archive_54.zip
- SHA256 e9e6a5e4d64f01b158801bbaead6aedfeeb8cd754e734d1471f591ca3e2c08f8
Overview
overview
10Static
static
10d92866420d...ea.exe
windows7-x64
10d92866420d...ea.exe
windows10-2004-x64
10d986bd8230...2e.exe
windows7-x64
7d986bd8230...2e.exe
windows10-2004-x64
7d9a7a84e51...74.exe
windows7-x64
10d9a7a84e51...74.exe
windows10-2004-x64
10d9cf29b555...3f.exe
windows7-x64
10d9cf29b555...3f.exe
windows10-2004-x64
10d9d8ce72be...b6.exe
windows7-x64
10d9d8ce72be...b6.exe
windows10-2004-x64
10da04c1cc45...42.exe
windows7-x64
10da04c1cc45...42.exe
windows10-2004-x64
10da2ab0267a...4d.exe
windows7-x64
7da2ab0267a...4d.exe
windows10-2004-x64
10da4889c628...ff.exe
windows7-x64
10da4889c628...ff.exe
windows10-2004-x64
10da73f61369...a3.exe
windows7-x64
10da73f61369...a3.exe
windows10-2004-x64
10dadf12489e...10.exe
windows7-x64
10dadf12489e...10.exe
windows10-2004-x64
10dae2049164...df.exe
windows7-x64
10dae2049164...df.exe
windows10-2004-x64
10db06d80b63...7f.exe
windows7-x64
10db06d80b63...7f.exe
windows10-2004-x64
10db0b5b8185...a6.exe
windows7-x64
7db0b5b8185...a6.exe
windows10-2004-x64
7db34bce8df...eb.exe
windows7-x64
6db34bce8df...eb.exe
windows10-2004-x64
6db41218c5e...fd.exe
windows7-x64
1db41218c5e...fd.exe
windows10-2004-x64
1db547399ad...cd.exe
windows7-x64
10db547399ad...cd.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
d986bd823023960d3592fbd96b01a297d157c818c3eb3c141794f694fa97262e.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
d986bd823023960d3592fbd96b01a297d157c818c3eb3c141794f694fa97262e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
d9a7a84e51c67d1a641349c9195c4f74.exe
Resource
win7-20241010-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral6
Sample
d9a7a84e51c67d1a641349c9195c4f74.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral7
Sample
d9cf29b5554af511c587d42fc89b333f.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral8
Sample
d9cf29b5554af511c587d42fc89b333f.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral9
Sample
d9d8ce72bea14182d0909964ca07a8b6.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral10
Sample
d9d8ce72bea14182d0909964ca07a8b6.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral11
Sample
da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral12
Sample
da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral13
Sample
da2ab0267a2a37786edfb78c7a6a694d.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral14
Sample
da2ab0267a2a37786edfb78c7a6a694d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral15
Sample
da4889c62855c58d6c05523169436f46cac74ad92b8e173c443bc8225cc8e7ff.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral16
Sample
da4889c62855c58d6c05523169436f46cac74ad92b8e173c443bc8225cc8e7ff.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral17
Sample
da73f613691fb380fa55261dc95a520f5c8b90ecd91ee741b56cb3628ac259a3.exe
Resource
win7-20250207-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral18
Sample
da73f613691fb380fa55261dc95a520f5c8b90ecd91ee741b56cb3628ac259a3.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral19
Sample
dadf12489ed76150718a6ef93c7fe010.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral20
Sample
dadf12489ed76150718a6ef93c7fe010.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral21
Sample
dae2049164a4504d985a9d3aa054939139e01691fe60d175d27fcad81b4b1fdf.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral22
Sample
dae2049164a4504d985a9d3aa054939139e01691fe60d175d27fcad81b4b1fdf.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral23
Sample
db06d80b635eadd508aae82af68fb07f.exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral24
Sample
db06d80b635eadd508aae82af68fb07f.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral25
Sample
db0b5b8185efd6ca7c3f569aec811ea6.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
db0b5b8185efd6ca7c3f569aec811ea6.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
db34bce8df2aa261ca6ff400843ca6eb.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
db34bce8df2aa261ca6ff400843ca6eb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
db41218c5e70c47489a3c8e20c0a0402eb80c67f67b281503589430480d715fd.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral30
Sample
db41218c5e70c47489a3c8e20c0a0402eb80c67f67b281503589430480d715fd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
db547399adb1223b51dd04ca54bc0dcd.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral32
Sample
db547399adb1223b51dd04ca54bc0dcd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target archive_54.zip
- Size 82.6MB
- Sample250322-g17rssy1ev
- SHA256 e9e6a5e4d64f01b158801bbaead6aedfeeb8cd754e734d1471f591ca3e2c08f8
- MD5 7fda1e24ff93dee7a1e0f2a933a4fd4a
- SHA1 84d384a63cb1640437dc615698165067555b4b11
- SHA512 5b32b670828ec41d3ae1152c1c795d218779e4a34c8634b3b627fc8bf41423e73230584f0f3ee744d698d017997a307f2bfe5252e9f8ca36d12737a0f55bcc38
- SSDEEP 1572864:XQ9RSafdtB5chKf3aXnDeQNILK6KuHnPqImecHBs7lqW/xTy6xjrHHaMNiEa4lpN:XQiaj7gKf3wKQNIOXuyteayDTfjrn9iC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xworm
C2
-
sound-kuwait.gl.at.ply.gg:23006
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
Extracted
Family
-
xworm
Version
-
5.0
C2
-
y0sxz-23886.portmap.host:23886
Mutex
-
Nu8ESzXeQ5CGfIYK
Attributes
-
Install_directory
%Temp%
-
install_file
updater.exe
-
telegram
https://api.telegram.org/bot7652540327:AAGYeqytWC570vUvKQiDlj_ZhVhXoUvUbmM/sendMessage?chat_id=7699236265
aes.plain
Signatures
-
resource yara_rule static1/unpack001/d9d8ce72bea14182d0909964ca07a8b6.exe dcrat static1/unpack001/da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442.exe dcrat static1/unpack001/dca9d49ceca4d2a1d01a2859f08a9fe4.exe dcrat static1/unpack001/dd88bfe6b86ae3d674677cf4cf2e44c8.exe dcrat - Dcrat family
- Detect Xworm Payload 3 IoCs
resource yara_rule static1/unpack001/d9cf29b5554af511c587d42fc89b333f.exe family_xworm static1/unpack001/db06d80b635eadd508aae82af68fb07f.exe family_xworm static1/unpack001/db7f9f27f70a8841cee341315be93c13.exe family_xworm - Xworm family
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack001/db0b5b8185efd6ca7c3f569aec811ea6.exe net_reactor - Unsigned PE 24 IoCs
Checks for missing Authenticode signature.
resource unpack001/d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe unpack001/d9a7a84e51c67d1a641349c9195c4f74.exe unpack001/d9cf29b5554af511c587d42fc89b333f.exe unpack001/d9d8ce72bea14182d0909964ca07a8b6.exe unpack001/da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442.exe unpack001/da2ab0267a2a37786edfb78c7a6a694d.exe unpack001/dadf12489ed76150718a6ef93c7fe010.exe unpack001/db06d80b635eadd508aae82af68fb07f.exe unpack001/db0b5b8185efd6ca7c3f569aec811ea6.exe unpack001/db34bce8df2aa261ca6ff400843ca6eb.exe unpack001/db41218c5e70c47489a3c8e20c0a0402eb80c67f67b281503589430480d715fd.exe unpack001/db547399adb1223b51dd04ca54bc0dcd.exe unpack001/db58922e67c5bee13417c175273f4c8d.exe unpack001/db64022baca0adb33fed349f8e651fc64e72ab361568f853582e4dc98bf9f1d2.exe unpack001/db7f9f27f70a8841cee341315be93c13.exe unpack001/db869090bc162639d692cb97a3d3df7b42d1267515fe1c91a1b46a9cd60ad612.exe unpack001/dbe72d2fb37f5496b664d8a17c8d5898.exe unpack001/dc3902a7b09965f812bb7035545391ac30fb188e606a7e9975aa886bdfde524e.exe unpack001/dc8d7390857358ae80c321015cdd1d914e5ec3c4b8a3d04d5c3acfe49d7717fc.exe unpack001/dca9d49ceca4d2a1d01a2859f08a9fe4.exe unpack001/dd2d0ebf311770d6dbdaef1baeabd28e.exe unpack001/dd88bfe6b86ae3d674677cf4cf2e44c8.exe unpack001/dd9aaf6358f7e262de925209ae3806e7f91df1d3c5ff3a0452427d7981681db5.exe unpack001/ddcb6ff5ce9cd75b9b7457b787b165000fab3bf4441509d5a1394983dd0bcbcc.exe
File Explorer
-
archive_54.zip.zip 82.6MB
-
d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe.exe 1.9MB
-
d986bd823023960d3592fbd96b01a297d157c818c3eb3c141794f694fa97262e.exe.exe 580KB
-
d9a7a84e51c67d1a641349c9195c4f74.exe.exe 1.1MB
-
d9cf29b5554af511c587d42fc89b333f.exe.exe 73KB
-
d9d8ce72bea14182d0909964ca07a8b6.exe.exe 885KB
-
da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442.exe.exe 1.6MB
-
da2ab0267a2a37786edfb78c7a6a694d.exe.exe 281KB
-
da4889c62855c58d6c05523169436f46cac74ad92b8e173c443bc8225cc8e7ff.exe.exe 1.7MB
-
da73f613691fb380fa55261dc95a520f5c8b90ecd91ee741b56cb3628ac259a3.exe.exe 780KB
-
dadf12489ed76150718a6ef93c7fe010.exe.exe 5.9MB
-
dae2049164a4504d985a9d3aa054939139e01691fe60d175d27fcad81b4b1fdf.exe.exe 758KB
-
db06d80b635eadd508aae82af68fb07f.exe.exe 154KB
-
db0b5b8185efd6ca7c3f569aec811ea6.exe.exe 5.6MB
-
db34bce8df2aa261ca6ff400843ca6eb.exe.exe 20.0MB
-
db41218c5e70c47489a3c8e20c0a0402eb80c67f67b281503589430480d715fd.exe.exe 13KB
-
db547399adb1223b51dd04ca54bc0dcd.exe.exe 1.9MB
-
db58922e67c5bee13417c175273f4c8d.exe.exe 4KB
-
db64022baca0adb33fed349f8e651fc64e72ab361568f853582e4dc98bf9f1d2.exe.exe 2.4MB
-
db7f9f27f70a8841cee341315be93c13.exe.exe 80KB
-
db869090bc162639d692cb97a3d3df7b42d1267515fe1c91a1b46a9cd60ad612.exe.exe 12.7MB
-
dbe72d2fb37f5496b664d8a17c8d5898.exe.exe 31.7MB
-
dc3902a7b09965f812bb7035545391ac30fb188e606a7e9975aa886bdfde524e.exe.exe 3.6MB
-
dc8d7390857358ae80c321015cdd1d914e5ec3c4b8a3d04d5c3acfe49d7717fc.exe.exe 130KB
-
dca9d49ceca4d2a1d01a2859f08a9fe4.exe.exe 2.0MB
-
dcdd57e7e55442dd40b99a52bae2f959.exe.exe 30KB
-
dd1a7917fc5cfc75ff103d43cba6ffc96d1512f01e443cbc3f518986b4a1e0e0.exe.exe 878KB
-
dd2d0ebf311770d6dbdaef1baeabd28e.exe.exe 5.9MB
-
dd88bfe6b86ae3d674677cf4cf2e44c8.exe.exe 1.6MB
-
dd8b84aaf97695a0ec537b23219c5a55d963e751d3d9c26839b5beed1a92c9df.exe.exe 690KB
-
dd9aaf6358f7e262de925209ae3806e7f91df1d3c5ff3a0452427d7981681db5.exe.exe 491KB
-
ddcb6ff5ce9cd75b9b7457b787b165000fab3bf4441509d5a1394983dd0bcbcc.exe.exe 96KB
-
dde6f22984a36bc2d31cfff96617d32c1aafa551a8acc0d2a148dd06fd63b8e6.exe.exe 810KB
d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d92866420d8daf87ded38ffc92b6a8db1cc13c93e7529db32979a5e52d9c0bea
- MD5 371ac901265784870ebce3b2f6d4c663
- SHA1 624369382a311fd84568a61b309f8414b8ca7c07
- SHA512 28a83331b901295d597616364a429020e7879aaa1abb5c690e98bd96f385a8ed5dbe27435c94d525a678c4cc4e3c6228f00fa5356828ec53b540ac67def51d27
- SSDEEP 24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d986bd823023960d3592fbd96b01a297d157c818c3eb3c141794f694fa97262e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d986bd823023960d3592fbd96b01a297d157c818c3eb3c141794f694fa97262e
- MD5 335f23b40840863a84a2014abd32f4b6
- SHA1 d8a317aafe892dc2aecb85e7580ff2d22e9087d6
- SHA512 93bb49a655459fc9af26e0637f73edf96caae76207e3af7f08899111b345e02a685e73613b3382e25b970e3b3d31b5f697f7007c1d199d7956a3f1a14f47b8f7
- SSDEEP 12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7AY:rBJwdhMJ6ZzHrfcsMGTfZ5PAY
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3e:b6:2c:1c:c7:0b:97:0d:18:56:2d:e5:e9:d8:dc:b3:c2:f6:da:07
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Chains
Oct 30, 2018
CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Serial Number
0c:53:96:dc:b2:94:9c:70:fa:c4:8a:b0:8a:07:33:8e
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 23, 2017 - Jun 28, 2019
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Minor OS version
0
Major OS version
4
Entry point
588750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
567KB
Virtual Size
566KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d9a7a84e51c67d1a641349c9195c4f74.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 98be7f502a04b1116647aec47e8e1061d2c26404d6e7855423371fe01d8f5ef9
- MD5 d9a7a84e51c67d1a641349c9195c4f74
- SHA1 ab7430806db422ec6dc6bf7c378d70f36125c33f
- SHA512 fd9a242d657e746ddd07474fefe772afb1b4060db34bb030d1ce8abd7c4ff1af235b209606ea8f43aaf87ae30e1cbfd5b23986344b23a6a50bf13b35deb97ee7
- SSDEEP 12288:Kmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:Kh4TbLUEhZL/GspeYhkc9Soh2SfwJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1111230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d9cf29b5554af511c587d42fc89b333f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 255fb86d56dbcbf96016d55ccdbe48d2acf7762bb16e115487c4b9991c13bee2
- MD5 d9cf29b5554af511c587d42fc89b333f
- SHA1 cd607ac7223b6023f267b8e2bc072f065604bbe5
- SHA512 2504067df1665cd4b142144b5c5e5085c44bac809e27226fb2bf4230b0cb2966e35c9a99416d22ad261f220f4aaec349a55fadc3d169300d6078853e75267ecf
- SSDEEP 1536:F9wkc4ceDXruTXh+bX7kaAj6McOVBwVCJSdUf:yODyl+bXUhcOvwQac
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
80078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
d9d8ce72bea14182d0909964ca07a8b6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c14f2d55ba7fb0234c638ac3b7b7081e5c94fb27382b081176fd88ae5b90aeb7
- MD5 d9d8ce72bea14182d0909964ca07a8b6
- SHA1 b28d8a45177dc711160d4ea289b88ececf0174fb
- SHA512 78e08e64514d53ae1335caa9c36d66b0e1eea3f52b8fef6fee72cfbc449b6cd3b8f15b432329f7528a7291a438ba96fd8ec6ee4f13a13a30438bd7f98870c256
- SSDEEP 12288:clNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:clNCv6XJ5BClaXfD9vUha+u
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
912286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
883KB
Virtual Size
882KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 da04c1cc45ee3c15dfa9a951b1e3c8d2d3fe4caa814713749b9471f3d1d49442
- MD5 9af38351067812c0e3fa8e5ba3fdab5f
- SHA1 896e6735656cc62d2f9258672683e200c9e30be5
- SHA512 dd35feecbb645e33a4a13247e31fac3cb480c9c9cc6aeca1e9434a082b4d7aaa77585583650358d7507e5e02d9a441c43754897c6bf09baf446346574d870c9d
- SSDEEP 24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
da2ab0267a2a37786edfb78c7a6a694d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 23a803a6c6730cd9ab23656c9d7ddb14f17c21cf25ea6a39e235ae1a132429a0
- MD5 da2ab0267a2a37786edfb78c7a6a694d
- SHA1 f609fe3eb09175ae77aafcfe878be17bccd30621
- SHA512 224105a5f6ad2a8f8d1deaf5a57cd5b1d1869a476a14dd567e1a792571a11afe152f2b8b400c143dcabeae10b9940ecb4fc79345ad17a9e2fe40babc4b7b40f8
- SSDEEP 6144:boy5p178U0MURaGyNXYWQzHazRfXrwSRnWwhrQ66fas:boSeGUA5YZazpXUmZhZ6is
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
251550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
238KB
Virtual Size
237KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
772B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
da4889c62855c58d6c05523169436f46cac74ad92b8e173c443bc8225cc8e7ff.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 da4889c62855c58d6c05523169436f46cac74ad92b8e173c443bc8225cc8e7ff
- MD5 9af5fe2641401056a984b15f527969ca
- SHA1 6d71a8f2b329bbb10c2f216070b0c4b2d99f8cfb
- SHA512 025fa7b5755138dc84524665a3c5311e8202eb47129f223397fc5b12d1718dc99652383917e0137db630f5a7807f5d98b790d5e6d224b166b9fac51bc1613975
- SSDEEP 24576:DD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjo7:Dp7E+QrFUBgq2K
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
32:3d:e0:3e:f7:a0:20:99:a9:ab:d9:4f:0a:66:71:67:3d:e1:36:77
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 8, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
722670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
698KB
Virtual Size
697KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
da73f613691fb380fa55261dc95a520f5c8b90ecd91ee741b56cb3628ac259a3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 da73f613691fb380fa55261dc95a520f5c8b90ecd91ee741b56cb3628ac259a3
- MD5 0c3baba16f3ab689be48dac074e065c3
- SHA1 3b51ce649e0920a2d252fac27bcd0f2df5766d0d
- SHA512 9694671792a25c4829b30d507864e3b06390a9259c1a015946c582e6debf40475a4ae80d03929eb06e11033b0f5ae4d53373ba198e20bab3760702521c0ab63c
- SSDEEP 6144:utT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rcnKHHk:C6u7+487IFjvelQypyfy7cnKHHk
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
dc:cd:48:f4:19:db:4d:47:78:e7:54:bd:bb:76:ff:28:c2:13:79:bb
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dadf12489ed76150718a6ef93c7fe010.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3769933e54a8e2c3df8af84017b52a270b5307cea7df0386d860214bb9fda3eb
- MD5 dadf12489ed76150718a6ef93c7fe010
- SHA1 1895e40361a27955832e7bc518359440fb716236
- SHA512 4edfdc0b1231d4c757ada0f66711fafb13f812e9c8cc0b10efd41f514732a3ab6607a5403ea2b1c711758a72964ef9cc9cd962e7a5ad0be0356b339677cc9c94
- SSDEEP 98304:ByeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4/:ByeU11Rvqmu8TWKnF6N/1wG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3430773
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.>fc
Size
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.;`{
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.`n(
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dae2049164a4504d985a9d3aa054939139e01691fe60d175d27fcad81b4b1fdf.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dae2049164a4504d985a9d3aa054939139e01691fe60d175d27fcad81b4b1fdf
- MD5 fca5dc41cb882456f8d33d6c9240ba6f
- SHA1 7814a1bb5bab169183ed7c4f873acd57097a4eb7
- SHA512 5399accc19a7bba346524ba9175b0772e1310738a1cdeb6522ebecb8239197d562000c46dedaef55a9b524a880d9fa92407fbf0ab1c692bde4d85daca456fda6
- SSDEEP 6144:ZtT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rcnK4:z6u7+487IFjvelQypyfy7cnK4
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
9b:be:54:45:54:05:f8:a8:0d:da:71:80:aa:99:37:e2:6c:91:58:b7
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 25, 2015
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:7a:7d:96:ed:17:23:de:94:44:00:00:00:00:00:7a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db06d80b635eadd508aae82af68fb07f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 01a66c806b319086b19edef1a9a511211c0978f12c154fcba00ded27f6a79a14
- MD5 db06d80b635eadd508aae82af68fb07f
- SHA1 87e85410d9d92abba7da25c4ff6579ceee9eff74
- SHA512 c500eec47d539cd71359da7046d770796e6bbef50bcb9375a3a3db4807275f9d58c1dcf20ba0b269c2e2fe1bceed27532cb96638fbe26b03e04ac0dcbeebe000
- SSDEEP 3072:DpkFv9i/JOwR4NpVq8BxFRzaqF+o2GQJ7/JzqVfGve:D8v96gVqwlL
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db0b5b8185efd6ca7c3f569aec811ea6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d2b0f426014687a310ac74bfe78da227f506d163d6635527d115c0b96b5d0ab4
- MD5 db0b5b8185efd6ca7c3f569aec811ea6
- SHA1 9b4c4966684020b351943b44bb3be066e23f2ccb
- SHA512 891b19ba225e729d691906a5a3765c248a130c562cb587fe2fee507fd78a2f585e13d851ab23b32bbeed3f87d01cd2f2d50fde9ceaaffbc12f2de6e20f96408b
- SSDEEP 98304:OvGBBkxCZS9bYZhID0qLNYfeW+4IkRpKMzVUp6QRDy:aGBBJDhID0qLNY64BR0MzVUp6QRDy
- MD5 SHA1 SHA512 SSDEEP
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5871646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
354B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db34bce8df2aa261ca6ff400843ca6eb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b500f2020692d8b941db3f3ece9ebdaa043100da525da081a574318cebe132c3
- MD5 db34bce8df2aa261ca6ff400843ca6eb
- SHA1 58c310b630199f8e1213f5a94d8fc1a09013c064
- SHA512 1ecb24e1596ffad4e80f4296886843b5608464e83b0fef64727febba28cdbf12df6355528441b8591c76e1f69ae29323f91a2891f80ed4cd6e6208ab230e016f
- SSDEEP 196608:RQXY82cxqAOz8vuoTyQWzLRRXpFrq86wEIWM0y06wrR:cicxqAOz8vuozWzlRZFu+EIWM+6wN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8372078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
8.0MB
Virtual Size
8.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db41218c5e70c47489a3c8e20c0a0402eb80c67f67b281503589430480d715fd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 db41218c5e70c47489a3c8e20c0a0402eb80c67f67b281503589430480d715fd
- MD5 52b818c373a9aba2551a9cc823485893
- SHA1 3e69f6652ddd9108ae6b7c3735f108cc001c8115
- SHA512 d9a32c4914e91b9724918732ef01a023fe07bcad6fb529bb6401663416c396b6477be974a76640ec17a91a592163f130c39695b00814fbe10d6ad94868c00007
- SSDEEP 192:kLNSWs+WAyaSOmywSoF2pHb4i5yXDuLaE2v1OhbJQ+AN2XWEXWY:kLMymywtcpHb40CuL329hN+WEXW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db547399adb1223b51dd04ca54bc0dcd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 101ccc6b92cebfc2110fc59fe95374d2b7255103cd662a796513cc18f0c6022a
- MD5 db547399adb1223b51dd04ca54bc0dcd
- SHA1 5c5010b0c7d160d19aa37a981f28884c6fb753c5
- SHA512 6f000a5731877d84c56df1b3268f48b6346b5c5710e8044d7b0ecffc03b89f4a40a17049a9f929f9631bf6fbcec8cb35eadd521168d739085771fa8630e5f910
- SSDEEP 24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db58922e67c5bee13417c175273f4c8d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ee36c57a5386a2a5c60dba6006650d1207e7ca8c04f9c1767ef6572cc8571612
- MD5 db58922e67c5bee13417c175273f4c8d
- SHA1 94740edee3f92f650844d976f6ee8a69700c68a0
- SHA512 d9ca90fbeefb64ec36462311ace015dba2085ccb93f1749ce18f044984882f5b927d4ed7f6593ecdbe56242a0980f419e217df6ac3ce0a344ccc41822b90e8b3
- SSDEEP 48:6gm9tQyxZ8RxeOAkFJOcV4MKe28dZ2dEivqBHXuulB+hnqXSfbNtm:yybxvxVx90vkJTkZzNt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db64022baca0adb33fed349f8e651fc64e72ab361568f853582e4dc98bf9f1d2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 db64022baca0adb33fed349f8e651fc64e72ab361568f853582e4dc98bf9f1d2
- MD5 e95eb27a46c2a1f35b01723c5b59722f
- SHA1 02fc413de70c9b8a7a1315fe9ad87bc53bd4fe7e
- SHA512 accc5c939a2f63d77c2b7a9dfcf9c2182a92e1ae67c0e25543b3a9ca7cd755e18c84c7da77dffc69f6ec55dbbca93319fc12e1ffbaab8fc0fc89f2b41897f372
- SSDEEP 49152:LikhSJHCr7o6Dqu6dkH9SJWJ/TiuH0w/CPZGwnUzb4hI00jDKKblJLkB4no:FIWWNdk6CZp6QwK4hI0KDKKbPLkB4no
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2234654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
266KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db7f9f27f70a8841cee341315be93c13.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 425199db502849c856729868e62896209cbaf3af413f726b8c9f0c2b8745113f
- MD5 db7f9f27f70a8841cee341315be93c13
- SHA1 29ef083b0fdbdb989fef9a81db46c311786ae050
- SHA512 2b5bf5e2c43920f1a58ee284cfea35ba6840798e2a392479472b9820bd17159133fd2da73c4632b406a8a02c3195ed83ccfadc3aa1ceb455a8194746cf217f2e
- SSDEEP 1536:06t/SEYH2+uFZhjAzb8Jh6+v19bkvqAcZUmuO++nd9670/OFeY+KJ:0MRnNF2AJZnbkiam7ZMyOFe/KJ
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
87230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
db869090bc162639d692cb97a3d3df7b42d1267515fe1c91a1b46a9cd60ad612.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 db869090bc162639d692cb97a3d3df7b42d1267515fe1c91a1b46a9cd60ad612
- MD5 844835e718865a57de0123d58eb8035c
- SHA1 24e8f92578a203727b52dba48da0af56003035fd
- SHA512 975dc8bc59cad821ae55ed208db27fbe1c8f072f29e9c04e3c0ed7a3f0772aa7d393e00159616abb2f4216318d07942bed02f68eae99280bdec4e0cc0281f7c4
- SSDEEP 393216:yCCxpaCIMsB0qwclpStYn5/ifi++cf74F2T984Kb5yYgT:yCmaC8B9wUpStC5sho2Ts
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13271406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
12.6MB
Virtual Size
12.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dbe72d2fb37f5496b664d8a17c8d5898.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 03b7919ba80f1c00e9f40a377a3d8d31eb226d132e55d7500c375ae4f99d550b
- MD5 dbe72d2fb37f5496b664d8a17c8d5898
- SHA1 31ba3a0b95368bda3979a7f56c41d4b2e07e741a
- SHA512 7b5b30f45acb724b9ed4df08280614befe435d66db318a98cab0bb0c21049de253e8c6b48650f6cacab59b95d1156d4ad84e87b348eec60e189bb7cfaccb9d86
- SSDEEP 393216:dbTSV72+/Wa+Ag8jPB6CH5tqUKG1BcX0LpDbQyWI4nPPve/Tef1p7PbAZu666LHC:MfA8jPVLKG1eKDs9I4nvebY3E1LSH9Uc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1709630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dc3902a7b09965f812bb7035545391ac30fb188e606a7e9975aa886bdfde524e.exe
- SHA256 dc3902a7b09965f812bb7035545391ac30fb188e606a7e9975aa886bdfde524e
- MD5 b33408e4ac533f3db9fef92c2d13963c
- SHA1 af5b48ccd8e949a8b633fd55d0a40f3034a44e1b
- SHA512 b3d781230ebd2392fd3c3d6c014a1d8cebc22691673c3b3e0a1e52c48a7efd2b54eacd568282a2fc11773fd75586a26649721f7b64068d51d5d52c6d06ac67f8
- SSDEEP 98304:xRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/etJk8WD:xkj8NBFwxpNOuk2vtJk
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
dc8d7390857358ae80c321015cdd1d914e5ec3c4b8a3d04d5c3acfe49d7717fc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dc8d7390857358ae80c321015cdd1d914e5ec3c4b8a3d04d5c3acfe49d7717fc
- MD5 28b9d09334047f4cca52ed10a92cd32f
- SHA1 f4a16156645cee5a9a16a2cc272ddbdd6bfe70f9
- SHA512 31717135ef1280cd3750c5d3a621569a44b4e4d15d1af1d339552debf8479129f7f724a99614427740f635b0ea42ac565592e9d13009bdf9e78fbf218e282fd9
- SSDEEP 3072:TkdxnFTduj60qvBKNtop0d6AjEehkrTgtJY2mRf:TGxCj6DvSdEFgbY2m
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
138306
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
127KB
Virtual Size
127KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
dca9d49ceca4d2a1d01a2859f08a9fe4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 93308f1b2cb0b134ba313944b8ae4ebfecd0dc43b45bd6fe99c2b1f7b59b9dab
- MD5 dca9d49ceca4d2a1d01a2859f08a9fe4
- SHA1 447d0365ead0c4ece7501a7cebac366913701948
- SHA512 e8854c73cbf10dec242365fe72c6468b38334776d6039dcd008f4f12451c9cb60393bb8574e3bb6633128bdcce97d4576842db5435920753849b504a5d75816a
- SSDEEP 49152:kDM6kxEuF98kPO2wjovVRbloub6AKcILOw5MNu/I:kNba98kPZwSJayUOwku/I
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2100334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dcdd57e7e55442dd40b99a52bae2f959.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 25f541a0fef3cd478dfb837fc69b5180aa6cba21a89b31648575cf260cb1e659
- MD5 dcdd57e7e55442dd40b99a52bae2f959
- SHA1 8d9e0eaff39549a8918fd62c5c637287cf1c8bd2
- SHA512 b09f1cb19a77b65a85b78f1647f74287620ea9fd63c19a408616febc9fd6da3febdc978b805caf97e2ffe7d52c925bd0583464df93a8f647dc25795445d80668
- SSDEEP 384:GSwPLqusAKYP/GKhwlJCXOxFm7bhCm/z3:xwz9HvK6XiFZKj
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b3:37:a8:22:0d:61:90:8a:37:05:4b:fa:71:69:12:00:64:32:08:d2:d0:13:34:f4:23:c9:fb:72:92:70:ab:44
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=0105838409,CN=DUC FABULOUS CO.\,LTD,O=DUC FABULOUS CO.\,LTD,L=Hanoi,C=VN,1.3.6.1.4.1.311.60.2.1.3=#1302564e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jan 1, 0001
Subject
SERIALNUMBER=0105838409,CN=DUC FABULOUS CO.\,LTD,O=DUC FABULOUS CO.\,LTD,L=Hanoi,C=VN,1.3.6.1.4.1.311.60.2.1.3=#1302564e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
6d:d2:e3:17:39:95:f5:1b:fa:c1:d9:fb:4c:b2:00:c1
Issuer
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 4, 2024 - May 15, 2027
Subject
CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Issuer
CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 26, 2019 - Mar 22, 2034
Subject
CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7
Issuer
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2024 - Feb 16, 2034
Subject
CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US
Serial Number
6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Issuer
CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Nov 13, 2019 - Nov 12, 2034
Minor OS version
0
Major OS version
4
Entry point
12402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dd1a7917fc5cfc75ff103d43cba6ffc96d1512f01e443cbc3f518986b4a1e0e0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dd1a7917fc5cfc75ff103d43cba6ffc96d1512f01e443cbc3f518986b4a1e0e0
- MD5 212348f05b5997a930b7ae2fce20c3dd
- SHA1 8c8618b5c20dfd82c01c7c24a026d67d5795bd5d
- SHA512 4cc31323429763ac8be25b1217696b1eceaddc04124fcf077346b77fe57d0c8e76a035ff380a7520e321e76a8a3a368601655ab27f5e9062eb81b6adfaaf3a9e
- SSDEEP 12288:5p+rgRNyA55IxJ+feDOa9rZj5XqkJD0QrOod7XxlW91RRzwAY3Q:5pugRNJI1D39dlfGQrFUxwAeQ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
fd:f8:c8:95:52:6b:33:5a:c3:65:d8:74:f6:c1:ae:5a:96:89:d0:6f
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
712958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
688KB
Virtual Size
688KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dd2d0ebf311770d6dbdaef1baeabd28e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9b3e494a4d023dd9b185aee8245a49de9fbc91b5a807c63c7d0a5d0187f9ae94
- MD5 dd2d0ebf311770d6dbdaef1baeabd28e
- SHA1 cd2b8c21d855919ed8fbb2de7104fd4015257e93
- SHA512 a408ad7f7774659a777a75c1d87342fe4f404a110f6c98f4b05c0cf249502b5caa35d926b2bd57300154d07fc2735df5ce79b13076f4f5202462cb1bca44ce3d
- SSDEEP 98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw46:RyeU11Rvqmu8TWKnF6N/1wb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3430773
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.>fc
Size
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.;`{
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.`n(
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dd88bfe6b86ae3d674677cf4cf2e44c8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 409e1303e286b180b041717b44900cdc81361268cfbd329b2f74bf9edac73476
- MD5 dd88bfe6b86ae3d674677cf4cf2e44c8
- SHA1 0963f2b4f40303d9925d02824984572c8d38bfab
- SHA512 27128b9dcb1082c71249ce53e33f2d835b99e5415d7dbabb3941dad79abac4e3fadee8373041721cbb0cc168b5e446d6c01d9ff900b9154ff24a131801f3c616
- SSDEEP 24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dd8b84aaf97695a0ec537b23219c5a55d963e751d3d9c26839b5beed1a92c9df.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dd8b84aaf97695a0ec537b23219c5a55d963e751d3d9c26839b5beed1a92c9df
- MD5 7c26cc742175861fba4052c70a6c72f7
- SHA1 d4d5d1bdd31840a4b1e488b4a588128f8cde0d4b
- SHA512 c07ce0cd40e2ab5187265072de3b839cd8ce7deb751a01882a2f73f33c5fea775b4bf5300961d478e9aaa6303a002a378c898e26f7c8efeeed503ad272ed227e
- SSDEEP 6144:JtT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rC2:D6u7+487IFjvelQypyfy7C2
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
38:8b:4d:5d:ba:b0:f7:25:16:cf:40:9a:7f:c2:f5:a2:2a:c3:b9:98
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dd9aaf6358f7e262de925209ae3806e7f91df1d3c5ff3a0452427d7981681db5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dd9aaf6358f7e262de925209ae3806e7f91df1d3c5ff3a0452427d7981681db5
- MD5 28983cdd906a52afa9c493efcfd3d570
- SHA1 67a69ddcb18bf85ab7efac4a7ecf1fc273efdf26
- SHA512 13ceb8e69258661b1edc68258121c2864c956349da19b885b7aaeaeb3c408ebfe62c91d9541cca6d0048281139e812ba057f8eeba9ced8e0a7abad1cb11fc62a
- SSDEEP 12288:125rMyU42G7D2dfsjB/v5h6uSarDC8Z+q:125zwGyWXP6uSsDCZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
508694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
489KB
Virtual Size
488KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ddcb6ff5ce9cd75b9b7457b787b165000fab3bf4441509d5a1394983dd0bcbcc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ddcb6ff5ce9cd75b9b7457b787b165000fab3bf4441509d5a1394983dd0bcbcc
- MD5 111c327a73494906fcca0ea1135afae7
- SHA1 49885ac1a4a0b9edc8c163031e9735d8863a9408
- SHA512 556c94d24997606a96529aa54f6a8199c03064b0a42d5a3dcc8a2e78ad9f908cb6123b142ab40013333b98399b0b12d5b61b3f1538b8626b1034b532416a2566
- SSDEEP 1536:UxxZKHefxJbY/FQm+/kOdDD3zAYQmADnIbWvSxJ2159gEMOA:+Kxm7OmUIbWAI159/MOA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dde6f22984a36bc2d31cfff96617d32c1aafa551a8acc0d2a148dd06fd63b8e6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dde6f22984a36bc2d31cfff96617d32c1aafa551a8acc0d2a148dd06fd63b8e6
- MD5 3ea0c203b871b74508a0b802fd8e495a
- SHA1 d08a4d043977f8094cb58030e0e52112e2fd47c1
- SHA512 861ab0377abb01d9cfec66fca09ffb47263865ce258be52910fe16f4141a3ba9cdaa81348ef269a6bbd0ed02bba3d83490cb6b9924de741289d12992c0e5fcd8
- SSDEEP 6144:StT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rcnKk6:O6u7+487IFjvelQypyfy7cnKk6
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
63:65:80:0f:ca:85:30:af:55:b0:e8:7e:7d:67:71:33:e4:71:cb:a5
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ