archive_57.zip
- SHA256 e5d28ec84e4b5f023e3f386cf7e0776850b67e2bad1299413885f3fdd757f58c
Overview
overview
10Static
static
10e64b687735...eb.exe
windows7-x64
8e64b687735...eb.exe
windows10-2004-x64
8e65dc6f84e...10.exe
windows7-x64
10e65dc6f84e...10.exe
windows10-2004-x64
10e67e28bf49...ac.exe
windows7-x64
10e67e28bf49...ac.exe
windows10-2004-x64
10e699919d5d...ad.exe
windows7-x64
3e699919d5d...ad.exe
windows10-2004-x64
3e70b65e1d8...21.exe
windows7-x64
10e70b65e1d8...21.exe
windows10-2004-x64
10e7193d3473...84.exe
windows7-x64
10e7193d3473...84.exe
windows10-2004-x64
10e740e379c5...b9.exe
windows7-x64
10e740e379c5...b9.exe
windows10-2004-x64
10e751c36e12...39.exe
windows7-x64
1e751c36e12...39.exe
windows10-2004-x64
1e7573bcf85...a1.exe
windows7-x64
7e7573bcf85...a1.exe
windows10-2004-x64
7e787228874...9b.exe
windows7-x64
10e787228874...9b.exe
windows10-2004-x64
10e80000db8c...4b.exe
windows7-x64
10e80000db8c...4b.exe
windows10-2004-x64
10e82aaf456a...e7.exe
windows7-x64
10e82aaf456a...e7.exe
windows10-2004-x64
10e864953c3a...53.exe
windows7-x64
10e864953c3a...53.exe
windows10-2004-x64
10e8686658e2...12.exe
windows7-x64
3e8686658e2...12.exe
windows10-2004-x64
3e8add32344...f4.exe
windows7-x64
10e8add32344...f4.exe
windows10-2004-x64
10e8cdbe10bd...14.exe
windows7-x64
10e8cdbe10bd...14.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
e64b687735f08d83a710e6e493346feb.exe
Resource
win7-20241023-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
e64b687735f08d83a710e6e493346feb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
e67e28bf496e7f9625bf94a126253aac.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral6
Sample
e67e28bf496e7f9625bf94a126253aac.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
e699919d5d4dee2a70455861a6aeddad.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
e699919d5d4dee2a70455861a6aeddad.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
e70b65e1d80063b1fdfc5b439f8ec121.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral10
Sample
e70b65e1d80063b1fdfc5b439f8ec121.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
e7193d347375dbb471134f1772410284.exe
Resource
win7-20250207-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
e7193d347375dbb471134f1772410284.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral14
Sample
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral15
Sample
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
e7573bcf859fd192353ba79f43e0cca1.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
e7573bcf859fd192353ba79f43e0cca1.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
e787228874f75520e2a95df7768ba99b.exe
Resource
win7-20240729-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral20
Sample
e787228874f75520e2a95df7768ba99b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral21
Sample
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral22
Sample
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral23
Sample
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral24
Sample
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral25
Sample
e864953c3a95b063ace86177e1914753.exe
Resource
win7-20250207-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral26
Sample
e864953c3a95b063ace86177e1914753.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral27
Sample
e8686658e2163a23de75fe75807e0d12.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
e8686658e2163a23de75fe75807e0d12.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
Resource
win7-20241023-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
e8cdbe10bd3316f1f52cfd57c431f914.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
General
- Target archive_57.zip
- Size 52.6MB
- Sample250322-g2knnatkt2
- SHA256 e5d28ec84e4b5f023e3f386cf7e0776850b67e2bad1299413885f3fdd757f58c
- MD5 cfcf8a48803b5d7e40eb5caa48927daa
- SHA1 cabb20fa9f372588726f179a4cbcd3411dc05f7d
- SHA512 e89d8de61dd1af53cfa72e9f640297dee76499ac22eb1384cad2bf89a03339db892bbf02d02ac0852eb9eba1333eb72d44d15bdf81acc22e781b7a5c6a43b21a
- SSDEEP 786432:y6PaCRm//yxNN//yxNkfZ0iS1H5ZawLcBdQegJwI6T5o5IgJrOHxvnoa4b8/29tl:hLRGatawqhAVnIioVFORvozU2XSS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
topher
C2
-
127.0.0.1:5552
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
rantu.ddns.net:1177
Mutex
-
2eb54f435f25eb81272f7f2f1d81c98d
Attributes
-
reg_key
2eb54f435f25eb81272f7f2f1d81c98d
-
splitter
Y262SUCZ4UJJ
Extracted
Family
-
xworm
Version
-
5.0
C2
-
27.ip.gl.ply.gg:4563
-
127.0.0.1:1603
-
morning-ultimately.gl.at.ply.gg:1603
Mutex
-
MF6dhFMwgcljrzUB
Attributes
-
Install_directory
%Public%
-
install_file
rozetka228.exe
-
telegram
https://api.telegram.org/bot7809829240:AAGhYA4SPUVIk4XcRD9Y4PjF3oUrHO6XJcM/sendMessage?chat_id=5838837539
aes.plain
aes.plain
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
XboxE
C2
-
vncdz213.ddns.net:7500
Mutex
-
e431bd5145cebea0bba46beb9fc0ccac
Attributes
-
reg_key
e431bd5145cebea0bba46beb9fc0ccac
-
splitter
|'|'|
Extracted
Family
-
xworm
Version
-
3.1
Attributes
-
install_file
Mason.exe
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
HacKed
C2
-
127.0.0.1:8884
Mutex
-
e74b08658c528d3d311506adb49a025a
Attributes
-
reg_key
e74b08658c528d3d311506adb49a025a
-
splitter
|'|'|
Extracted
Family
-
xworm
C2
-
127.0.0.1:3775
-
discussion-temp.gl.at.ply.gg:3775
Attributes
-
Install_directory
%Userprofile%
-
install_file
svchost.exe
Extracted
Family
-
umbral
C2
-
https://discord.com/api/webhooks/1351374291261718571/m5LIIWlqorXnzT48pitTuxfMUMetQJ52rJhbTqyDfIywVmJ3ZnM3iUIHTa3R0uTiMSFB
Signatures
-
resource yara_rule static1/unpack001/e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe dcrat static1/unpack001/e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe dcrat static1/unpack001/e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe dcrat static1/unpack001/e8f433b6bec154c4ad99bbb895acf656.exe dcrat static1/unpack001/e9a1acf2afe6da755292a7e199442fd7.exe dcrat static1/unpack001/e9ef90bd89d281622cd2e8454a2471f0.exe dcrat - Dcrat family
- Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/ea07bde8ca505d52b26a02e9a614d1ce274c57d759bd7a0266be6fab700643e1.exe family_umbral - Detect Xworm Payload 4 IoCs
resource yara_rule static1/unpack001/e7193d347375dbb471134f1772410284.exe family_xworm static1/unpack001/e8cdbe10bd3316f1f52cfd57c431f914.exe family_xworm static1/unpack001/e97a4629d0932ecf65a8e3e587138b7ede3216894441c57ae3aacd6a21a97f44.exe family_xworm static1/unpack001/e9ec51975ec96019c83b4cffb33956c5.exe family_xworm - Njrat family
- Umbral family
- Xworm family
- Unsigned PE 31 IoCs
Checks for missing Authenticode signature.
resource unpack001/e64b687735f08d83a710e6e493346feb.exe unpack001/e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe unpack001/e67e28bf496e7f9625bf94a126253aac.exe unpack001/e699919d5d4dee2a70455861a6aeddad.exe unpack001/e70b65e1d80063b1fdfc5b439f8ec121.exe unpack001/e7193d347375dbb471134f1772410284.exe unpack001/e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe unpack001/e7573bcf859fd192353ba79f43e0cca1.exe unpack001/e787228874f75520e2a95df7768ba99b.exe unpack001/e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe unpack001/e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe unpack001/e864953c3a95b063ace86177e1914753.exe unpack001/e8686658e2163a23de75fe75807e0d12.exe unpack001/e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe unpack001/e8cdbe10bd3316f1f52cfd57c431f914.exe unpack001/e8e55ad9c18ac9869f352052d9738465.exe unpack001/e8f433b6bec154c4ad99bbb895acf656.exe unpack001/e908379ed8cc4a11e08ad222ba2b2af1d01d6449d1c7cc6e5029ddedcded193c.exe unpack001/e9128f6bf95a40073604a8605c153624.exe unpack001/e92636607a3572cdbce9939615011f4f7c93bab97770cd6fcc623ba3fc925084.exe unpack001/e92bf0aa6cc65d57aeab105e44525f55.exe unpack001/e954ed3b07a38264bced63faeb08ef11.exe unpack001/e97a4629d0932ecf65a8e3e587138b7ede3216894441c57ae3aacd6a21a97f44.exe unpack001/e97ef8e8de1c8e127ce6b995bc7ebdfe.exe unpack001/e999ae5c438afe67d8ee58db451530ba.exe unpack001/e9a1016658a3269c308879399964b90c.exe unpack001/e9a1acf2afe6da755292a7e199442fd7.exe unpack001/e9d56aae5bc564df42e84e8652b247d75e6dd9b1515a6bfec42e2c477c4b3d62.exe unpack001/e9ec51975ec96019c83b4cffb33956c5.exe unpack001/e9ef90bd89d281622cd2e8454a2471f0.exe unpack001/ea07bde8ca505d52b26a02e9a614d1ce274c57d759bd7a0266be6fab700643e1.exe
File Explorer
-
archive_57.zip.zip 52.6MB
-
e64b687735f08d83a710e6e493346feb.exe.exe 228KB
-
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe.exe 2.0MB
-
e67e28bf496e7f9625bf94a126253aac.exe.exe 143KB
-
e699919d5d4dee2a70455861a6aeddad.exe.exe 43KB
-
e70b65e1d80063b1fdfc5b439f8ec121.exe.exe 31KB
-
e7193d347375dbb471134f1772410284.exe.exe 41KB
-
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe.exe 1.7MB
-
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe.exe 537KB
-
e7573bcf859fd192353ba79f43e0cca1.exe.exe 2.1MB
-
e787228874f75520e2a95df7768ba99b.exe.exe 984KB
-
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe.exe 1.6MB
-
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe.exe 5.9MB
-
e864953c3a95b063ace86177e1914753.exe.exe 5.9MB
-
e8686658e2163a23de75fe75807e0d12.exe.exe 2.4MB
-
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe.exe 2.0MB
-
e8cdbe10bd3316f1f52cfd57c431f914.exe.exe 33KB
-
e8e55ad9c18ac9869f352052d9738465.exe.exe 78KB
-
e8f433b6bec154c4ad99bbb895acf656.exe.exe 1.6MB
-
e908379ed8cc4a11e08ad222ba2b2af1d01d6449d1c7cc6e5029ddedcded193c.exe.exe 129KB
-
e9128f6bf95a40073604a8605c153624.exe.exe 78KB
-
e92636607a3572cdbce9939615011f4f7c93bab97770cd6fcc623ba3fc925084.exe.exe 28.9MB
-
e92bf0aa6cc65d57aeab105e44525f55.exe.exe 78KB
-
e954ed3b07a38264bced63faeb08ef11.exe.exe 23KB
-
e97a4629d0932ecf65a8e3e587138b7ede3216894441c57ae3aacd6a21a97f44.exe.exe 229KB
-
e97ef8e8de1c8e127ce6b995bc7ebdfe.exe.exe 984KB
-
e999ae5c438afe67d8ee58db451530ba.exe.exe 37KB
-
e9a1016658a3269c308879399964b90c.exe.exe 108KB
-
e9a1acf2afe6da755292a7e199442fd7.exe.exe 2.0MB
-
e9d56aae5bc564df42e84e8652b247d75e6dd9b1515a6bfec42e2c477c4b3d62.exe.exe 3.3MB
-
e9ec51975ec96019c83b4cffb33956c5.exe.exe 80KB
-
e9ef90bd89d281622cd2e8454a2471f0.exe.exe 2.0MB
-
ea07bde8ca505d52b26a02e9a614d1ce274c57d759bd7a0266be6fab700643e1.exe.exe 236KB
e64b687735f08d83a710e6e493346feb.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c5527f31480ac48e227122ccc4239db78bf3094bbbba6f6e1dd6c30e788ac7ae
- MD5 e64b687735f08d83a710e6e493346feb
- SHA1 42330b4138ce8d74ddf94ccde3cf56678aea4c78
- SHA512 f51fb52208429fc9b97881f23d34145bf06a9526827c1ce19240fbf21b1627d0d9b6012584c98ce432a72470fcf33a7e3ec344085f1c83822f29f6accb8846c1
- SSDEEP 6144:RPTRtufdY7vzXpjYgV53GUEMlqJ8eFNL++y:MG7vzZXW+4NH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
238990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
225KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e65dc6f84e8571ee0c8d0df1c15ab10c168f9e8951c0e9d61bae78ca53bb1e10
- MD5 7557bbff187c92eb67752330d640c103
- SHA1 cb6d84da9ed514d1bbe319af28ae240752b18bfe
- SHA512 0e3f9b5bc0accf6e7f18eaeab13a9be6c75eb4414d065aa58b3a2de05740241eea16aaff8fff3e047668a26651c6a27beabe6c2c76897d08ac69c1718b08c885
- SSDEEP 49152:7rYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:7dxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e67e28bf496e7f9625bf94a126253aac.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4549878374bcf9d4b5b872e0423eed14635eb8c9317c9d3da1bff246c6034aae
- MD5 e67e28bf496e7f9625bf94a126253aac
- SHA1 0fa0895e7332dcd5671e5debb90931bbb19653af
- SHA512 5a6bcf68b213b843ae26a783fa08cb20bca4f8b5ec84fb1e8eff20034da57072cae71950fdbeff99bb7f573d8752c2ba083052f39bf3a7730682e7cf255f32d3
- SSDEEP 3072:xPd4n/M+WLcilrpgGH/GwY87mVmIXhIHVSsr:xP6/M+WLckOBhVmIYBr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
137582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
516B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e699919d5d4dee2a70455861a6aeddad.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 bbff4d03281a83df13c01bf5b2dbdb8c0510993c88954321c1483cf0ecd7fa56
- MD5 e699919d5d4dee2a70455861a6aeddad
- SHA1 bc692ff7f936247df00ca166feb3f905da04794b
- SHA512 42985e0a96f854bad3739de65108723dbfcef4ff7cd2e54ce7970ca63c64eb47ff16c1a5f3be4f4b9ea0c83ad7ad41aaeaa60d6200da6d392c6182df618c6067
- SSDEEP 384:3Zy+Uun1iDcsyEqt3ptKwQmMxGhOEEW9D9O5UE5QzwBlpJNakkjh/TzF7pWn/Ggy:JHnU4pEqt5tKhqhivQO+aO+L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e70b65e1d80063b1fdfc5b439f8ec121.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 be397dc5de47dab7fe463cc85e584959daf279c54a14063432598b4f237e2c88
- MD5 e70b65e1d80063b1fdfc5b439f8ec121
- SHA1 e57593fb0e9a33cb82470b402d93ada69f6bde0d
- SHA512 d6acae917fc56eab81f496b3d06ff4f1ca3b07edbabb2f4de41cd2d98d480ca45f659ccf10d56ea3ffc61b71b77509877adf8557835c4e9d34b1f318c7a55248
- SSDEEP 768:pj8p5d5rLmzxBuJJKye8nu4LPv67QmIDUu0tiNJCj:evKO+4jwQVkTj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e7193d347375dbb471134f1772410284.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ff976ade83191c5dbd4a095a3755faeb92ea0fef940a9e191c1e92a2e448ba16
- MD5 e7193d347375dbb471134f1772410284
- SHA1 cb2e5a367488fc004eb6469cdc49d8278835efbf
- SHA512 f8ff2e91511d1060a414c029b7fe71009ce10e90dc4e0cdd66f1051cbfd01f7adb68b0843708dd8d6d86a846401d7a84f97528a74ea3b54fb35e7ec49c9e5550
- SSDEEP 768:EqZAuyVGTZgZm5Plxjvr6F5Pa96NN106tOwhk33Qw:EqZAuy8ZYmBjeFY9oNS6tOwCgw
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
47646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e740e379c5b6d33ab42fea238735745f5965d78dfbca807496686cd94cfa57b9
- MD5 acec4e3a3a6a8a6ce6aa2cd917bfb911
- SHA1 87dbf1d948f71fb4b62b1c18289df01637bf76b9
- SHA512 2eecb7e1ebd091062edae5619e3850ed763432a9024a01046e63c3cfd8fef3f74f2e046e00959da67fc02aebb128bfef479600955a0153966ae84a37b3a877cc
- SSDEEP 24576:hD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjom7:hp7E+QrFUBgq2v7
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
db:38:5e:f2:ca:c7:0f:df:96:b3:aa:97:c9:b8:5c:b0:7b:dc:42:50:04:5b:9b:b5:be:9b:ca:3e:de:ab:d4:0d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 20, 2025
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
722670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
698KB
Virtual Size
697KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e751c36e12f90580dfa17b05b50269a413ae64807c60a7a0f1e58bcd38f6fb39
- MD5 0ebe1df49d3810aa2345de3c1179c39f
- SHA1 b1d6541cc7db9e3065fc81eb95207a588ee60ced
- SHA512 14d5906c3347b8f7d7debdc8fafaa33762f1f009057e7d3fc66f4347a8845662315b4c9b466219cd2d38b9ba19c6ab03147c4a530b577813179388428caf1cd1
- SSDEEP 6144:V2uu5QRM/XRVQBk2WYjEve6VlWT8b96v0NwnSbaNCzP6akbLOdEcixR:V2f5VQUPVle80v7aUOdEcixR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
555406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
534KB
Virtual Size
534KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e7573bcf859fd192353ba79f43e0cca1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f2815a4651b0b255e936709905c664b0c239f14523caf00879c6a9d6b66132f5
- MD5 e7573bcf859fd192353ba79f43e0cca1
- SHA1 92d91a8d995daa54c835839cc5ac0f3e91425a65
- SHA512 a9e759da56ebc339cdecfecd64ee4aa3d7b26f3099d827a9afa1a35fc49b4bdc1c8e87ec0b255184080cb3d1966a6310d1f9f70621d2d63f1c3a81a0b422ee13
- SSDEEP 49152:S/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4Cf/:r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2135918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e787228874f75520e2a95df7768ba99b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4acafc42154659f6098bf63fa5671b7ab8b72d27785ad7737112ec2dbbc32bf4
- MD5 e787228874f75520e2a95df7768ba99b
- SHA1 03c4f765750cf2f42f3421f80353376a665ab9a5
- SHA512 48ea43fe8cfd0a7f5f9609ec30546ab3e9a356d0bb03327e9edf2899daf1251059ba8397061e560090c1eb33f9887ae7c23756fed263266311701f1f36c33fcf
- SSDEEP 12288:LzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:LzZvuGD2PvA5YxwmbZB6Uv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1013790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
982KB
Virtual Size
982KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e80000db8c58338a7944e72e30e5ece016290acb6bd9a2129e796ec576da934b
- MD5 d49f9f0f5730138879ce947728596fe0
- SHA1 4757810dc00db1570dfd3508acaf6fd47b925e07
- SHA512 099508a93873b25601ab8e187cc731a00d6248455a3e60738bfc0f0d9eb23504f21cdb121b30fdd63d82eb5fd597f7f2a4629f489551dc7b08cf96acb68dbe9b
- SSDEEP 24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e82aaf456af5fe5a644f8dc0d34133c9b37337bb5ab028fc75ab448a30cae0e7
- MD5 1e36a4648b29e6f1e182d0db0c45a3be
- SHA1 934d5fe30ed8233d77098f1214d07b0d009e5371
- SHA512 ec6ddc3da4d504bac611d61d0e294f74e1092ce0d6afc1e56641ec99b44237af1fcbce374b39eb1b8aaf9e57de5997bd6917b38e1a5cf5c34f44e93e089061b2
- SSDEEP 98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4H:RyeU11Rvqmu8TWKnF6N/1wK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3430773
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.>fc
Size
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.;`{
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.`n(
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e864953c3a95b063ace86177e1914753.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d11fecef716ab9ab91bb2342635dd89113e0cce4313229abbc80462facaefad9
- MD5 e864953c3a95b063ace86177e1914753
- SHA1 472bc71ef2e9c06ff3271fc0623f79a95ed2fe93
- SHA512 f947ad181a748964673ce7fcff6ba8cb192079cf4f095ce60e44b4ff0a5bd241a06b0cca88899b91ad8064c3d000946a6da1bb7d7b61759b9a5888e8aa64a435
- SSDEEP 98304:hyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4J:hyeU11Rvqmu8TWKnF6N/1wo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3430773
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.>fc
Size
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.;`{
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.`n(
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e8686658e2163a23de75fe75807e0d12.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fc8ad2197b7f953a85e6333561efa2d83249e7926ece6d2e4dd4d5eedba3f4fc
- MD5 e8686658e2163a23de75fe75807e0d12
- SHA1 13b967640328c617d05ddb7dc2e81f6c42b87a8c
- SHA512 f318ca4f413301aceacfbd9f0fc3a6c2120df88a48fd545c14253ae534a782c2a0b1062bac5025f13c7a8d4b9965945574b7d606b4385b94e991cd9e75d9d4e6
- SSDEEP 49152:6vFIuOCJ2YfXjBfAYYqY0vI6DOTwv1X8Sdh6KqQRc5L5B:ScmTVAYYqQ6DOTwNsSdh6Kfc5L5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2536334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e8add323447be730ffb34507864ea6c71e16df32e6668ce7eb03839e3f0e49f4
- MD5 bc3ad2f2cf115c59001b9218e1a7227e
- SHA1 03661c865461ca2b330d82b11490126597ed9809
- SHA512 16089aec2bfd51e733969205ef591c209fcb64bacc227f97e7146bfce9e2b4a318506b01c7eb4c6325c029262f653dda2a89b721396db3f26f1699a551d79a98
- SSDEEP 49152:7rYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:7dxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e8cdbe10bd3316f1f52cfd57c431f914.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 99ae94311bb4cc0d06d8288999c1a12e527b2904c1fe5efcd826d485701fdc9f
- MD5 e8cdbe10bd3316f1f52cfd57c431f914
- SHA1 2e3d81ff5caff8984f182148d4dffd3c0d33bdf1
- SHA512 22154b49d3945f153bcb5488e05fa24c6ff57c45b64b57db1f48406cd7f7f41180afad0997421dcf3ea81666cf0b8e6343709a9fce01eba3c78d332f03208988
- SSDEEP 384:cfP/SG1aTTcPTEUV75LC2SM42pfL3iB7OxVqWqKRApkFXBLTsOZwpGN2v99Ikui8:u11weF3X42JiB70lVF49jVzOjhYbC
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
39038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e8e55ad9c18ac9869f352052d9738465.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f67855ee9d06fd2b05dce6cc32e23839182cf10837c0e730519c829addef1c42
- MD5 e8e55ad9c18ac9869f352052d9738465
- SHA1 e65dcbed408dae59c720828f4cf759687ad552a7
- SHA512 4179c3762c6826f63cc61973bc8d6ccba82cfe0cfe461eef315e888fc2f774ffddab7f7d3399b71d71494e00ccae94e1dcfb67549948f93a901153bbd2930358
- SSDEEP 1536:gCHY6638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQt/9/u19p:gCHY53Ln7N041Qqhg/9/I
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e8f433b6bec154c4ad99bbb895acf656.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8d3a345df3b36d072594089ee7f96540c7f83f20e7c9c9d9618c1c01799f76ac
- MD5 e8f433b6bec154c4ad99bbb895acf656
- SHA1 22cf97bede88c6ad096643bc0f5c17ee13f8777a
- SHA512 c074c7abab2b6828d869cf716ff1b93af2508a418d1660fa24a0186a044cd5f11c50eb0b42f8c309739b5e1ab702b704cf0359fa79877f558f2dd44702cbfe2f
- SSDEEP 24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e908379ed8cc4a11e08ad222ba2b2af1d01d6449d1c7cc6e5029ddedcded193c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e908379ed8cc4a11e08ad222ba2b2af1d01d6449d1c7cc6e5029ddedcded193c
- MD5 84e6881b3787629f8fee510abc347f7d
- SHA1 359ee0baac2b35c570820b4793c02aa7b8270266
- SHA512 b104a407c7575380d90693a40a5384798fc5eb04576d9f6e7effe57cabf22bbd69dca659c6754a4b81ae3a90a350dde5d739c5bffd7f4197dd9b881143d5d6d3
- SSDEEP 3072:CZoOvRLJ1dUC4eg7rZ8CSPoH4/6wwbrqC/O22yJOvOEE:CaOvRF1WC4e5VoHuurN/wyJK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
129230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e9128f6bf95a40073604a8605c153624.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3fe6eb60697fd304e46ead79e01f637741f5891ae79d213f0bc4d6770460126f
- MD5 e9128f6bf95a40073604a8605c153624
- SHA1 e534f7adf2eb6dc3342289495b67e3532b20e421
- SHA512 27fd6d04b83a77abe1450ad115e695e8f2111eb416740d0c46077a3b9a31d5ca39edaf81aec05ada182a66ffcf533c9834fa09782fd949e6282bc59e745e5ca2
- SSDEEP 1536:LStHH638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQteU89/P1B2:LStHa3Ln7N041Qqhge19/e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e92636607a3572cdbce9939615011f4f7c93bab97770cd6fcc623ba3fc925084.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e92636607a3572cdbce9939615011f4f7c93bab97770cd6fcc623ba3fc925084
- MD5 68dfc3217b96ada387c02b9f83f2a6c6
- SHA1 0ab218a37376c895bb8768bccd3f67f095f487d5
- SHA512 27a4aaf5e70e919a42e3084a28b584c099bdd1a258b64f5ab58258bc825bb915fc2b51b896fb96cf45aa63f1aa62c073d7b6466567815e0aef8694f89325ab20
- SSDEEP 786432:4XuCHGJTk6G76kgFVM9MKbb6vpJ3ckMB2E:5ZPkWM1/6xJMvr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1709934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e92bf0aa6cc65d57aeab105e44525f55.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dfaee3a2c91710169f1f64dd2467234756338a45b1d63da4e0dba14948339ac3
- MD5 e92bf0aa6cc65d57aeab105e44525f55
- SHA1 5fed5cd0c798de8e74d7ccb4331f2306d75c59e6
- SHA512 8c62ead9b21e61977d0a5143f953554cccff461b77ba640b7b95dce127fb4a06e3bfc150162d3bbc7553d9c4b5ef30757d9defa1968e093e34032f953ba3ce80
- SSDEEP 1536:cRWV5jELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtS6T9/2701w:cRWV5jSE2EwR4uY41HyvY79/u
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e954ed3b07a38264bced63faeb08ef11.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8fbfbb9f33bdad8732c68da75d397cc1509fa502c08d61512b55736781189d6d
- MD5 e954ed3b07a38264bced63faeb08ef11
- SHA1 42fcf01ed572f8aad655daf32705cf88d9b1e1c2
- SHA512 13c04e0f0813d4ab494c48344c99cff2b2766eefe3e1bd972ff09e86559bc7c4152814be0fba7720336457a6673d90a51d6f857cf69afdad51ff818b4216f169
- SSDEEP 384:jPwz6+T4IjWZFNwXU0eiNUBdvt6lgT+lLOhXxQmRvR6JZlbw8hqIusZzZEA:jETbC81NgRpcnuS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e97a4629d0932ecf65a8e3e587138b7ede3216894441c57ae3aacd6a21a97f44.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e97a4629d0932ecf65a8e3e587138b7ede3216894441c57ae3aacd6a21a97f44
- MD5 2ecd0476476fbc39ad5ea72b8dcf79c9
- SHA1 bc1a0ff117ad653204c65d6301b43dffb1fddf19
- SHA512 65a9a99c95eaf52dca75a623df475bcdbd93d7da2dfd96795694adca0635a447d2524c7cc051f99a2ffd0718b21834b2d03b3ae6c5876d55f98cea06ea9fb273
- SSDEEP 3072:wO4FE9RpOqzuLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN7:wpE9a/5bTgVziHzZnSKrCbYMr2bv8Vq
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
237070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
224KB
Virtual Size
223KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e97ef8e8de1c8e127ce6b995bc7ebdfe.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 243dc2e1d8af7c17f3e16307cb009183d2ffdce3ac8fb0f2cd31c1572d7f2fa1
- MD5 e97ef8e8de1c8e127ce6b995bc7ebdfe
- SHA1 9fb46a637cb9b2ad1fa91877b1b64b94bc4afd3f
- SHA512 8734ea03f99db8f138a17964f2f822b70edd6a2f2693ce49b7afd11f44b09596996256edb31bca9dfc839049963871453df9ea21d698e8a4077a980d6f0d5c13
- SSDEEP 12288:fzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:fzZvuGD2PvA5YxwmbZB6Uv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1013790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
982KB
Virtual Size
982KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
760B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e999ae5c438afe67d8ee58db451530ba.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ed576c32e4d0cbfeded56694debd01dab0aff9ebc292bfd3a14dfc38df333a40
- MD5 e999ae5c438afe67d8ee58db451530ba
- SHA1 8e46a6ec85f501a346c458952aaaf0d197f75c81
- SHA512 a116efd01acfd86e9bf8677f3b999aeb5924038291427a00098f2e9ec9d2a3c521bbd06eb1d5de25f9c89636f9a2ab51655d695a90fcde056d43f97b6b04da0c
- SSDEEP 768:eL1dqrEP8PgibVwibC/rM+rMRa8Nufrt:e6rEEY6NuA+gRJNA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e9a1016658a3269c308879399964b90c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0381181f642055eb42be31f98dfcfd4adc1e20f1d056bbcf4e2a632b3e07c1b1
- MD5 e9a1016658a3269c308879399964b90c
- SHA1 2d20ee450f75a1bf80bd986809de3fbc865d5fe4
- SHA512 cf0e289ca093864e3bf8d84bff7b3120c4970a98ebc1eaf678a42cad5aaaa61c60b9cb397b52f676d775c9c6bf04d8dfa4a1dbbabc6fffcc8443acb47fa9abc9
- SSDEEP 3072:kMGbv1Cy7MIHVqZfGpjS9GmEAoOXrwFeKbK:kvz1b7MI4GpG5EA9X0Fe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e9a1acf2afe6da755292a7e199442fd7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 21aa89425b7cc320414fb655dd9d20d48b3097055643ff2c0d4eadeec3a067c1
- MD5 e9a1acf2afe6da755292a7e199442fd7
- SHA1 6d5a84fbcbc9ebfe26a8b9dddb9da93e9c022d20
- SHA512 f521f5fa54b604963ee14c7e4a45c836e1796bb12f00517b284a2591271c0283e3965a6af0d33e957a698f3f82c48e0902a3ea80960f1186d1ff279bd9ee962f
- SSDEEP 49152:brYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:bdxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e9d56aae5bc564df42e84e8652b247d75e6dd9b1515a6bfec42e2c477c4b3d62.exe
- SHA256 e9d56aae5bc564df42e84e8652b247d75e6dd9b1515a6bfec42e2c477c4b3d62
- MD5 c27ed31b785e99462f65cf97c82b74c5
- SHA1 dc0c0f7576550187c4ba792f023d52bb1efaece2
- SHA512 9c4c6ac8da4ff0c676ee75e445ac235a8638046dabf7affff60c4468340e0989af7826a04761e02865c48325b18540a6e8f05341594d1630a4d0ced3738645fd
- SSDEEP 98304:dRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/lvR:dkj8NBFwxpNOuk2Ep
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
e9ec51975ec96019c83b4cffb33956c5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a46af1e18f6b3005cd440304ce9eadc9729b1dbfeb68869f9acf5aec6741a2cc
- MD5 e9ec51975ec96019c83b4cffb33956c5
- SHA1 85572830a37b73ebe7bb6145bf07b86090997e6f
- SHA512 9cd4425b3ca9f5acfe46776860244d160bd1f38c64a9044207f5810955daf9998bc7b65afff8a7365ee8ebfd4753ad186124515ad142d842fe4b876528116ec2
- SSDEEP 1536:R5mP4hDVQDh9xgWhOrmgLhA+/ruwyC8aeF2bWOjvXePpkIg6IOegNeZ:D6b7Iuw/8aeob/vzOegNC
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
88014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e9ef90bd89d281622cd2e8454a2471f0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 92a897cf763b0090b0d55d68a6ccc5b18db0f6ed6c064200f70b05304d35e167
- MD5 e9ef90bd89d281622cd2e8454a2471f0
- SHA1 2a2eb23da7cafd74ab8c3ffdb7ed3e51ac2617fb
- SHA512 073382caba0226933ff33ef5c715b4312734c7bd9b839c4247902a9d2f6a2b19e6b9c64e3b0b165ea8a7ceb7096e1f66ec9348cb4606d7cde7cbf5d55395cc76
- SSDEEP 49152:jrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:jdxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ea07bde8ca505d52b26a02e9a614d1ce274c57d759bd7a0266be6fab700643e1.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ea07bde8ca505d52b26a02e9a614d1ce274c57d759bd7a0266be6fab700643e1
- MD5 05e7f220560e9bcde86d06769d8cd20c
- SHA1 6474779d8fb0da570143b9957749651ebddfe92f
- SHA512 c8c868d751378a78cf0b0c2c85de707b88b74c95ab776997b3b450b1870a99e9274931c7ea1a417a571762805b0d0be34301f0ffd83b71553227eb7851dcd938
- SSDEEP 6144:9loZMprIkd8g+EtXHkv/iD4iXptbhS6FgAxDeebVfBb8e1m3oix2:foZCL+EP8iXptbhS6FgAxDeebVxaM
- MD5 SHA1 SHA512 SSDEEP
-
Detect Umbral payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
240270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ