3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693
- SHA256 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693
Overview
overview
10Static
static
1084b12442aa...e4.exe
windows7-x64
1084b12442aa...e4.exe
windows10-2004-x64
1084c3944913...92.exe
windows7-x64
184c3944913...92.exe
windows10-2004-x64
184debf79f2...ff.exe
windows7-x64
184debf79f2...ff.exe
windows10-2004-x64
184f75ab85b...fd.exe
windows7-x64
1084f75ab85b...fd.exe
windows10-2004-x64
10855deb7775...d7.exe
windows7-x64
10855deb7775...d7.exe
windows10-2004-x64
1085744dd3f6...0b.exe
windows7-x64
785744dd3f6...0b.exe
windows10-2004-x64
785c94c7c76...5f.exe
windows7-x64
1085c94c7c76...5f.exe
windows10-2004-x64
1085d0793219...96.exe
windows7-x64
1085d0793219...96.exe
windows10-2004-x64
1085da941cd1...86.exe
windows7-x64
1085da941cd1...86.exe
windows10-2004-x64
1085edcd8fbc...42.exe
windows7-x64
1085edcd8fbc...42.exe
windows10-2004-x64
108601303574...8e.exe
windows7-x64
108601303574...8e.exe
windows10-2004-x64
1086513494c7...6d.exe
windows7-x64
1086513494c7...6d.exe
windows10-2004-x64
1086700eca73...12.exe
windows7-x64
1086700eca73...12.exe
windows10-2004-x64
10867e002192...1f.exe
windows7-x64
10867e002192...1f.exe
windows10-2004-x64
1086c8fa2e13...a0.exe
windows7-x64
1086c8fa2e13...a0.exe
windows10-2004-x64
1086ca2f06f1...26.exe
windows7-x64
1086ca2f06f1...26.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
84b12442aac5bc73f568e7fa4d5d958ba9edc5bdc504d16f499a30ce549965e4.exe
Resource
win7-20241010-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
84b12442aac5bc73f568e7fa4d5d958ba9edc5bdc504d16f499a30ce549965e4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
84c3944913d37db4d64ab41d8ceb266686cc28048d92b7aad2e15467adf75092.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
84c3944913d37db4d64ab41d8ceb266686cc28048d92b7aad2e15467adf75092.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
84debf79f2864b51cf49de435c5fc2ff.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
84debf79f2864b51cf49de435c5fc2ff.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
84f75ab85b7776371d89c84d47ac58fd.exe
Resource
win7-20241010-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
84f75ab85b7776371d89c84d47ac58fd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
855deb7775f714f1fc46d29fea8008d7.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral10
Sample
855deb7775f714f1fc46d29fea8008d7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral11
Sample
85744dd3f65e4636d5d433ed2a070c50a90375a38356c175ed31975813b4610b.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
85744dd3f65e4636d5d433ed2a070c50a90375a38356c175ed31975813b4610b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral14
Sample
85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral15
Sample
85d0793219eb0fac73bf85eade28e6ed1d676ec16ff8c01eacf13994f3267896.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral16
Sample
85d0793219eb0fac73bf85eade28e6ed1d676ec16ff8c01eacf13994f3267896.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral17
Sample
85da941cd1a122ad907ea9a637c620517ddd1e21857a01f6244dfa3ec0d3c286.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral18
Sample
85da941cd1a122ad907ea9a637c620517ddd1e21857a01f6244dfa3ec0d3c286.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral19
Sample
85edcd8fbc445760ff0796aa459e3c42.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral20
Sample
85edcd8fbc445760ff0796aa459e3c42.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral21
Sample
8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral22
Sample
8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral23
Sample
86513494c7861a5a0c9f1c0fb478e36d.exe
Resource
win7-20241010-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral24
Sample
86513494c7861a5a0c9f1c0fb478e36d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral25
Sample
86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Resource
win7-20240729-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral26
Sample
86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral27
Sample
867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral28
Sample
867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral29
Sample
86c8fa2e136e29f51a3670f440b9f0a0.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral30
Sample
86c8fa2e136e29f51a3670f440b9f0a0.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral31
Sample
86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral32
Sample
86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693
- Size 32.5MB
- Sample250322-zaqppszvbx
- SHA256 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693
- MD5 18d8d9b657ea6c1dc27c03a1e9984a04
- SHA1 da4fe63e6cef6fb590e58b8ebadc3a72df06433c
- SHA512 84c924cf7803ece91e9f36fc1311d5cee80c83fb9b5d6e73a2278b99165bef2a0cc231f4a2a55add2aa5e9af193ea3628457c67e5fcba0d8663e5a29b48e610f
- SSDEEP 786432:kaB0LOkfUPaivAzjmdaQa41PagnyQ37XuV1ha:kEGfUdvKTuMQS1ha
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.0
Botnet
-
Office04
C2
-
free.svipss.top:37263
Mutex
-
499e1307-c938-406c-8031-c021ba04640f
Attributes
-
encryption_key
4111EB4E3452F3046C6F5DFE90F84F08D3E1BB9C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
quasar
Version
-
1.5.0
Botnet
-
Office04
C2
-
pa-force.gl.at.ply.gg:12214
Mutex
-
ffecbda9-25fa-4e3c-a5ea-37cd0d0376aa
Attributes
-
encryption_key
197572FC97D91919662FC0B14F52E41F83A2F651
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Extracted
Family
-
quasar
Version
-
1.3.0.0
Botnet
-
Office04
C2
-
185.246.113.135:1604
Mutex
-
QSR_MUTEX_1lwMeXPloe4D54kA3Z
Attributes
-
encryption_key
DlSDsTT8uMyBbPq2Olp2
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
krnl
C2
-
127.0.0.1:1234
Mutex
-
62cfd7a2-713f-44be-bf60-f71392c34930
Attributes
-
encryption_key
34F17DCAB06146593170B498E9E1F2F58CD66C91
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
HacKed
C2
-
127.0.0.1:5552
Mutex
-
984559f52d4087243e95e5ad9bb48e8d
Attributes
-
reg_key
984559f52d4087243e95e5ad9bb48e8d
-
splitter
|'|'|
Extracted
Family
-
xworm
C2
-
127.0.0.1:7000
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
Family
-
44caliber
C2
-
https://discord.com/api/webhooks/1352254322221649931/9VnbDu0akm8arI6xlajkT0gkPnHkBzZWO058bsU_Yyp9VyZke9bmFbbu_YrR7edIBNKH
Extracted
Family
-
xworm
Version
-
5.0
C2
-
cartomen-43567.portmap.host:53000
Mutex
-
gBThbP58fxOMpNHC
Attributes
-
install_file
USB.exe
aes.plain
Signatures
- 44caliber family
-
resource yara_rule static1/unpack001/84f75ab85b7776371d89c84d47ac58fd.exe dcrat static1/unpack001/855deb7775f714f1fc46d29fea8008d7.exe dcrat static1/unpack001/85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe dcrat static1/unpack001/8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe dcrat static1/unpack001/86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe dcrat static1/unpack001/86da73dad34959352bae293728ee03d0.exe dcrat static1/unpack001/8750afa36131868fd706bb1d6800a22d.exe dcrat static1/unpack001/8792699c9ff31e00aee18ebc3082e902.exe dcrat static1/unpack001/88b6af199d91164503a3cc98dff4b4ba.exe dcrat - Dcrat family
- Detect Xworm Payload 2 IoCs
resource yara_rule static1/unpack001/8852497bb139e3a2e350f949ed634995.exe family_xworm static1/unpack001/888ef44713c700aa3f3a1641d3746fb7.exe family_xworm - Njrat family
- Quasar family
- Quasar payload 4 IoCs
resource yara_rule static1/unpack001/85d0793219eb0fac73bf85eade28e6ed1d676ec16ff8c01eacf13994f3267896.exe family_quasar static1/unpack001/867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe family_quasar static1/unpack001/877b6f54cc162886869c665fb55be9e4.exe family_quasar static1/unpack001/87c6cdaa6dad2f63826db7d5d1d66cf5139d99c1aa7c9096b6555f276cbf2d69.exe family_quasar - Xworm family
- Unsigned PE 27 IoCs
Checks for missing Authenticode signature.
resource unpack001/84c3944913d37db4d64ab41d8ceb266686cc28048d92b7aad2e15467adf75092.exe unpack001/84debf79f2864b51cf49de435c5fc2ff.exe unpack001/84f75ab85b7776371d89c84d47ac58fd.exe unpack001/855deb7775f714f1fc46d29fea8008d7.exe unpack001/85744dd3f65e4636d5d433ed2a070c50a90375a38356c175ed31975813b4610b.exe unpack001/85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe unpack001/85d0793219eb0fac73bf85eade28e6ed1d676ec16ff8c01eacf13994f3267896.exe unpack001/85edcd8fbc445760ff0796aa459e3c42.exe unpack001/8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe unpack001/86513494c7861a5a0c9f1c0fb478e36d.exe unpack001/86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe unpack001/867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe unpack001/86c8fa2e136e29f51a3670f440b9f0a0.exe unpack001/86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe unpack001/86da73dad34959352bae293728ee03d0.exe unpack001/8750afa36131868fd706bb1d6800a22d.exe unpack001/877b6f54cc162886869c665fb55be9e4.exe unpack001/878573ed40a11d2b4f38071961b0e8ce.exe unpack001/8792699c9ff31e00aee18ebc3082e902.exe unpack001/87c283def556314364f9cccbf42dde1cfc52314d0b4bc3238af4651a9468952d.exe unpack001/87c6cdaa6dad2f63826db7d5d1d66cf5139d99c1aa7c9096b6555f276cbf2d69.exe unpack001/87cab2d505fad41add24fedf153bfb4b.exe unpack001/8852497bb139e3a2e350f949ed634995.exe unpack001/888e4327b8a60041eb74f2334d2c096f5a5f51e540996f6093123b44742e1cc4.exe unpack001/888ef44713c700aa3f3a1641d3746fb7.exe unpack001/88a7598098c148669500aef914a12cec.exe unpack001/88b6af199d91164503a3cc98dff4b4ba.exe
File Explorer
-
3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693.zip 32.5MB
-
84b12442aac5bc73f568e7fa4d5d958ba9edc5bdc504d16f499a30ce549965e4.exe.exe 521KB
-
84c3944913d37db4d64ab41d8ceb266686cc28048d92b7aad2e15467adf75092.exe.exe 10KB
-
84debf79f2864b51cf49de435c5fc2ff.exe.exe 16.3MB
-
84f75ab85b7776371d89c84d47ac58fd.exe.exe 2.0MB
-
855deb7775f714f1fc46d29fea8008d7.exe.exe 1.6MB
-
85744dd3f65e4636d5d433ed2a070c50a90375a38356c175ed31975813b4610b.exe.exe 251KB
-
85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe.exe 1.6MB
-
85d0793219eb0fac73bf85eade28e6ed1d676ec16ff8c01eacf13994f3267896.exe.exe 502KB
-
85da941cd1a122ad907ea9a637c620517ddd1e21857a01f6244dfa3ec0d3c286.exe.exe 580KB
-
85edcd8fbc445760ff0796aa459e3c42.exe.exe 999KB
-
8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe.exe 827KB
-
86513494c7861a5a0c9f1c0fb478e36d.exe.exe 2.5MB
-
86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe.exe 1.6MB
-
867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe.exe 555KB
-
86c8fa2e136e29f51a3670f440b9f0a0.exe.exe 2.5MB
-
86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe.exe 2.5MB
-
86da73dad34959352bae293728ee03d0.exe.exe 2.0MB
-
86f81fab2180488d5a7ce4d45d6cb24863368b2a4cb0c46a46dd06c9b9f028b6.exe.exe 1.8MB
-
870250493aa7c48e54f2b48c9c6e4794.exe.exe 39KB
-
8750afa36131868fd706bb1d6800a22d.exe.exe 1.6MB
-
875cf39add23dd6fb46708c1e03b678caa81738edc9509d3d1e3bec912382d15.exe.exe 864KB
-
877b6f54cc162886869c665fb55be9e4.exe.exe 348KB
-
878573ed40a11d2b4f38071961b0e8ce.exe.exe 1.9MB
-
8792699c9ff31e00aee18ebc3082e902.exe.exe 1.6MB
-
87c283def556314364f9cccbf42dde1cfc52314d0b4bc3238af4651a9468952d.exe.exe 180KB
-
87c6cdaa6dad2f63826db7d5d1d66cf5139d99c1aa7c9096b6555f276cbf2d69.exe.exe 3.1MB
-
87cab2d505fad41add24fedf153bfb4b.exe.exe 37KB
-
8852497bb139e3a2e350f949ed634995.exe.exe 64KB
-
888e4327b8a60041eb74f2334d2c096f5a5f51e540996f6093123b44742e1cc4.exe.exe 303KB
-
888ef44713c700aa3f3a1641d3746fb7.exe.exe 32KB
-
88a7598098c148669500aef914a12cec.exe.exe 8KB
-
88b6af199d91164503a3cc98dff4b4ba.exe.exe 1.6MB
84b12442aac5bc73f568e7fa4d5d958ba9edc5bdc504d16f499a30ce549965e4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 84b12442aac5bc73f568e7fa4d5d958ba9edc5bdc504d16f499a30ce549965e4
- MD5 ad94009dbf24192d8ddb026e6d183702
- SHA1 5dc5b6aad743f5573bd3a73208789687f06854a9
- SHA512 9a65b2539e03d41fbe7b37c51db0b5520f079c56d16e8f64241ccc812d01387ae2253554fc1a195e85fbad216acc346889d7bfcadb11267869c468e61272889a
- SSDEEP 6144:mtT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3r/+:K6u7+487IFjvelQypyfy7/+
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3a:d2:f1:b1:d4:1b:b6:af:41:b1:2a:d6:29:73:50:70:e4:f5:3d:73
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
84c3944913d37db4d64ab41d8ceb266686cc28048d92b7aad2e15467adf75092.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 84c3944913d37db4d64ab41d8ceb266686cc28048d92b7aad2e15467adf75092
- MD5 be4469ad2fc0139f5224aa5abaca7309
- SHA1 f04bf42efe6db379aa53c15f4448747a9d558ee9
- SHA512 cc86d386f8ac416da6148cfac0da73981aa43749e690435e97eabe4fb8d614822b90dfa0d144a9ca5b6bd2dbb92f653eeab1ef77d5d0f2a3d9e02675f08d1ee2
- SSDEEP 96:LBURYC7oW4qISQdD91Ne4M/v+msicLo3RAJ3AexnF3cQmgP75hP3F/UaRo/vJnkQ:iRevdZ1A4MH+ms7FvN1o/hkqh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Users\Eddie\Desktop\Neil\ZmetHacks V2 2.56.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
84debf79f2864b51cf49de435c5fc2ff.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4561a799e74e351767e1dbfa63ce81110d7a42b8a1ed1ab2f19ba353dc7944fa
- MD5 84debf79f2864b51cf49de435c5fc2ff
- SHA1 fdf0328f9950d271dda14901ce1c82dd28851be7
- SHA512 f2c397df55ae9bd3b56407050494432f0ce4a026b688a6e1171f1843c6282bc06caee21598882b69c26fbf92e4f31488483285c5b1a873b9bcb08aab3e9aaf4e
- SSDEEP 196608:fawGh8x7b6QqOyjr2LF3Ye6YmnwqdU142Uk/X9Z/yhYsOEi4Gsq4G8rF4:fGk1cjSLFoBYmn5U1Pb/X9tuG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17094222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
16.3MB
Virtual Size
16.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
84f75ab85b7776371d89c84d47ac58fd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e1cf18320c276bb0e5049efcaa0c9d33e19238cea8e7a0f6822e7b9c07e82872
- MD5 84f75ab85b7776371d89c84d47ac58fd
- SHA1 eaed14d10608efc9851b82500f0b0f5bfc0fe0ed
- SHA512 441e9e4015937c4f5fe959cd158d4bce9684c66dd80c218f4fb2e831b2f3d3d4c2b1986dc6ffb3e4130b874c75fa889e83e8f95becc247e676dbd8c796a4f5c0
- SSDEEP 49152:7rYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:7dxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
855deb7775f714f1fc46d29fea8008d7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 795cdb953a299acec277e31a6c97b38acdc44dfca7a2ce6bda2785a48bdfafdf
- MD5 855deb7775f714f1fc46d29fea8008d7
- SHA1 421d56096458fc456190f7c8d13fa3435c051264
- SHA512 7fd5597d07dd4597262a6122c3b165b0624d99ee9d222f448e2161c07bcef791a08be95bf52eb4cf37c8105e53855bf96d1bf026d887cb3ef85d132c07b40d99
- SSDEEP 24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
85744dd3f65e4636d5d433ed2a070c50a90375a38356c175ed31975813b4610b.exe
- SHA256 85744dd3f65e4636d5d433ed2a070c50a90375a38356c175ed31975813b4610b
- MD5 541d40acfed529f53816f8974634d875
- SHA1 801444be5fb8efafd8a92dcb51a480cbb6039666
- SHA512 e7e653dbbf778533b244808001b7fa440e350c9c2c7fd2c45b52d46cc2f249cbc2a049bc023e4d350484a63b9d3b78b4ca378f7d0e883dcbbc6324c0a3b14c2d
- SSDEEP 3072:+Cm3/jdYiAScDuYOr5rfaAP7K7yGzAMVb168yiJXNgfz798beFnHrAnlUwKV:SCiJ8uYOBfaAYyqhe8ZJda98beFnLAl2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
249KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f
- MD5 c87ae2c7c0c0a77294bdf61219b952f5
- SHA1 009d29952e3cec0966402de8b8ffeb264c78a956
- SHA512 b7477f968f2356dd08991668b6feb01bb878bad59a6b3857b0a226b1e246852ba0c40214c502e757b01bbd9fc130f9e0cad033a12ada3f1c6f42767b9b813c7c
- SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
85d0793219eb0fac73bf85eade28e6ed1d676ec16ff8c01eacf13994f3267896.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 85d0793219eb0fac73bf85eade28e6ed1d676ec16ff8c01eacf13994f3267896
- MD5 30a029d32d632ebd5938260e3e941c12
- SHA1 26ee839be698c18d24becfc0102400435ccf039b
- SHA512 e0cc40d1615485ada96eb3958a07ddee5e1ce895036437403fbd898682b29fb5a7d35d958abecad23ea5f97bc8e8ef6492ce4563811e318254594243afd608ee
- SSDEEP 6144:kTEgdc0YkXAGbgiIN2RSBEnxEkmf5MNJO5Etqi+yw4lUcEgOb8F9WwQAZD8GcTRi:kTEgdfYubgAxEk3P4rywVwpvQm5cdy
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
518062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
498KB
Virtual Size
497KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
85da941cd1a122ad907ea9a637c620517ddd1e21857a01f6244dfa3ec0d3c286.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 85da941cd1a122ad907ea9a637c620517ddd1e21857a01f6244dfa3ec0d3c286
- MD5 b747e046e2e395a2fe5ac28533a02fbc
- SHA1 b044b266c4d095ec36cbb957ecaea6fefee1c700
- SHA512 1a1a7215331a2e7ae64230b34b801a63b440ad444de2d17cda61e32eca09cd4c67697e7f803c4204ee1edca1f3609de46b2785b42a5e982b6861d3aefa90e521
- SSDEEP 12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7a:rBJwdhMJ6ZzHrfcsMGTfZ5Pa
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ca:35:2e:d8:d3:65:83:d2:f7:10:a0:8b:cd:c4:31:d7:e0:3d:d4:67
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Chains
Oct 30, 2018
CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=Mozilla Corporation,O=Mozilla Corporation,L=Mountain View,ST=California,C=US
Serial Number
0c:53:96:dc:b2:94:9c:70:fa:c4:8a:b0:8a:07:33:8e
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 23, 2017 - Jun 28, 2019
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Minor OS version
0
Major OS version
4
Entry point
588750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
567KB
Virtual Size
566KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
85edcd8fbc445760ff0796aa459e3c42.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8b7f417cdbc071fe2752a6c225154b943636ebd63674d591861251f5bdaaa292
- MD5 85edcd8fbc445760ff0796aa459e3c42
- SHA1 bc63d62de0f20bee25246b808bf512371e9aa875
- SHA512 a192875edf98bd51e92a0a827c7b767041fa1c25595a70683f458971ff300a87404edfd9b1507220440f5e6c9704ebed07655498f27bee224d97dc56eb91525c
- SSDEEP 12288:H9pLLk45WSSY1BX6f4bIS7rMNetPfC9Vs6IFGs0jxAqXj9xPSI0dzNgCoD7WX+Iu:H9pP5WS3lrMNyC9TJPCXBi
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1029310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
997KB
Virtual Size
997KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8601303574d298fe6d9a433d6fab9854ff5fb81d357d01f5065dccdb4407bb8e
- MD5 7d14c283441fdefcf681cc58017bb841
- SHA1 cdfe7ca961f11fd078a314335ce8c19f3acf2409
- SHA512 413f00a1c2dc19c43bf1a61738ac605c405f4834095a0e410091cfbb10085d56afe8bd99928477b5dec24c3b323c387da1e3bc6680409681a1d66a7318d3eb9f
- SSDEEP 12288:sNtD0qKiyhtFrXketHevYS6Rc/OOi1GuHQiEHRu3oDK:snKiyhXket+vYNSi+iEE3oO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
840606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
813KB
Virtual Size
812KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
86513494c7861a5a0c9f1c0fb478e36d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 80c020c2f71b279f7fdf6ad878ea772cbbcf248aab8c0b08b4db327d7dc86794
- MD5 86513494c7861a5a0c9f1c0fb478e36d
- SHA1 0e7ef50b5b4d51bda8789151b444505e4fdec51f
- SHA512 e80e51cc26d5952cfbeda8154f785cd31688ac0e643c86f915ababb2cfac31ed7133621065e336ac56cf707865997707e1d1d189c4db36a8f87f6719e810a1ff
- SSDEEP 49152:bcuxJ/hk+7ZklWBJPxWMbKdZeQUj5xqJb6TquwYhx19ZyBNDGE:bcsSFlWBJJVbKkl2z/YhryBNDn
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2611294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 86700eca731eb2e78b5995d66bec509b0438494b6a573d777043b6d21f10ac12
- MD5 522b3cc9b8e0565c5a2eb2d40b7a9513
- SHA1 86d71ba007afecc0f28e9815086992099a13f2c4
- SHA512 a22e86028dc923064c045563341d3c144f9d3473935c8ebecf54e2a6ab4afb5b21d2cc0a80f92dc96ceb294dbbf2a33ebc48122079acb62f9ec140230e3e6c73
- SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f
- MD5 04c25605f640412aa0be2abecda263df
- SHA1 b90b4a69730917fb57bfa4238ff506d1db536703
- SHA512 65ebd7fca6fe0f4c7a069226a2dda2bb3c68489c8e363cc73be6b4dff208da96cf1c8a3ea6c532e4c2d1a75e9d6c3582ce132c9c2c2672370cd86a1262f9d177
- SSDEEP 12288:OusTy3x2mU/iLYStKT7yFPb2bNR/SN4UY1lc6VA:Oq3nUfStKHIPbcNRf3fc6W
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
572894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
551KB
Virtual Size
551KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
86c8fa2e136e29f51a3670f440b9f0a0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 da49bed9676a8352a71fdd38dc855a01ca72f5dd393a91e9d7ad71ef9a4f11eb
- MD5 86c8fa2e136e29f51a3670f440b9f0a0
- SHA1 103d45983c01fc861cb7390afe5db10ff2892fc0
- SHA512 7c5f74c7a041c38216dc4a7f1d60d1a622227b8cd5aea5c1c4d200a5ccfabd7cbd2a17b22ca2ff028fc45dd0373df8cf9a5998cbefe7873fa7f9eda7ad117ddb
- SSDEEP 49152:BjLLQdzMIwA7G5ALF/CT2vyYSjEf+QSs5saA2R97oF/cZ8ekY4E7Jy:B2l7G5Auotf+Lg4ElM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2611166
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26
- MD5 3dbf7d9fdfd5a0151f1003095ba9655c
- SHA1 4f5de06a720298a5e32660fd0f56733ad611060f
- SHA512 3405c202bad0e95f18341f8c664f94626bec55db6ef9c15ff9a5b6cb2632e73375fec802d64e5ca3b924829ec1729c06f01fcb9a5013ac22d5b5b437812eb2ef
- SSDEEP 49152:qGVFTkAxSKOfsx79ZnGGHMgVj2x+0XrSqWsn+fz+pV6ZKvTYnp:qGVyWNGGN2sqWs+fz+pVZTYp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2611134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
86da73dad34959352bae293728ee03d0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 39f28e665421aef4604a24767361fb0a0eb54047bc2861476c64f08bb55aad43
- MD5 86da73dad34959352bae293728ee03d0
- SHA1 706cbe2c4bc2215aeda737d1c48c2409ce126559
- SHA512 c49ed0e2ce19e98d7e7a6744a89699469b38bfcc409ecf62631186fe7d45305a53e27c21ab5ecd6b09113eefecabe79711ec9163c8e24c6cc78ba1208a349f39
- SSDEEP 49152:jrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:jdxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
86f81fab2180488d5a7ce4d45d6cb24863368b2a4cb0c46a46dd06c9b9f028b6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 86f81fab2180488d5a7ce4d45d6cb24863368b2a4cb0c46a46dd06c9b9f028b6
- MD5 6bb8aa037495213609b6a77fd5b5cf7b
- SHA1 95f121262e1efe673652dab4c37559fbf47e097c
- SHA512 2d79b2d0c0f5ad7a8526b609ee98cf148a181b59a8533a19133f9b1cdeadf9987e1cb3d9a887a98edc92f750aaf19c9c607354d2f4ae5857227836642cd8b975
- SSDEEP 24576:PD39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJWqwH6K:PF+QrFUBgq25eKu6K
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
65:46:d4:aa:56:cb:33:66:a1:95:77:3f:c6:92:67:4e:f7:40:ea:e7
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
722670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
698KB
Virtual Size
697KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
870250493aa7c48e54f2b48c9c6e4794.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cfd15665b1224fc3d8e3f957bf17aedf86461efbc7ae9810ff81ac64c8295dc8
- MD5 870250493aa7c48e54f2b48c9c6e4794
- SHA1 15be27b704770806ae516ec23be1a5a176e789bc
- SHA512 8c2a6d405b19f6510a301889ef69caa0734069de2a7a641f8c9895478cc41371e3c3991848a1d81ddb9bfc08b18d32e9b98fa2a299a35c4955eada3fa7a80228
- SSDEEP 768:eBNs4XjMNWSrlNi0RI2i6Rio9z86ge2Er8:IscMNprzii9i6Igz8xex8
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
87:22:44:93:45:94:c1:88:52:45:03:b7:4b:4a:6b:76:21:01:5f:09:ee:4f:df:d7:c3:6f:5d:5e:4a:09:3f:d6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=91410104MA447T3JX7,CN=Hena Luxion Network Technology Co.\, Ltd.,O=Hena Luxion Network Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13095a68656e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#130548656e616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 3, 2025
PE Signature issue
Digest
87:22:44:93:45:94:c1:88:52:45:03:b7:4b:4a:6b:76:21:01:5f:09:ee:4f:df:d7:c3:6f:5d:5e:4a:09:3f:d6
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 20, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:fe:6b:ce:da:d6:c8:03:03:a3:00:00:00:00:03:fe
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 22, 2024 - Aug 20, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
SERIALNUMBER=91410104MA447T3JX7,CN=Hena Luxion Network Technology Co.\, Ltd.,O=Hena Luxion Network Technology Co.\, Ltd.,L=Zhengzhou,ST=Henan,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13095a68656e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#130548656e616e,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
7e:ad:67:7a:7d:d7:f6:60:37:9d:11:6a
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 1, 2024 - Nov 2, 2025
Subject
CN=DigiCert Timestamp 2024,O=DigiCert,C=US
Serial Number
0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 26, 2024 - Nov 25, 2035
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
26622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8750afa36131868fd706bb1d6800a22d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ce51653fab1c06b6c1fecb4797f755e16c3a173342846aaedc7b8103cd2ba7a6
- MD5 8750afa36131868fd706bb1d6800a22d
- SHA1 a39b26d8845880967e6f64d5650108659f7a8c88
- SHA512 a94eab3b46010cb3d9b482ecad29b73ba2689c47c62df2c0a56cc1d4117808df58219a3b72ffe8fcee9c736f387fd521a61b6a0437f7112b58b312bcbea4fbaa
- SSDEEP 24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
875cf39add23dd6fb46708c1e03b678caa81738edc9509d3d1e3bec912382d15.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 875cf39add23dd6fb46708c1e03b678caa81738edc9509d3d1e3bec912382d15
- MD5 650e542b72fb5c0db7652334f73864dd
- SHA1 ce183234b028158147499a67c031b1c76192cc63
- SHA512 101068cb33b63f9e298a64a2bdd85b9756dbc02d7f270002665a4a9319b0eefb1125101a6a8cec7d71ff9ec5d183f76def60bb659b42dc31d59007c323f40c52
- SSDEEP 12288:sp+rgRNyA55IxJ+feDOa9rZj5XqkJD0QrOod7XxlW91RRzwAY3c:spugRNJI1D39dlfGQrFUxwAec
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
d5:3f:c1:a6:52:75:72:7a:cd:1e:ca:25:58:e3:e6:c7:e4:2a:de:ed
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 8, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
712958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
688KB
Virtual Size
688KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
877b6f54cc162886869c665fb55be9e4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a76e07e94dc79d6d45d1ce5e22ea9915b52ad14533e521484b5b5b7e824702a5
- MD5 877b6f54cc162886869c665fb55be9e4
- SHA1 4097999538e154c37b9acd40921b279749d62496
- SHA512 2a8c214f90d8c5b6368a31f0af7a41aad265cb070bb4649acfc55335b5bd2463c815a4bc613cc68b2cceb43f12e249d6e7bec71ff4895e7966bd64c4862ba999
- SSDEEP 6144:s2NHXf500MACNOCQ5TLbg8841Y2a2nUj+dV2:Dd5070gO9a2nUqV2
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
360894
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
344KB
Virtual Size
344KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
878573ed40a11d2b4f38071961b0e8ce.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b5529177eaf477e600e450f8858c812323678a00306953952bb963f4dea862a1
- MD5 878573ed40a11d2b4f38071961b0e8ce
- SHA1 d2fceac31e933bd35487d29a275a2d5227a95e18
- SHA512 4236f5dd7626e9d72fdcb23e7712abce4f7421f81f05e8bed5302fdf8ae9c80d960b46dc76709372087ab6c7990306faf47b49a2cce9b98b7421932b4adf9f96
- SSDEEP 24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8792699c9ff31e00aee18ebc3082e902.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 497e859cedebdd618375a3d577a1245ed3faf584d75def9dd3706e3f87f79b3a
- MD5 8792699c9ff31e00aee18ebc3082e902
- SHA1 13439439a62da10b28a6218fc1492e78672b5132
- SHA512 7811aa88349cbb4fa9896e1f28be96a146f8547e79d673d293cdc4aece357a0348273b873239bfecaf8b896b885fb87e046c62cb3dd1951ea250204e441c6bd0
- SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
87c283def556314364f9cccbf42dde1cfc52314d0b4bc3238af4651a9468952d.exe
- SHA256 87c283def556314364f9cccbf42dde1cfc52314d0b4bc3238af4651a9468952d
- MD5 64dcffee4e30c79669e430567fe3a59e
- SHA1 8bdc7f8eae15449305d9782ea4dbf2d9250061fe
- SHA512 5d06c330953916bb76ec2b6d158e11ddb5a4460b2eecba5ed201e13fe0986001592573f293c680659b597959273b9b9d28ddeb2a12b9bd53af817f1c787e55a1
- SSDEEP 3072:sY/mVMLLsnh9aMr2wThBe5P4BBkftPS57v912xwob+lHp7fFGiSpn8VfxB2U/ZCh:sY+V59aMiwTu4BBExSBF1Awob+l5fFjI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
178KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
87c6cdaa6dad2f63826db7d5d1d66cf5139d99c1aa7c9096b6555f276cbf2d69.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 87c6cdaa6dad2f63826db7d5d1d66cf5139d99c1aa7c9096b6555f276cbf2d69
- MD5 2b19586d9f7eb3ffbe8d8c7fb9ddc38a
- SHA1 0b3d9c9ee8c168666f8b93b6a52e8b84dc12bf66
- SHA512 6d65f216315a6dd13cec3391ceb50342695e047160cc52bc17514cfb761a40e572384b60b01eb9ac94542e28813837b960d962256cf96f928e7225421433e0e9
- SSDEEP 49152:CvUt62XlaSFNWPjljiFa2RoUYIexDE/gGk/JxBoGdkTHHB72eh2NT:CvI62XlaSFNWPjljiFXRoUYIexX3
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3269614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
87cab2d505fad41add24fedf153bfb4b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6c067f770a8ad073379bd2704bf2364614b33c594fc6f80d2b91a562652f6e24
- MD5 87cab2d505fad41add24fedf153bfb4b
- SHA1 fa9cb9538a55cdb2213a5b615f17da7d0b197355
- SHA512 bbcfe977e1af705017e5ab49a6765317bcfb6cd676078ec02b874f97fb3ebff17b3e8dfb7564f1e32811e564965a35e66b6d7775d71240e58060aade9e295a2c
- SSDEEP 384:IWLM+2giHF1XJvubMcKyMTqsHveTX5ii4rAF+rMRTyN/0L+EcoinblneHQM3epzo:LLMBTxJc5MTqs2z5iPrM+rMRa8Nuqht
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
8852497bb139e3a2e350f949ed634995.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 464df737e52c9f3b38ba3200a089bb253004bed3de879cdef9ad7d693cc456b0
- MD5 8852497bb139e3a2e350f949ed634995
- SHA1 55426fbe7b3cc7987c6375d89d5b1bec7f1a1c76
- SHA512 e9f5996aa5d5da6661c0880bf445adc7efa89b3eb3703efd887a9f9dd132cd444a89e89e745aa30a397e4ccbe16acb5747b79cf56101c21a94f41c225dd0eb16
- SSDEEP 1536:6ecfXiR6Fvbm/iLd69+176HtmynG61BEOckY:ePiAbm/yMy76HjnNBEOckY
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
888e4327b8a60041eb74f2334d2c096f5a5f51e540996f6093123b44742e1cc4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 888e4327b8a60041eb74f2334d2c096f5a5f51e540996f6093123b44742e1cc4
- MD5 2f09a87e3654ee5d8be7549b14699955
- SHA1 824bcc921d5de1329119feda88689de4162d2c05
- SHA512 3936187132bb47fb0b85d5f9d335e28b1fac7f5689323edbfe674991c924f3bd6fae3077d114545e6724b0b3340e64d296231c0d0b272c84898e98c679eba6d6
- SSDEEP 6144:UNFT6MDdbICydeBpxUKCa269TwHfewjmA1D0VRI:UNzIKCa2yTtK1DkI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
306686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Влад\Desktop\Новая папка (2)\44CALIBER-main\44CALIBER\obj\Debug\Insidious.pdb
mscoree
_CorExeMain
Name
.text
Size
301KB
Virtual Size
300KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
888ef44713c700aa3f3a1641d3746fb7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8aab2070f3f6d7a5c9ac5d478980cf42cad4e5779e3b574df5e959d9e90ba53c
- MD5 888ef44713c700aa3f3a1641d3746fb7
- SHA1 81d2688d2f92bfe33b1454c6c37748a09529e6d3
- SHA512 4f873ff8ad942e7dec2361aa9418f161e9775603349c6e5c7f2798d60649c5a4b27d0e5339b67b07f1be35fa816edf203869fa6c41fe0a7eb46dfca9fc7fbb1f
- SSDEEP 768:RRPD9OQhx/B03Tw49FzVFE9jz7OjhXbc:Rd9OW/03U49HFE9jz7OjRY
- MD5 SHA1 SHA512 SSDEEP
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
88a7598098c148669500aef914a12cec.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2b464881a61976d68880a0e0ec5afb1fbf235360fa9b9e1a22b7bbf86975337b
- MD5 88a7598098c148669500aef914a12cec
- SHA1 0ea03be0f9a1f3f990b87059ba6bdd326a0b5c67
- SHA512 4930344a80b88d8edb8f5ede27071a5c63deae1bcdcc56c2932559c0fbb89735cb61eb342c6304be714fc78106af118537489dab1731021f837f8d734c01b408
- SSDEEP 48:6gZmuFJKvVJglh6bnAy9itiLtlEul3bnPjVbnQqysWBg6qjpLkwOEG6uudHkiSfq:5FJKIf6RLbF7jVCBFq9gVqETzNtK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
88b6af199d91164503a3cc98dff4b4ba.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8471f483c939a0a16718d3d0691b4b1090fb6441bb4c25fc80a3a7a5a91ad729
- MD5 88b6af199d91164503a3cc98dff4b4ba
- SHA1 8c3f6c4f6b9ddbab2f9b7db6b2419d57fa6015ee
- SHA512 5215fe438919a98e3f0496ac22a2c2382b0a520722e88a1efc0c981aeacf3863628a0349c24ebe5c97c3c20fd5ba581bb7cb2265740b62b89eb77fc9d536d002
- SSDEEP 24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ