astral.zip
- SHA256 cf0b47eafa7787a698bc8dbb62d18f1d16d0659ff7bd7e6312ccb50b08b754b6
Overview
overview
10Static
static
10net8.0-win...er.exe
windows7-x64
1net8.0-win...er.exe
windows10-2004-x64
1net8.0-win...er.exe
windows7-x64
3net8.0-win...er.exe
windows10-2004-x64
7net8.0-win...ion.js
windows7-x64
3net8.0-win...ion.js
windows10-2004-x64
3net8.0-win...ion.py
windows7-x64
3net8.0-win...ion.py
windows10-2004-x64
3net8.0-win...px.exe
windows7-x64
5net8.0-win...px.exe
windows10-2004-x64
5net8.0-win...I2.dll
windows7-x64
1net8.0-win...I2.dll
windows10-2004-x64
1net8.0-win...on.dll
windows7-x64
1net8.0-win...on.dll
windows10-2004-x64
1net8.0-win...nt.dll
windows7-x64
1net8.0-win...nt.dll
windows10-2004-x64
1net8.0-win...on.bat
windows7-x64
1net8.0-win...on.bat
windows10-2004-x64
8net8.0-win...ll.bat
windows7-x64
1net8.0-win...ll.bat
windows10-2004-x64
1net8.0-win...nt.dll
windows7-x64
3net8.0-win...nt.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
net8.0-windows/Astral Stealer.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
net8.0-windows/Astral Stealer.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
net8.0-windows/Astral Stealer.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
net8.0-windows/Astral Stealer.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
net8.0-windows/Astral_assets/Injection/discord-injection.js
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
net8.0-windows/Astral_assets/Injection/discord-injection.js
Resource
win10v2004-20250129-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
net8.0-windows/Astral_assets/obfuscation/obfuscation.py
Resource
win7-20240729-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
net8.0-windows/Astral_assets/obfuscation/obfuscation.py
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
net8.0-windows/Astral_assets/upx/upx.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
net8.0-windows/Astral_assets/upx/upx.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
net8.0-windows/Guna.UI2.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
net8.0-windows/Guna.UI2.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
net8.0-windows/Newtonsoft.Json.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
net8.0-windows/Newtonsoft.Json.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
net8.0-windows/System.Management.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
net8.0-windows/System.Management.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
net8.0-windows/install-python.bat
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
net8.0-windows/install-python.bat
Resource
win10v2004-20250129-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral19
Sample
net8.0-windows/install.bat
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
net8.0-windows/install.bat
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
net8.0-windows/runtimes/win/lib/net7.0/System.Management.dll
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
net8.0-windows/runtimes/win/lib/net7.0/System.Management.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target astral.zip
- Size 5.0MB
- Sample250203-qte8mstrak
- SHA256 cf0b47eafa7787a698bc8dbb62d18f1d16d0659ff7bd7e6312ccb50b08b754b6
- MD5 99f1133043b27927628725cdedab82fc
- SHA1 5c5eff02b8cd8468638712cef2f58df38b678c8a
- SHA512 62c751ef8d6f4977f8eaca662213532eacbcd14debdab16f85c4750e5385d78f55ed8f24a929aba82a719e4fda429be61e15a109bf26178f887636465b4b4497
- SSDEEP 98304:VKq8KgB9itUfnBgeOCR3zyISfP/5Jyb6LswnFbkcoIyeU6t:VKq8KS9itUfnBgeOC1zan5J9LLoLIf
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Growtopia family
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule static1/unpack002/out.upx patched_upx -
resource yara_rule static1/unpack001/net8.0-windows/Astral_assets/upx/upx.exe upx - Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/net8.0-windows/Astral Stealer.dll unpack001/net8.0-windows/Astral Stealer.exe unpack001/net8.0-windows/Astral_assets/upx/upx.exe unpack002/out.upx
File Explorer
-
astral.zip.zip 5.0MB
-
net8.0-windows/Astral Stealer.deps.json2KB
-
net8.0-windows/Astral Stealer.dll.exe 2.1MB
-
net8.0-windows/Astral Stealer.exe.exe 139KB
-
net8.0-windows/Astral Stealer.pdb38KB
-
net8.0-windows/Astral Stealer.runtimeconfig.json386B
-
net8.0-windows/Astral_assets/Injection/discord-injection.js.js 87KB
-
net8.0-windows/Astral_assets/img/about_d.png.png 7KB
-
net8.0-windows/Astral_assets/img/about_w.png.png 8KB
-
net8.0-windows/Astral_assets/img/arrow_d.png.png 22KB
-
net8.0-windows/Astral_assets/img/arrow_w.png.png 10KB
-
net8.0-windows/Astral_assets/img/build_d.png.png 67KB
-
net8.0-windows/Astral_assets/img/build_w.png.png 56KB
-
net8.0-windows/Astral_assets/img/crypto_d.png.png 101KB
-
net8.0-windows/Astral_assets/img/crypto_w.png.png 101KB
-
net8.0-windows/Astral_assets/img/files_d.png.png 17KB
-
net8.0-windows/Astral_assets/img/files_w.png.png 14KB
-
net8.0-windows/Astral_assets/img/logo.ico246KB
-
net8.0-windows/Astral_assets/img/logo.png.png 4KB
-
net8.0-windows/Astral_assets/img/options_d.png.png 28KB
-
net8.0-windows/Astral_assets/img/options_w.png.png 30KB
-
net8.0-windows/Astral_assets/img/thiefcat.ico246KB
-
net8.0-windows/Astral_assets/obfuscation/obfuscation.py6KB
-
net8.0-windows/Astral_assets/sound/hawkish.mp3892KB
-
net8.0-windows/Astral_assets/upx/upx.exe.exe 525KB
-
out.upx.exe 2.0MB
-
net8.0-windows/Astral_assets/version/config.txt5B
-
net8.0-windows/Astral_assets/version/version.txt898B
-
net8.0-windows/Guna.UI2.dll.dll 2.1MB
-
net8.0-windows/Newtonsoft.Json.dll.dll 695KB
-
net8.0-windows/System.Management.dll.dll 72KB
-
net8.0-windows/install-python.bat.bat .vbs 683B
-
net8.0-windows/install.bat38B
-
net8.0-windows/requirements.txt224B
-
net8.0-windows/runtimes/win/lib/net7.0/System.Management.dll.dll 288KB
net8.0-windows/Astral Stealer.deps.json
- SHA256 e065d74b80c7c33ff71f58641cc8f5b999af72248e360c913b9e171074eca9e7
- MD5 ad3899242747075a58ad9e39e902e572
- SHA1 98df4e329efd729afaed9455a506d064b4970dbe
- SHA512 734a6d8bc7bd59009df74bab281e44b5bb11ea6ee2fefe5319a05d36175cba51bbdb2bd1e4c4e25807777f5f672cdbf403dfdd15d02094d1495d57d7243fc682
- MD5 SHA1 SHA512
net8.0-windows/Astral Stealer.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9e2e1e1392cbd5097033cfd40a1d496f9bb31003d7c80cba53eb8cdd100531f4
- MD5 aae3db3d79052fbdd65728644d0b778b
- SHA1 f0dbb597f050d060e4dc6c7c44ed4edccccdae3f
- SHA512 c2fca2b32f1170df4d2aa348ec2276318edaf69d22d983fb7bab6fc0a19a80d29539c969e602c6c2ac318bfed0b15692acd5b31cac8018eb5ed43c0dce5fead2
- SSDEEP 49152:DxsrbCb35u50T5u50T5u50T5u50T5u50T5u50Ls25u50S5u50:DCncpMyMyMyMyMyMTEMnM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2246930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
G:\Project C#\Astral Stealer\Astral Stealer\obj\Debug\net8.0-windows\Astral Stealer.pdb
mscoree
_CorExeMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/Astral Stealer.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 1e7a930303762a3a1f8678da099225d9276d1a9fa16ced07a9fb4f14e0201bd9
- MD5 726c717d3e26f216b316f169ae4befd2
- SHA1 673efa718917cfd5685a3fa91f8ca0607ee59bda
- SHA512 2438ec07d41d19f7c4aa1885408784f5d68bcf979b5481cf0de14bfdb5d91d9b96ef6d651291733e4141e4b8f23bbb139baa04ebb92033ca9c4b9797519adb52
- SSDEEP 3072:PiS4omp03WQthI/9S3BZi08iRQ1G78IVn2sbS7cJp8lt2:PiS4ompB9S3BZi0a1G78IVAcLct
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33218,
count=18, id=259, version=33218,
count=86, id=261, version=33218,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33523,
count=1, id=258, version=33523,
net8.0-windows/Astral Stealer.pdb
- SHA256 c89ee668cbcb667b72b6cc3c6abddea4411f177aa81ed804b98cc9a734c0f9c7
- MD5 7249dfa0ed2bb95e77f5feb0f747c340
- SHA1 9b10480170a9cc109dcc063a2f988d2d849176a6
- SHA512 15fe7544ee09b2a71c7a1a5b767e8c87708fdc63217c3648decec1c6a4f51ee4e833cc5a4cd7c5bdc06da6de58cda316e881e66ed4fa6d34e6effc4d9920f0a1
- SSDEEP 768:5Idve4HZzF0bCZC4sl9EQfHqaNz7q0h2wC:mRZ89EQfHqaYI2wC
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral Stealer.runtimeconfig.json
- SHA256 e1e0974d0e8833375024eb7c78521b3b5cad4228aad22b23d506cbe702445844
- MD5 186a65581e2f29258f54d396660409fa
- SHA1 6f998d3be2e85cb5419205f867135874f27c0a3a
- SHA512 7dea87b523aab01ea3c794779b71bc0b52179e1d5e7b9a45539ddd39c775969ef22853c4c193699aec1e3fa3cbe26e90e3a4881226c52a3aacae1eac260ff896
- MD5 SHA1 SHA512
net8.0-windows/Astral_assets/Injection/discord-injection.js
- SHA256 1df7b0b11b9eca886e8ad118efe0196ca3202f08a2f803c9ed62c99b14d7b386
- MD5 f09e312599375709a60d60e87d4317ee
- SHA1 55dab351087947ecbf2a745a47476c2dbcfe907e
- SHA512 87d78a313eb2515b65d4b33b1ff787d17ad48180b17b03c30cd342a9ece0049e40e411ac91f950b3fece43658624cffb9808da3fbdf1f30e9ff0be3c1e54be76
- SSDEEP 1536:tK4SxabNH1fyDsH4ntTVPV3yTMHQHiM+ta0QUta+Yx4Y7tn1/yDsHYXicLjFfVnM:jb11fyDsH4ntT1V3yTMHQHiMMYx4Y71n
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/about_d.png
- SHA256 3821836239b0f948b430a857f3997a6a15cf304281d098c0362596844132a4d9
- MD5 5bfba4dab24e4644f973f0682cf4de5f
- SHA1 29e428d7f0a5d0151911cbe9090f6c8604daacd4
- SHA512 aac53d2560538c1b67e453bc4db0594734fef7103bfb9d59eadc2582b7980908b0b9c6c2f9db67991e48743e8cb1090527aa276b565f2a65b3ed86742f4d517a
- SSDEEP 192:S7Xkz83WURaZ9KF/GH6oP+dJ8kSwLWstxgQHPzfnDbsguz:S7XkMRZF/GH6LFfL5DpDnnuz
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/about_w.png
- SHA256 8a179789a3ac87d28b8636123e48413ee196e8ae41c3ed35224a08988017eb3b
- MD5 ffa7b62d549c9909dcde60e3f807ee55
- SHA1 5b09032f7ed45775b9dae89676caacd6da877898
- SHA512 9ac292221f6b3b76cc4412a993b7580eb1e7869c613f325241975d511567cfffcd92c480406db385a52c90044c1f5f621f59683c4f4da67fb983c87e144db720
- SSDEEP 192:JUyeCbrQhv76Ol4HNlkIMtS2Rml2R5CpRzFN7:OyW7VlsNlCgl2R5CfFN7
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/arrow_d.png
- SHA256 49399480156615bc73731434900e03f839f697bcca9bb65d7a12327e4d597568
- MD5 3817f0329eb749c6ad737038d072c500
- SHA1 45a2da595f0faf6506168870a996dd41e56957ed
- SHA512 74066315bf41543c3366f6f7efb37ee37963e45b342d0ac1639d5a0c9ad98067c56d566cfa0d6ae1f88eee0db518feb6cf318657e5cc781258dd0d2d75b0fc1e
- SSDEEP 384:kxSnU1Y1RrHxJ1siJ3diiJTzwQ1Wz4ryb8Jc5wMBfhun19popX0Oj:Zz1RrRJHJNii9zwQ1Wz4+b3wYhun1jd4
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/arrow_w.png
- SHA256 c879a67f58f2b5519ec14674821f688374b836cd674bad39508473ce72227e60
- MD5 2aa9fb89f507c2c1984e980e2071bb4a
- SHA1 110848c87f38e7521692cb343d9dcd30991a9a30
- SHA512 bab2d5ec80e5515dac51ede6e5f94c9a35bd269b5092d227e9cf48ae42519c6562c26ef3c8d76e2c89b6b9770fa6efc12e956e74a3ebe41585033bba3d288dd8
- SSDEEP 192:jTaIr54hKmbIBMcMk4Jj2YwdLFKcIKnKRtmefnoy+bMi+xDvEX/D4Dpa8Qmtj9:jOIiUk/k4895xnKRtmefoy+d+9p1xtB
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/build_d.png
- SHA256 889b85bb4d8ff9ee03fa812419920451093840a57a8ca1735de653c5d8bcf7a8
- MD5 25bf42f9ef458447be831bbb05911ca3
- SHA1 581d02a807f3ba6472674b7dcfadc2363dd11a34
- SHA512 a29d90afeb254d65b14616223fb8712fe65ce99c54ff83dcd617362d72b847908f4c1e532739354648574c6aba5fde946f5f2f06d8204b673a4580f5878e1f9b
- SSDEEP 1536:G2Mh1SjZiTjvyDeHYAFKO7f2dQiJZtd9Xhsu3zwAaUI2i7D1b6t:Gh+ZiHn7f2HFMd7S
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/build_w.png
- SHA256 33203318aa80dd6e2efedd9f665fa5524fbf838e4503a0be77b006b78dc53e49
- MD5 dd42543cc4a9da6f1227f5460ff1062c
- SHA1 3da99133896be0d15a0f6966c9c211d1f8306cd4
- SHA512 76fe179949ae9b9ae9fa9003672d6b03f7d8061caa133b3f72dd78d31cd96bc92983a1bb5553d52af66e28d7fd3d91207972f18ca72bdf26a2e5d5ca79cb6ff2
- SSDEEP 1536:3ktVgwa2wLo1bKlv4uVsr9t84NkZayBJFTIgn:3ktawa2wLoWlvNVsr9tOZlBfTIgn
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/crypto_d.png
- SHA256 c367e6d3b31248afc593aa1f7aa4ca008636f4421220a277d17a58e311c1ed4a
- MD5 a35feb0ebb183f5bbc9153026dd37f89
- SHA1 c4b922e604c9e7f38ed2a168511af917c32d5ff3
- SHA512 4821b33cce798e3a8d01a2f57e9d201ece7caf911e986b97c095c0d1fba1294c4a744294d8e56406ab339c2313418b1e0252ac2e3b2d1b448d9f6225b1d26024
- SSDEEP 1536:A3ydy64SQ9jszjIWto0/IXZleNNtqGYUu0Z/XbuydIEuM7/LgdUA+DZrsw2q3FTF:A38yDhw9r/QZlTUPZ/XbNjbLwnHw
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/crypto_w.png
- SHA256 14a73d01c9975944deb757cf88dda46f244bf7ec10c42e26f33d0bb31333bb92
- MD5 e7a58ff5bef30dfab8a80ca5077b75e9
- SHA1 6e2ff41b33e18f708374530a6264c3f6b42fb843
- SHA512 95b841e7b97cee3de8af0cc92eaf8f78347445c287b28c54538f3b3b660d97d4cf1795e3b46187b9e7b52c4c26445040292bf8b848569b79d3d523c8c7351220
- SSDEEP 3072:F/FlE0qojr6G4FUd0LGi8c/xOeJiSFZwL:F/Pq44FUvi7ZfJiSrc
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/files_d.png
- SHA256 3ab2bc97277bc646fbd593ab6f13cb053693ba1bda2808bfaa0213c902e109cb
- MD5 132a574a28cfc6ef25d63cf6b1c905fd
- SHA1 c907cf0a3894c4e630daea63ff5c47e0e4380a0a
- SHA512 e9df5c21b65fa0c2bf45903f4fb8f0d2abd331425d5d0acdd2e361e07a24e0e5d954a0a64378f441008db741de74ab3e4d8a9cc4247f1b520f29df3d99836d43
- SSDEEP 192:srddddddddddddddddddddddddddddWwPRRDkBVwbzh3HEFVgvg9Cp/pPiiDIlMf:j0RDPB8gSCp/p3DIhsFHDVgB/3AYYx
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/files_w.png
- SHA256 69014953842a5c8089cfde7fa279f884d31107d229b2e495bbbd7bf3872171e4
- MD5 97d9d423dfdc94b32056b8e963090aa8
- SHA1 4ab88fe2ce2f9051cc2473aa5ed6f4335e70f96e
- SHA512 77f30730cfcf762c486967d7a68f1c71d88d6b4c0a8adabe9deec6c186344523002321f9925dd724b23364bfb67200487852d0b71f54fcad9e248d87bc554606
- SSDEEP 192:/hItf7DJMKLwok+ELkV0nWLuE6+Q3lRC97ErU1PaF0vYBvKUfs2mB0/ZF5E8fp3v:+VvGvHhWwlRC97ErmPaF0GCUU2B/Z3r
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/logo.ico
- SHA256 eab8c8e0b63f9c7e36bec88095be0454b83e0ef4ea050801ff621411ec16d9d4
- MD5 76cc56ed36875bce61e0bbe4dd9bf6e8
- SHA1 6b1122ab479f0a83a9f8f75b2837a81876b99328
- SHA512 dfd64389d614c13313a522b2aa04fad082166537b1f108e284e87635cd7d1bb2c9b8810a4d61ba2469477b22a8abbf2877546200e5b7bfebd8691351ea05c995
- SSDEEP 384:avvvv+IvpMvvvvvvrJ555550oFFFFs7ZZZZZ8fkkkkk6gVVVVVIGCCCCCC8/+JS:GHZZZZZwkkkkkZVVVVVK7
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/logo.png
- SHA256 b7ff5afacee4665fe44d3adb0d5ab059f8310b9c06d77722c191678f5cb61623
- MD5 1751c2a5022acf8b8b8c4c1cd2bf81a3
- SHA1 666c79f48a644461974ad88bfef3491eb2093abe
- SHA512 1d19f08e53ebed8d7ec6859040813cc36da8bcc53dd9e01248bfae151efb48c1456c62e6c9a704fa70c69a58e1e094b73696b0a4c7040053aed370bad8e172b4
- SSDEEP 96:jSbGQbU+aQtt5tAlCjF/UJ+LkbAulHj24vgdHsT6v:jSVafl6FDLkbAulHjhvC66v
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/options_d.png
- SHA256 0d26c8710e401c4428b4c5214df2b6fdea0dabeed0d6005cbea46771034319b0
- MD5 f99bd429d4a98ad8fde284d387329a9e
- SHA1 dfe01ff030e95727ea2ba31dd83d020f1315fd7d
- SHA512 919f2859a3d76dc77a93df9e253d7238ff39cc777aa02141d2c2a9e8032800a6021a0299df367833788688f547e6722e7dcc684c8e2f0cf0f6e442babd2c4de1
- SSDEEP 768:PanEBILGhsvLz63/58KrI1OajriUfwlPbbAI7GEJvaGkKMkZ:CEBILGhszm3/yK0brgGEJikZ
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/options_w.png
- SHA256 8a5319fdbcc6aefd47bb3fe0138bda7355c84cf0d5c6d9f7503756d5a86a81f2
- MD5 cedc30f87b27f7ba298c5bf5b7bc9f09
- SHA1 c76c8e0d481d24a7044c7faf5ca7db6aca0512b0
- SHA512 45b481b52112ed800225f4acbd0ad9dc1047011602255ee27985ed124e62eca3767309fe196449bd8098f18e65ec6ed41e23f164a971d679c3cb1a354042a11b
- SSDEEP 768:KWLbouz765oEoOddNns9Mq46LX+Z2pIzd9hBPJUhv:/o15oeRIMq46LOQpId9a
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/img/thiefcat.ico
- SHA256 eab8c8e0b63f9c7e36bec88095be0454b83e0ef4ea050801ff621411ec16d9d4
- MD5 76cc56ed36875bce61e0bbe4dd9bf6e8
- SHA1 6b1122ab479f0a83a9f8f75b2837a81876b99328
- SHA512 dfd64389d614c13313a522b2aa04fad082166537b1f108e284e87635cd7d1bb2c9b8810a4d61ba2469477b22a8abbf2877546200e5b7bfebd8691351ea05c995
- SSDEEP 384:avvvv+IvpMvvvvvvrJ555550oFFFFs7ZZZZZ8fkkkkk6gVVVVVIGCCCCCC8/+JS:GHZZZZZwkkkkkZVVVVVK7
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/obfuscation/obfuscation.py
- SHA256 7445dc0c6dafacfe6cda1bf5ac93efb0eab39f1d1f787195c93a8d9b9d8aea75
- MD5 285744b7932bde6ca1bf8ca33534736a
- SHA1 44226fba522b7deb198ac8eb98bbd148c11ae1de
- SHA512 a27b5aa08329bd841c76a7d89872b95f12b083970c8c343973a18d8b15739d88d61f651078d4beefb954d13ef50e1db30eff549512db318257016bca7ea28f44
- SSDEEP 96:BFokKZB5DqxqDxkyjAMwRw+UVt4LsevwLzRCS:BFoTqxyxHjV9nt4IevwLMS
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/sound/hawkish.mp3
- SHA256 7a1e2a2972e1d8af3adda6606ed625cea5bea49b2095c450adc36b2aa4761a8b
- MD5 51e4c0f3806953656791107394272923
- SHA1 9edc4035d1c836ee09ce798e33578da15ec2ed4b
- SHA512 9678a21ea963a5698bce6b72fbc4d69de51e40d27873b36e4ed8c0268594031c01b1cfdea106cd8915c68398f36f2b1bbe816e564e2044e3fb80fbd9acb97ce5
- SSDEEP 24576:iuZTiJmJtzpZPooLgHiokpbS3V/Im5XGMK2n9MW0SY7bPr:fZiOpNooLuUe3tImEMrvk7bz
- MD5 SHA1 SHA512 SSDEEP
net8.0-windows/Astral_assets/upx/upx.exe
- SHA256 a4240ea0e8a916d15f8391edef9705ab4de1f516dd360f0a336c5358686d434b
- MD5 8a98406e32ed6139bd9e75342d452948
- SHA1 ed77737b88a7351d0bc5f542ddb7ce84f8f95588
- SHA512 f5b17975560d97308a6ee66845225715e82bade9df7bc36821c76fe67fcf8d22929bf21b85e28dd11b7399d0109ab1f3786fd2010c2e5023d3a93d2bd5cf678b
- SSDEEP 12288:fOHsWPQsJdQmiR0eYG16fyP8RHzS75CaNgMYqIW7I2:2QmiWK16rRHzS7U6ip2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2102592
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
522KB
Virtual Size
524KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 a84e70f79c993beadbfcade43bf51f63d841ecd27eaced77c0976e70fba9de69
- MD5 6f9617311d2fb9cbbfabc57ed46dbd14
- SHA1 899b535d0d942c60d2d95fa4cbe4a80408ccb8bb
- SHA512 1a71de62b8e6798889525ae3479322d93f2aaa35075adefe49d4d820b9542955ae15638046c78ab83c02da628140ece11dab30c1939e440f5260a012024b277b
- SSDEEP 24576:Y7J+UM2Sqzae2jctbEjviXrGBZUlOQeZp9G9SPkeDkFkH1:dUBacRiBiEQGP
- MD5 SHA1 SHA512 SSDEEP
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
.text
Size
850KB
Virtual Size
849KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
net8.0-windows/Astral_assets/version/config.txt
- SHA256 6754fcea32b88564b0879ceb065063ff5c69d08e65a6046a9f07edb5b324d3e9
- MD5 4fda350b2148254bcd9e67bbdbecdc93
- SHA1 4ea93c6a1e320054f99d66f428e611b31355cd92
- SHA512 a8dc79148dce2a7bd4340e29a7a3b95d43eb9415ffbb0ffa5655b32411baed0257269ea28ae78295d8052067ea0a9dabd76bb70ee9fc51af2e27b3e3d1ada8da
- MD5 SHA1 SHA512
net8.0-windows/Astral_assets/version/version.txt
- SHA256 72c4c1366f4afe80d6b90607b730e10323f9244feb5de4814d9c8b7300bf964e
- MD5 9e5c92fc8cff4cd2a16f85e1ae292162
- SHA1 19f623cc193b791ff01d9653d037fa6b12739251
- SHA512 4b3a0de2039c85900033a279a9a3393114aedbef579456b5d25433c24902f08f0b89c815b39549493b21c6d128a2a7cb5d892dd6584ee26ea7bd9b17a8bf40f6
- MD5 SHA1 SHA512
net8.0-windows/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ac70532408b89159bfe235d4ed228faa03ae3fbd63ec6a82d895f287a3b0579
- MD5 b429ae86c5be521bc8ca3b164cec3acb
- SHA1 387560073ff5a1f2191abc6f75fc34532bbb6dd2
- SHA512 eae65de53da50708983ed8ebf9e1e3dd5f9aea95a354d272e199bb59517f62bfe35f0df7a37d81ab0423d0d6d29304fa70284c731bd54023e446b2c19bacafb1
- SSDEEP 24576:DgWuftU4WrNOA6sM6kXxMfNmnjk/c5NrH0UUoo2QkJXVSItH5ppoO0KzJ6nFwHQL:DA+NOpXm1mnj0cP+DkhMAiawnFV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5e:00:a7:1b:7e:46:57:12:de:98:da:e3:8d:91:ea:26:6d:ef:71:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2226574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
705086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f515ca5c944c332ab706ff0a7c2e53e66d0d9d8a663e9b2691b35129ee22559b
- MD5 1c71e5310151ce1e9a3a92797776bdad
- SHA1 fd452b874fec4a9dae61a3710fb32749dc7d701e
- SHA512 2a4f18c77449c2d06a3ab6807338f73b03b1faa332e78319829ba3a2b6fd98bb9a83c5e29b47d55e4ce7f0dfdcd8524fa592a0f3ca8ee09daae2894b681265a8
- SSDEEP 768:BrEP45HksbMU3se5c/0b/9nLZV1BCUkVoV0lP7H0CkkiSLJKdbY8Mtuo0eDQP9zu:bbz5wulNV1zkSQzHxkxS9yc8no0nzu
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
21:dd:70:75:07:79:76:e9:4c:2e:f9:e2:e8:a9:c9:0c:99:41:ca:c8:0f:9f:d0:4f:af:43:ef:2a:ed:0a:ac:ff
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 30, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 4, 2022 - Aug 3, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
68690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net7.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/install-python.bat
- SHA256 44d62021bd4fa1870a45fc9f1b9bb978196987452688060a87ee97e4626fa4af
- MD5 d2582c98db5aad03be0d391a265f861b
- SHA1 bb545f83d8d69c8a1a08cd773ddcb53689e8f57c
- SHA512 268a5a71c70081ee8d6aa34d0a9158740712e174a70a0fac2972bd8fa812c34107ba2859d2f31391cc4b27f3f81a986160d9feb14880bdf02fe0c43567b2afbe
- MD5 SHA1 SHA512
net8.0-windows/install.bat
- SHA256 60e27d880d37915497117cecaf8919b5330ff908880451e937d4a83a8f563375
- MD5 667537a1c25c3050eba77c74a343329f
- SHA1 794df2143bd7bd07f9ade899d8fb1055b93236ea
- SHA512 19ec6064e8ed3ecf531bb8f051b88314c12e55dafd1380830acdf3496c3f863f8ba4dbb14a898cc4d2523846dfba5b021d4716b55781830be7fcf0bbae3dd011
- MD5 SHA1 SHA512
net8.0-windows/requirements.txt
- SHA256 aad1731050294799ba8541fe29161033bdf42ca2b0fd71f623494c10bf9320f0
- MD5 a584f0855251f50dbac703981d0e5935
- SHA1 af7be10af080f020cef9f5a86c856479784fce21
- SHA512 1f52b84f978c756f7de8e26a01e51170893c56486ed0786c91ade3d263346855b664bc436f60a6e50e7c92d36efd5e76107e39b308f91e523553419a4b227d5d
- MD5 SHA1 SHA512
net8.0-windows/runtimes/win/lib/net7.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7e248c3e6f25f4673e2006fa77f4a4322a3c74c2652dcc395178329feb7ff28
- MD5 76e0aaa7182e77403bf6fe2af8d90f28
- SHA1 d013c5d649f9ebce5bee1c8b774f3290b1f1f532
- SHA512 8e161a375fe174d9b203c2a098c92aff411d8521eef133d5174ae7409c394157f7a067c2a9dfe3f76cb02acbed52c33a11579b9a1cbee75e4092e6487d1a7bc1
- SSDEEP 6144:TMbKUVLmD7HP9ab+T5sBFzPnQpEZFAc2Q:45VL2Z++tw92Q
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
46:92:b4:35:81:df:77:c6:04:16:3b:5f:4b:00:f9:6b:d7:8e:d5:f5:f8:ff:d4:65:68:9d:fe:34:58:96:d2:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 30, 2025
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 4, 2022 - Aug 3, 2023
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
289818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net7.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ