
�[^c `.pyc1KB
-
Furk-Ultra-main/bin/Bypass1.exe.exe 17.6MB
-
main.pyc7KB
-
Furk-Ultra-main/bin/Helper.dll.dll 6.2MB
-
Furk-Ultra-main/bin/Untitled 0.lua24B
-
Furk-Ultra-main/bin/lua.xshd.xml 2KB
Furk-Ultra-main/Bypass.bat
- SHA256 c29fe90eeae955d900405ff44043bdba6d2b76504a1f606dd87f97bcfd61ffa6
- MD5 ed9b8d9a7a6855bd7542906c89df7d59
- SHA1 2fb50de53bb455b43cfe3f52032b245c2c50a3fc
- SHA512 bf2f3138353973f64ac93971fbf50e8ed8f6fb21d38f4c5a7940fb7077323df424da54c9ddcf172280dee97b0caa052eda09466dfc3e3bcc318235d97ff15219
- MD5 SHA1 SHA512
Furk-Ultra-main/FurkUltra.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1f79fa84d8edcf581380c9129f5e392d778d48c8f815f331871d74a95a16d397
- MD5 ae40aa4a810011454626af870b5af1a6
- SHA1 36d59c0bbd384b649d0ca54868be5199729aa78a
- SHA512 a60063b50fbeab343667f463715a9db0194194314ee538383dc11a7693c21aee30345aeb0dc39d0ad494b7d841a87475d16e6b2ec0d78c40eb78fa09220a4a5c
- SSDEEP 12288:+jabtvyU7RBv4XpnMQ9Nx3Ug+YL4UIHDPJKDbn2mFX1WpZOVXfTpU4n81yyU9:vUUbG9zE5YLv29K+mFX1WLkbpUPyV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
950202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\STUFF\Sources\UWP\autoexe\FurkUltra\FurkUltra\obj\Release\FurkUltra.pdb
mscoree
_CorExeMain
Name
.text
Size
920KB
Virtual Size
919KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Furk-Ultra-main/ICSharpCode.AvalonEdit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 202a4719e4b879da67445ab50901d80a259f8680b5d16bc0f929e0a6f6fad199
- MD5 d8f0e3940b5bbe9599ee0a84b541d50f
- SHA1 850d54860f97c431759933fceb92501df03a9e73
- SHA512 1af4b712a6716abaef56f754cc2e63d27b15f9d2d23285e2491b45e714f34acb3d7b026a2f7b316043253f4b7b9c98dc390ad0a53f2016c486bb695499cdca2a
- SSDEEP 6144:wxYTpmHJ01ImQ4JeqcP3Y5hdjxRDSipwypt+9mz+OB4JFDu8n+kUXjWyUO8tKtTD:wKTpmH29/xRxSmzmDuNxHR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
625310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/ICSharpCode.AvalonEdit/obj/Release/net462/ICSharpCode.AvalonEdit.pdb
mscoree
_CorDllMain
Name
.text
Size
603KB
Virtual Size
602KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Furk-Ultra-main/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- MD5 SHA1 SHA512 SSDEEP
Digest
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Nov 9, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
696798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Furk-Ultra-main/README.md
- SHA256 758025ae44c475822077a1d50d6ea37854fecff5cacc4fd956805c514edec259
- MD5 2e42871035e07d1817a00b113bd8e010
- SHA1 d77506d5149c9af0699128f333f5a0c2c8f8cb46
- SHA512 b4ba27d769fb496f70cb3bf23a2d3dd7ab12786dfdee62daa086e092219e920e113125a432ea97be9aa4a1550b065956b6a36679c81fc2f60f210b1491909ff3
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/Anti-AFK.txt
- SHA256 6ec7484d0ef4b0edc5dfc7f815529badb694b363873688509b12cdbb4677bcba
- MD5 f1ada5ce98ba2c8957611b291a3bf0dd
- SHA1 864972feb506802d1e658c6e5724ffeb56cf1432
- SHA512 fb6892735a16a872638826e0cb8a24bd94ef35fe20f16242152f8dbe5ee987496f9c4c96b9821b97d8b9d62f2a44c80fdbeda326df74023b016c04b9f44b9a60
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/ClickTeleport.txt
- SHA256 934628db67869c95edae78c288603e7a80ee571352920c0a67b05d40a123c286
- MD5 6d3d14456637d1209ab6048d83a05600
- SHA1 6921586f83d171be00b5bc669212adbaff9f9428
- SHA512 e7aa9ebc8bd9891b24183a4311f44436e40516cfd9060c4f21b22d6fe3b15d1230d97f7888c95722b2303afb5e7783f29cb94f956b2467e1e9b5587a5cff0154
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/Dex Explorer V2.txt
- SHA256 9cf75612842a8527d3e7c112690b5a0758fb996d536e0d2218cb6c63846a1fc0
- MD5 5c3866fd535e0d8753999abad37cc58a
- SHA1 54b2304611d655ca2a5bb059acb7fd47d59cfc01
- SHA512 1107c62655ef7594cdb6da0f92da96df2b5beaed306fe0d5a8aa70a560c3c5ad5b8a179897d72f53ac87dc59be3eb30aa2be2ef9d600f2149b0d46bbddcf6b00
- SSDEEP 6144:uJCMsX/4Mu4JKM2nw1u/oBSz/+JWoaxqX29kRCmAEkdR8hsE2CDA6q8YnegCi8MY:2w1u/oBSz/+JYTiui
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/Enable Reset Character.txt
- SHA256 0c01237b4992237c9994977f4802fd6fd1f6ca782212c70c863656c1a9207d06
- MD5 ab75d7a5c5a072d019825de5771a1fb8
- SHA1 2eead2ef92fddebf8069eb8861734639120a6687
- SHA512 915e5ab94026339577348dd44b974e88503de1be352ce356428a56627043de473165452e30fae7284f3c960c54e4ea14953fb26440c815469d6efcc663f09e93
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/FPS Aimlock.lua
- SHA256 8b7f73229d13d062fef9c4f06610c382838244495cfac2c8db37f927a87b0121
- MD5 4bbe9d46f882a1f0f04fe3cde85bad84
- SHA1 80d1ee35e7e471f8fe9e5f68cebbd834dae4092f
- SHA512 bc197145316a391ad7126fb24736ad11b90b56e1ee60c29cfb65f5d59673fd1d20cc723546c7b50f4e2cb5faee81d10095d4823d5c25528b811b3760ce664225
- SSDEEP 192:+P+bRz3yGXGkGJGSG7X49o178A3RDeOKxNqDbbrTJ/1ObrTJ/yS6WFMxFMoSfqGy:+P+bRDyUT+bXg84RyDqDbPN1OPNwzeq/
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/Headless.txt
- SHA256 5b2890ef2dae9c373e7de32c9ff2b908f9e9b65321d750f5d975514cd936f54e
- MD5 a03b9239b334e678cd066b9bccbd9b87
- SHA1 d587d9bb8f7aacee10b1f4ecbd3350fe23acf42d
- SHA512 ce763a80027e741d8c8f0964271202356c64028510025431958321433e771dba8a2e5c68e6fd616beb959351e795d849022742d9e958401299923a85b6411056
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/Hitbox Extender.txt
- SHA256 623481eac0575ca1e7decf41b5040142fa4693259c69662a5e6cada2b4b71001
- MD5 cfef731e7d6bd00bce9c97ae92af4113
- SHA1 5f15389bee2a005bd80d32a966b22598b616687d
- SHA512 487a478497af1d4b1f3358e25e5381d6a5f023aa3e345f1d3fae78222fa153f00b0d34c2cdb4dd07b1942d7d59844809c755433b392a22721795067a52d21bb4
- SSDEEP 768:unLcrQJSDv2ptuzvJwucDyxPRe78tTJVmhFLCuMMgNAyBg7LI5:uvJSDvauzvGucDsXMhFLC9MgeyBx
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/Infinite Donuts.lua
- SHA256 ce3e5e8a9831caa5f14e8aa6d760d7134a7369aab6b51396d3ff2d63597c58f4
- MD5 93cbacf7d3d7dcf1d7438bca56a0906e
- SHA1 92701f29e4c1b19b67bec8a3423f9c8395915067
- SHA512 47b4a7d686e19968ce89037cc1566b87f179c459c15ba0a3a62e34a577aeb39de14282621befb6dd773c2eee4011417a7ec9dcf6f3aaf61409442a24725cd29f
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/Infinite Jump.txt
- SHA256 06a33861e3c3fcd546bb69b7802ddfa808259e281632ed1ba3159bb9f8cf2463
- MD5 f2dcdebc7fdd1b8e2496596383f76519
- SHA1 0f71745ced13fb2d54f7defb88ec200c659f04ba
- SHA512 eec687ec06e8bd042e80b0c4912ca57df8de243eaa00611565535f2cb52b9226b397f2c36d7f5f3c9aa55accc04fcafa3341ff1db459de9abc69c1f9902103a5
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/Invis.txt
- SHA256 0197ae424629656ed099d56a5b31314cdb84c3ec5fd0d9b9839ba4cc3c29c44c
- MD5 b5ba35d8b7e6ae8054d0efdf5bfa6acc
- SHA1 7a758047823379efc7c3ff5b7b3d447bc34100d3
- SHA512 547c6b9e1d4421a03553bdfb190b952d8624893a22a641d5ab487c987ac16e552bf7f34444387e86591c7341a1fc5e2dedd6c8d677fdfe3ed7d42d7140af4a98
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/Kick Off Script.txt
- SHA256 54833d16d772645254528c77fadd37d1367d6d53df7a59115aa932bebc140c22
- MD5 4f68808d6169616eae6473b0c271c74a
- SHA1 10839f8a9d6f83f65c4cdcd53bf231611831d9f4
- SHA512 bdd2476c68b4f85b0d7c18ffc2aaa3f62c2940939f9e5427ba86d7cd2c04434b6bbd9beb3ec042db616375dadcb29aca805406329415619f9c53fa0624b2a6fb
- SSDEEP 1536:6GMPEjQmSQLkObS90BWYsluc2axim4/VwT/oDOEXwwWVPmkLJZ:aEjWvJ2aTKOEXwwWVuu
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/Old DEX Explorer.txt
- SHA256 dbb57ae0bb3c180501cf4a2c347686b8d5fb611c5aa02c52d07b72487c0e8a63
- MD5 59bb3358c0ca9b0ea91a7b0ccb555fea
- SHA1 431ec6ca815c82115076e44955cca92111306e0c
- SHA512 8aaaa1e1d3fcc0838e5db10356af2dbf9577146d2d68663bdbf670c9f4721ebbfada5d74cb3c04506715876507e787364ba0736f6e9dcbec63deb97695fd681a
- SSDEEP 12288:kv8/0gQjYXlA1iLG3sZa8rGZ4ni1YrfqNOJkJAFwOJqbzlONWjDurUf+tYD4uPIX:kv8/0gQjYXlA1iLG3sZa8rGZ4ni1Yrf9
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/PrisonHax.txt
- SHA256 6c117ecf4f44ea5afed6f7d8f202aed96ee446f4be0a28cd9ce293842f758ff5
- MD5 e47ac67d1ec302c2f75b518696d45eb0
- SHA1 c86214035524f6ae0de5815fd57ea053d9252daa
- SHA512 0b46bcbbd3d6f37b1840025af4baee2774c90cd4768e0bda1e02b637b5400c50b6fe2212e35b5f2814a8cc65d1f6f5dc62bba7c1d88e8ca6004cf395a5a299e9
- SSDEEP 3072:UrFGAVqFMGAVqFePmTqFZGAVqFYGAtFwwzQmgn+IkAoxVA3hjxm9chichhmZchRM:UrFGAVqFMGAVqFePmTqFZGAVqFYGAtFN
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/PrisonHaxx.lua
- SHA256 d6156ed87c04fcf235c14bf232f4b650cd008d8ec83ba01c0d7425a285a34303
- MD5 8bed9c12ba96421ee81efaeab1b2cad1
- SHA1 493cd49c71c9ff3246fe4a9ae3d21ff416fd6557
- SHA512 c1bdc1be0c343798234352c535e37dd3f44d27c5f296f90e6f60f7d9ce8cb903fa57649d9f0ddb34658a5dcafabe0e736bc7e89c3416d6266c973ee57d73c839
- SSDEEP 192:CrjOgvd0IGncS1COZw8OfduiJa3c2Ujkc2Ujkc2Ujuc2UjWc2UjZ:CrjOgvd0IicS1COZwpfduiw3mYmImymz
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/Spawnkill.txt
- SHA256 0197ae424629656ed099d56a5b31314cdb84c3ec5fd0d9b9839ba4cc3c29c44c
- MD5 b5ba35d8b7e6ae8054d0efdf5bfa6acc
- SHA1 7a758047823379efc7c3ff5b7b3d447bc34100d3
- SHA512 547c6b9e1d4421a03553bdfb190b952d8624893a22a641d5ab487c987ac16e552bf7f34444387e86591c7341a1fc5e2dedd6c8d677fdfe3ed7d42d7140af4a98
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/TopKek ScriptHub.txt
- SHA256 5364ad42dbce5beb80583fc5f318d578f0767360ddda3900eb6c10fe0e7bca09
- MD5 da6db26c9c3bbee0f1ac82e2cb80ee0b
- SHA1 39ba261fd5d36a6234370f3ae9ad680e0e8113c4
- SHA512 4a8bda111e7d4c9228625a81cac81032b6a7675800d0ce58dd0042f3586454e4c5a2208673a0801ae145d5a629303914deae0b503cc0ff240760f6267aa4a46a
- SSDEEP 768:UxpiOrCmOj3qB4EpuNpEUi2rEnr2zkYtXQyphJ63rrrE7NQUWSfYQJB6r/CM7/f/:CrQsjfSnT4mqDO1/kmyFQ9liqN78cmL
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/Unrestricted Btools.txt
- SHA256 10ab345ea1184b6de1ac870bf5cce62d47d425c7c8a3bb64de144cde2409fcde
- MD5 577eea5fd3eb10affa6211c93297ffe9
- SHA1 ec58986ec7b1b63966c68408cda1650044c7056d
- SHA512 a73d31bcad4fd9d7860f72c4f74fdef94465b156298a102ebcadde3098b5519345c2d451862763fc87ff86fafe9ed765dd4c343d6a49e4b5804f1f06a0aaf7c6
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/[FE] Chat Bypass.txt
- SHA256 fbca5616f06db07f96378da5c5c2a2e01628851621d263f219815010350d7ecf
- MD5 a48c6c1f7a4ec0d4fbfb1e8ab47148b4
- SHA1 698cbc610bc9fde33bccdad88b1e7153800d135a
- SHA512 f3514e21d3b4d877ba5e4737024fe5479f38110f5df2f093e576ae19a65a16e73618fb8a9b10e9ae88fa762a54baa3b7122d86bc4ea5a6b5f505f06665f4bbba
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/[FE] E to TP.txt
- SHA256 ab5f58bb9722de9b2ccb7ba8c12d85f6bcaea5fe8bbc3c646d2f482db8b66d0e
- MD5 58fdbf2376580418a84f4a3b0627e0a9
- SHA1 7ea92d0c02dfe703270b5a72970db519c3b23f5a
- SHA512 92849e352ec49b09b59dc1d588cdeb56ef70a220cc3fa624385a3640526107cfe75007f35aa80a7cc3fee9cada08ed263dcfe43b65eff7c4db278b7d7cdf56f8
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/[FE] Fly.txt
- SHA256 baac1bdbe6eec6eaadaca5eed5b2e93c8d11ff4c0262026c571a9863c9d2bded
- MD5 16c87f9ea8e1f15ec8d236fb36ebd14b
- SHA1 50f3c33e17138951fcc36c3478251b52c5df6efb
- SHA512 cde8191663355c3ca6380cb15b39e8ccb43733c2450eb33ab4b8bed9f2666131950f9ce4efd277f7524fc7a11e8ca4a0e7fbbbb74aa21fb134877c792c6256a8
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/[FE] God Mode.txt
- SHA256 9e3c7448087ab8eb788c9ae51cb6f0811f3f62f4bc5875c51878d3e73bcc31ab
- MD5 e4b18f3e252a03ff12e2f5ca0435a9cb
- SHA1 892ca4bfae09248be3e23ecf0e4fb9552d2a68fa
- SHA512 e80268a8dbe6ed0c39a38946380f82abf14ed790cee806f62260de45e8ecda6c8ec4e878692c86442dbc9ed308825eb31dc68df7b7f109fa50c3975e1dfe8c8e
- SSDEEP 3072:oRmZ+7RIYrglkoKxRvJPIsx3LTFS4smsQcePqrnIo44ry9qM3MUq:oRmA7RIYrglkoKxRvJPIsxgVmsQc6qrz
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/Scripts/[FE] Infinite Yield.txt
- SHA256 6ee5622f3f17b68cbb2902c1677c142dfbbb2e13bd8a7efe12fc511327f0dd8f
- MD5 5f622284cc0d2d527a92b6b32d81a007
- SHA1 def4d7db8c777ca5d255d4f079330adc7eba1e06
- SHA512 33b8d744d161b45e6fcc0af93574ec29ce1b65cf80052643a91a8039f9cd22fc4877956bd7d3aa7674b084a4512f9d52b2205021dcb6c66591c67d8378d81d7a
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/[FE] Invisible Character.lua
- SHA256 df5e87a07b49e2447e1e40a0f19f340e13e7e278f320df772707b97a2e2e968a
- MD5 a8178c2dc114ac7dff7c261716082f25
- SHA1 44bb7b6b9dd142f92292a278f515bc55128e46dc
- SHA512 f062a8e1512ef71bfb964ac96d5f3c9138db6cb4aa5b02856fef62eb110b65dbb5fab6e581c0e251b41f5938aa8e2a1f6d8affc23bfa2b8f2928d93069aebb57
- MD5 SHA1 SHA512
Furk-Ultra-main/Scripts/[FE] Invisible Fling.txt
- SHA256 9ae4205499376a2cb45e4385c82479322c138f84955839c256e02758ae44c6ed
- MD5 fd4faf8d3a5f088e1be3524d7b6ec91b
- SHA1 771cef94ec6fd732c0e36421c44b2a31f1bb2eac
- SHA512 933b44eb4de7eb1e38086e617ff5db8e7117121a3de7c0ba813ae426e62fe56cddf94cff35052290a1070eac49c639416ff92c8435fa181b951b4379423edeb5
- SSDEEP 192:6dmW5fdMjLlEH2wi36TO8Laji7U/wHcE3CYaRTlec+A:qffejREHrE6TOBdYaRZeO
- MD5 SHA1 SHA512 SSDEEP
Furk-Ultra-main/System.Diagnostics.DiagnosticSource.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
- MD5 8d9df432109f1cfdd86723b5f171e3d7
- SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
- SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
- SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
PE Signature issue
Digest
bc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2016
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
24690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Furk-Ultra-main/bin/Bypass.exe
- IMPHASH 20d446c1cb128febd23deb17efb67cf6
- SHA256 99935b77b6c7387bb1d572704dd96e804d0a7655e2197afeab8baacc1ad9d067
- MD5 b6fc4bbdbae0300b3c1fd00dccbcfe78
- SHA1 2e14e298c29b2c79cf78a575a79f4488e85a0dd8
- SHA512 02bbacd3cd3d23f7eab4a33901eabeac6f706140e98835e916c97fb995cd747ac7c09494fcf9a90d0e92c5bc6a43123bfc32dcf88b7e1b5c713cfc7ff3ec9c15
- SSDEEP 196608:VuhYS6qOshoKMuIkhVastRL5Di3uq1D7mo:QYSjOshouIkPftRL54DRN
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
75:07:1c:d6:8c:6e:a4:ca:a7:13:54:39:4b:49:68:79:d6:09:f1:22:ef:86:9d:4d:4a:8a:0c:06:12:b5:44:0a
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Chains
Apr 25, 2023
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Serial Number
33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945
Serial Number
bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Issuer
CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 29, 2021 - Sep 28, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
2
Major OS version
5
Entry point
49760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetOEMCP
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetEndOfFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=187, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=31935,
count=40, id=261, version=31935,
count=17, id=260, version=31935,
count=9, id=259, version=31935,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32217,
count=1, id=258, version=32217,
�[^c `.pyc
- SHA256 e54fbb568750c119217b0dc3629c166d95f08e61cf61b810b50a613f5a86dfef
- MD5 ecd740b3c488a962f849718a45fb3ee0
- SHA1 79274383f90b13fcd21bb00a36933725021f51a2
- SHA512 25b438f911b3dcd498f539ba76c790fb556d976224af049037fd9b2ae00ed0859716c813a4d7f0a281332ce962a7731081bc395e8d9cee5a1c496c8dd6bc8c67
- MD5 SHA1 SHA512
-
A stealer written in Python and packaged with Pyinstaller
Furk-Ultra-main/bin/Bypass1.exe
- IMPHASH 1e92fd54d65284238a0e3b74b2715062
- SHA256 9eb4f0e1d1e1a195692d317a04f9cfaf528fa6aba186a05ad23eff3ec30fbb6f
- MD5 2c0c9a7eee5098b51a24a00fa4882c30
- SHA1 c853410921600843726571c4b2250e3c0f0470d7
- SHA512 9532d83bb11b7e614881972c33d0b76e388aaa8db5041a537e8294043c950c7578e80642fed49e78039266197855d049de9e901624bf943574998aca72ca9831
- SSDEEP 393216:tqPnLFXlrgUgQpDOETgsvfGAwgTwPvEeLg4MLA:0PLFXNgtQoEQMwUFH
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
44960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetCPInfo
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=29395,
count=190, id=261, version=29395,
count=10, id=260, version=29395,
count=4, id=253, version=30818,
count=40, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=17, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=9, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=11, id=257, version=29395,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=31328,
count=1, id=258, version=31328,
main.pyc
- SHA256 bf7cb70d72dd7facbc6b118328c917d9619443abdf791665e271bc8bb39d6797
- MD5 fa876117fd9a68d770f22169967038f5
- SHA1 d8fce901221cc39174eb745d585114f63a124043
- SHA512 6277aea67a643ac02763edc9fcc0c180a0c1236a73993679ae943c1cc2b482c1a8cafb2cfa1250bc99786d597dab9cfe18c91c8ed1ce42c81cd81e2fc2248656
- SSDEEP 192:wdXWD8adWdXwe05tNKKJhwi+f6MdwgA0nw:GXuWu9j2zf6Pww
- MD5 SHA1 SHA512 SSDEEP
-
Detects Empyrean stealer
Furk-Ultra-main/bin/Helper.dll
- IMPHASH 8d5d2984e07c57cda0cd5720ad3d2aef
- SHA256 c1eb4052b0a9d672595be10d21ff60a79039c5842d8c98e837251a721549c60b
- MD5 cdf73079a63074805810016f13fbbfce
- SHA1 f7ecbbd392820ea6fb8cbc72911325c440c0c271
- SHA512 2eb5a41dfe01d6b58aba5d27a4b359f8b6ea2b913e465ca839f09b3c334aabe550d4925a6e786540a5c28c9086ed97b2187722f3bf62c54ae92922550f5e36e9
- SSDEEP 98304:ff0ldnefVuuvtLonWJ7gatg6QrkP6G9qvPpZDI0evx+AquS/gdV7Wme+OEDl:kH6tvP613pZkvquddNLhOW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9006696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
WriteProcessMemory
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xout_of_range@std@@YAXPBD@Z
vcruntime140
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
user32
CharUpperBuffW
_is_injected@12
_run_script@16
Name
.text
Size
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.flux0
Size
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.flux1
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.flux2
Size
6.2MB
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
233B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Furk-Ultra-main/bin/Untitled 0.lua
- SHA256 be134748efba0e4398ac6a8854e3d0b0511d2c5de17f21cbe7038f91125176fe
- MD5 10ff13a9784d2ab0113c8361de5d74fc
- SHA1 5969639352ee6d36da03966a790cc0fc9f6fe50a
- SHA512 ffbf76018575a4041ff93f338b69c6eb4e0c5840f63c5ff468de07ae86410a8f0af4c838b6ede6044ed0525918caff1c73da08029a656e91d0a3adb92099c17d
- MD5 SHA1 SHA512
Furk-Ultra-main/bin/lua.xshd
- SHA256 8a4a61e59f2ab48fb2d7b766a7b32ae2de97a051c58558bc4681783b5344ba49
- MD5 2b0eef74ff96593b74b9689a142b8395
- SHA1 02327cff0c3b10bd07cb2df81d2baa80bf7591fd
- SHA512 1664564e019e191f10b5381a5af9fc057fdb9c214153dc355d5278e1023eae8b392e2e3a5dc4249ada5a675e3b27ee729d0e6e0d1c761c7d35797fc0d55b0bdc
- MD5 SHA1 SHA512