archive_61.zip
- SHA256 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760
Resubmissions
12/05/2025, 21:57
250512-1tzbmaxrw325/04/2025, 20:13
250425-yzes3asnt91025/04/2025, 14:50
250425-r7qf7syks31025/04/2025, 14:35
250425-ryf66svsby1025/04/2025, 14:30
250425-rvmjsaxrw51024/04/2025, 16:38
250424-t5sjws1rw61014/04/2025, 07:51
250414-jp1kfssjz91014/04/2025, 07:46
250414-jl9nyssjt91008/04/2025, 15:58
250408-tevasswl181008/04/2025, 14:19
250408-rm2nqsvqw210General
- Target archive_61.zip
- Size 23.2MB
- Sample250512-1tzbmaxrw3
- SHA256 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760
- MD5 bf90b2e0b88eb02563c013b903940fc4
- SHA1 cc5c0ff87124055c185058a285a331f5da792a6e
- SHA512 c36291747e8f802a94f4668893a387e9e560522d2c26f3c42add65e0b052693c7ed2c26cc9eee3cbbbbae00acc95d95c546b5c918810f170c7dde36f0858b280
- SSDEEP 393216:ksNpRraBaHxVlDA8WOrT/n6aXpsxXdXZusNp0FpE5yhuAs7P6RsBC6hSyOMDv2:NlE8WOH//yxNpT0FpE5yQ37P6u86hLBy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
asyncrat
Version
-
| nelsontriana980
Botnet
-
Default
C2
-
pctrabajonuevo.casacam.net:6606
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
reftel.ddns.net:54984
-
127.0.0.1:54984
Mutex
-
11b132f1-b2d5-4bf6-9166-34aaf514d89a
Attributes
-
activate_away_mode
false
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-03-27T18:14:14.261066736Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
11b132f1-b2d5-4bf6-9166-34aaf514d89a
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
reftel.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
Family
-
asyncrat
Version
-
0.5.7B
Botnet
-
Default
C2
-
mooonskj.ddns.net:5552
Mutex
-
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
njrat
Version
-
im523
Botnet
-
HacKed
C2
-
holyfuckingshit.zapto.org:1188
Mutex
-
dbaa10daaecc50e5048d51ecb95a01dd
Attributes
-
reg_key
dbaa10daaecc50e5048d51ecb95a01dd
-
splitter
|'|'|
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
127.0.0.1:4782
Mutex
-
64815557-7ace-4e24-8254-b4bfa76c68d0
Attributes
-
encryption_key
4C4CF51A01784F79888EFBAF8D36D0C89B0CFD16
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Async RAT payload 2 IoCs
resource yara_rule static1/unpack001/f5ed1274646abc95fd8b87f43adcadbc.exe family_asyncrat static1/unpack001/f8a3f1d5a1d18a666d9b81a974e212b0.exe family_asyncrat - Asyncrat family
-
resource yara_rule static1/unpack001/f5ae5532f18462594d061ae3bdf732b5.exe dcrat static1/unpack001/f908d30321810e4c87131f6fea397e39.exe dcrat static1/unpack001/f99ae4a3786f8c8da71654ddaba30b4791692d795c93ec1f60b0c58f3be43c93.exe dcrat - Dcrat family
- Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule static1/unpack001/f89219b77e5fde5a7a1581e3e4cc0b00.exe family_mafiaware666 - Mafiaware666 family
- Nanocore family
- Njrat family
- Quasar family
- Quasar payload 2 IoCs
resource yara_rule static1/unpack001/f5cb51ffdb87e6d78da4a60b2a83a2c0.exe family_quasar static1/unpack001/fa0d8e0c80c4d5be75d4ff442d6a85ea4750bffb3526d4d2d3b2e03f3ccfb28e.exe family_quasar - Unsigned PE 28 IoCs
Checks for missing Authenticode signature.
resource unpack001/f5ae5532f18462594d061ae3bdf732b5.exe unpack001/f5cb51ffdb87e6d78da4a60b2a83a2c0.exe unpack001/f5ed1274646abc95fd8b87f43adcadbc.exe unpack001/f62837f3bc66012b94d74cc471f3d97a.exe unpack001/f628fa20e85aaf1cc562cfd512392d3d12da2ef70adc31068f1e3d7f2b0a4f3b.exe unpack001/f640f01e808f31a32d455a827fd646d5faf2a452b47833597990ffe9a6597ac5.exe unpack001/f66fa3036e662d8f7ccce8795fb8b907.exe unpack001/f68f044685639be03fd992bcb711c098d22b6d0f0043638768c726bf96049950.exe unpack001/f6ac1ea5c19284854998f25244a12f25.exe unpack001/f6b79788476c3806befcdd2dead8231a.exe unpack001/f6e297800457d823c0597e833d555135.exe unpack001/f736c152b3d1812f1142ed0da99e0ac8.exe unpack001/f780377dd90d33c8280734d882fc2ac9.exe unpack001/f812ad48d0a6d53611389e30fd8ae9f80a245fe3360b52dc833f6bf7b7b7859b.exe unpack001/f8173be0fb3bebc0120e2cb017eb9922adebbb430734d0363e2d38e28ee47ea4.exe unpack001/f835ddaf4933c7bd4a3aa1f015442bb48b69f863f467dd8d1db09e6f2a427fd7.exe unpack001/f846950431f463a0a7e663ea7003e31c.exe unpack001/f89219b77e5fde5a7a1581e3e4cc0b00.exe unpack001/f8a3f1d5a1d18a666d9b81a974e212b0.exe unpack001/f908d30321810e4c87131f6fea397e39.exe unpack001/f926cc363c27c542c23e14398096eda8.exe unpack001/f97418dbfcdd3f6d26c6cad46d16ec06.exe unpack001/f98ee08aed6b41b1f9e6e1ca752d22cc.exe unpack001/f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe unpack001/f99ae4a3786f8c8da71654ddaba30b4791692d795c93ec1f60b0c58f3be43c93.exe unpack001/f9a573b21a7be92000f27a3802bb3518.exe unpack001/fa0d8e0c80c4d5be75d4ff442d6a85ea4750bffb3526d4d2d3b2e03f3ccfb28e.exe unpack001/fa942bbb984e2be3a2e1d8414cc00cd7.exe
File Explorer
-
archive_61.zip.zip 23.2MB
-
f5ae5532f18462594d061ae3bdf732b5.exe.exe 2.0MB
-
f5cb51ffdb87e6d78da4a60b2a83a2c0.exe.exe 271KB
-
f5ed1274646abc95fd8b87f43adcadbc.exe.exe 66KB
-
f62837f3bc66012b94d74cc471f3d97a.exe.exe 625KB
-
f628fa20e85aaf1cc562cfd512392d3d12da2ef70adc31068f1e3d7f2b0a4f3b.exe.exe 273KB
-
f640f01e808f31a32d455a827fd646d5faf2a452b47833597990ffe9a6597ac5.exe.exe 373KB
-
f66fa3036e662d8f7ccce8795fb8b907.exe.exe 154KB
-
f68f044685639be03fd992bcb711c098d22b6d0f0043638768c726bf96049950.exe.exe 3.0MB
-
f6ac1ea5c19284854998f25244a12f25.exe.exe 654KB
-
f6b79788476c3806befcdd2dead8231a.exe.exe 506KB
-
f6e297800457d823c0597e833d555135.exe.exe 78KB
-
f721adec82fb8994517719b69e8aa337d4619879e64cbd2fd80fc4e190e22c71.exe.exe 859KB
-
f736c152b3d1812f1142ed0da99e0ac8.exe.exe 5.9MB
-
f780377dd90d33c8280734d882fc2ac9.exe.exe .ps1 12KB
-
f7a96bf0830c5f7513d65086e0f7eb6679565b6ffdc6d1e325ee21303b38fec8.exe.exe 16.3MB
-
f812ad48d0a6d53611389e30fd8ae9f80a245fe3360b52dc833f6bf7b7b7859b.exe.exe 135KB
-
f8173be0fb3bebc0120e2cb017eb9922adebbb430734d0363e2d38e28ee47ea4.exe.exe 551KB
-
f835ddaf4933c7bd4a3aa1f015442bb48b69f863f467dd8d1db09e6f2a427fd7.exe.exe 203KB
-
f846950431f463a0a7e663ea7003e31c.exe.exe 351KB
-
f89219b77e5fde5a7a1581e3e4cc0b00.exe.exe 294KB
-
f8a3f1d5a1d18a666d9b81a974e212b0.exe.exe 47KB
-
f908d30321810e4c87131f6fea397e39.exe.exe 2.0MB
-
f926cc363c27c542c23e14398096eda8.exe.exe 1.9MB
-
f947bf8f07543c9beae3fdba615ba1dd.exe.exe 784KB
-
f97418dbfcdd3f6d26c6cad46d16ec06.exe.exe 2.1MB
-
f98ee08aed6b41b1f9e6e1ca752d22cc.exe.exe 1.9MB
-
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe.exe 3.3MB
-
f99ae4a3786f8c8da71654ddaba30b4791692d795c93ec1f60b0c58f3be43c93.exe.exe 1.6MB
-
f9a573b21a7be92000f27a3802bb3518.exe.exe 37KB
-
fa0d8e0c80c4d5be75d4ff442d6a85ea4750bffb3526d4d2d3b2e03f3ccfb28e.exe.exe 3.1MB
-
fa8e531e0860851ba2d1fb27a07f1879162d4f9bee94df2b818bae9d7834a884.exe.exe 1.9MB
-
fa942bbb984e2be3a2e1d8414cc00cd7.exe.exe 984KB
f5ae5532f18462594d061ae3bdf732b5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 afc02ea81470653fdfdfa402a5a8718a48617cefdfd811e95b9d0350b8bc9910
- MD5 f5ae5532f18462594d061ae3bdf732b5
- SHA1 6461c47fabfa10d49f4c87c1e7685b81a2a402be
- SHA512 81bde60db899576ff3be441021c522e3e14e89c019122fb2fbd4b9647adf19ef7a1f5059dd1b13ca58cc869b8c367bdec7bde3fc1c4729c7fdcb9b402a26c26c
- SSDEEP 49152:TrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:TdxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f5cb51ffdb87e6d78da4a60b2a83a2c0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cc18af46043434e99591546067f4ac5c031656cc3493d80396c4eb461e2d6cc9
- MD5 f5cb51ffdb87e6d78da4a60b2a83a2c0
- SHA1 f707cebf3b837c0f5b7724f125a5eb5acf622e6b
- SHA512 883970f6caecb15195108d25014a5faeaf2a1ce3a0c3f888da7d51bee3ad57f95abdf55a14748e25af39d0697fab6c1ad9fd5958efc2cc14ea279e099baf0610
- SSDEEP 3072:7aaXQh1zKfB0OZpbsxFqc9pI9sjBO1z+5X0uuMmk9b+3ZrQE8Ne5oKk3XsXMSrZS:7aaXMzUmOZoqEIaNOyEObyQEJ5o5eM
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
278494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
264KB
Virtual Size
263KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f5ed1274646abc95fd8b87f43adcadbc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dfc5e3435f8ce62c4ba623753f1e15d0311547b9c0276d34b4736f640be26330
- MD5 f5ed1274646abc95fd8b87f43adcadbc
- SHA1 bdc83157a77066f75ae2285455428bdb95246f00
- SHA512 c8616cf6f6c586d3f9b99360ccc3243fc8708a91d7e0fd9df91bcaf644022a60c9c2529c5cd648a5fb5ea6c635c2c922e6ad90ae3741d304b533f139cd2554b3
- SSDEEP 1536:a2wukvF1ak9gcKu5UYFwKMkb7UApZrPlTGZx:a2dkvF1ak9Ku5UYFwdkb7Bdax
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
72270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f62837f3bc66012b94d74cc471f3d97a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6831200eb1173e4bf699042b7b2e63e3582490981a55b20671724bb60cb0faa9
- MD5 f62837f3bc66012b94d74cc471f3d97a
- SHA1 9fa01c1c57bb1ec604771a796b4c36352552516f
- SHA512 de95cd3184e9f9d6931db60a6edd6e986eba3ae0c2e6308e65808aa6fbefd4d00f0d38a4305dc307d0217acdfe8fad165adf7a39d6f553eb53ff81abbb147b6a
- SSDEEP 12288:jQn+P/KKZA6B0Ndprctmm0+xFLnLsoc/8uHlHXob3:W+P/0UWdomC/LnLsoc0uHdX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
640390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
fOGI.pdb
mscoree
_CorExeMain
Name
.text
Size
617KB
Virtual Size
617KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f628fa20e85aaf1cc562cfd512392d3d12da2ef70adc31068f1e3d7f2b0a4f3b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f628fa20e85aaf1cc562cfd512392d3d12da2ef70adc31068f1e3d7f2b0a4f3b
- MD5 3ef5f71fdec671a56a286ea1866bb640
- SHA1 04e90d67cfb7cb470ea9e6d48f4fc765b0ddb472
- SHA512 5e724aef6ad8258cf23363911fb74780ff9b6cd469c0ba478d72de2d86b295ed63901e89a0a05466b2c9a7925244f6b02aef3ab9d06f325a1301eb3aedd431d2
- SSDEEP 3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdT/u:WFzDqa86hV6uRRqX1evPlwAEdS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
169742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
158KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f640f01e808f31a32d455a827fd646d5faf2a452b47833597990ffe9a6597ac5.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f640f01e808f31a32d455a827fd646d5faf2a452b47833597990ffe9a6597ac5
- MD5 1390a05960fe6acd3fd25279513346f0
- SHA1 c65393f72d9e00c770ba3ef393701bc87e13b938
- SHA512 90c3d8d61687e3bccd9e6e15f6c5f3db6770471878b452f9a11874ea70391eac5639424fd3f4a03de7729d642355fb2e6e0c4e65e3e4765cb76111a7b2de5bcc
- SSDEEP 6144:tyMIULPy/x3xUArN62f7GU7njrbma/3LaQURrM2TuP6zJcW:XDy/xhUAtf7tjrbma7OJxuSzp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
384750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
368KB
Virtual Size
367KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f66fa3036e662d8f7ccce8795fb8b907.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ada4cebb65e8b8b58ecee2c799394b5bad8fa4ebfd3ee7cf8f88c54b93e91b86
- MD5 f66fa3036e662d8f7ccce8795fb8b907
- SHA1 6685873421123f46a8762802b835e2556ad8e5aa
- SHA512 49be39d868ab2f268230222e12fbff79ee561641c1b61becba21909a0bb0ce45acae75d55a238c8940484c3b2cf57547105de9247ff5bc9b9af8675cf8eedaff
- SSDEEP 1536:2mZmg5zb02q/t6jOFvDO7slsF9PS24s+lSmSWQWOxzlAuT2oLkC1N5UbsGt3kcmF:JZmCb6ROF96zMq1yLAHtUcmKyN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
SimpleDetector.pdb
mscoree
_CorExeMain
Name
.text
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f68f044685639be03fd992bcb711c098d22b6d0f0043638768c726bf96049950.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f68f044685639be03fd992bcb711c098d22b6d0f0043638768c726bf96049950
- MD5 4d16429b31b10c20f707cd5289b2466c
- SHA1 2d81797a275a1e4810e8c9d3c32ffca17adffc76
- SHA512 e69fa3608df519e26d5878f95c29132992e4c1a6744905d2256912d7c40aab11fe903575734a8952791d5898570c634e969b26a62b21bf978acac5878d9615d9
- SSDEEP 49152:NMHHrIxRWPc3wDlRo4LZpsqDXUDBvFHOxoYj80VmXvqvIGg:N4H2RWPc3QlRzLTFDX6VFHOxjj89XvCy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1082030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f6ac1ea5c19284854998f25244a12f25.exe
- SHA256 10478f3361a6cdb5ce48bf9490ea60505e90ef4f9649973ca35bdcf43af1f4b9
- MD5 f6ac1ea5c19284854998f25244a12f25
- SHA1 99fbd0be6020def40eedb33c453c9e516d39ddb4
- SHA512 b2415c9af9284eebc053ef56c82ad15043b713d38c6fca1cabdbeff0d726f9f956bf56655c60f0d6ec95ef5150e50da1a539cbef5502dd032399721a545badda
- SSDEEP 12288:slGjIbKjk/x78IANpdqAUJeBrwwsRpIFgVXC0xi8/+b7LegZSv:uGcbKj+d0dzAZVXObfeoG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
652KB
Virtual Size
651KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
f6b79788476c3806befcdd2dead8231a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9c798b5cf50fd400ce59355b91a741ab5ccfcffdaedc50815981fa280f4776a9
- MD5 f6b79788476c3806befcdd2dead8231a
- SHA1 56eba5da31c728dc287435a555e527b1a27cae37
- SHA512 f46f9b568f3d0cb6b4e799a68a3d7defd4e35cbf3df59840d05e575e8580a0cd8e95a497b5f5b272c21fe4105264272d4b58c8bec211597bbcf2de099eab49f3
- SSDEEP 1536:N4eK+IFjWfoPbuaTRM3nFkwHbaA3LL0idWwiQcmWkF7jV:G+IF6foPCaTRMXbaev0FQcmWkRV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
69990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
G:\WORK\MONEY\BOT\NoName\PsiX\obj\x86\Release\source2.pdb
mscoree
_CorExeMain
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f6e297800457d823c0597e833d555135.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 da2a754ce56ec13af9f429d5dcd20ff88aadc429a1b0a74d68f217f87e31b42f
- MD5 f6e297800457d823c0597e833d555135
- SHA1 bef99c4a2e1ad4c2c478f156089158cbc624f7d2
- SHA512 69ae7dc2898887531ef8faa9740d56e6e40af3d0bafca4f2c78e4e4a37a643afa731985d9fbb9792ea61fd61927d043356a418be09b5ad1b48c73aec81af1790
- SSDEEP 1536:7V5jSYLT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtt6H9/0V1aj:7V5jS+E2EwR4uY41HyvYg9/0g
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f721adec82fb8994517719b69e8aa337d4619879e64cbd2fd80fc4e190e22c71.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f721adec82fb8994517719b69e8aa337d4619879e64cbd2fd80fc4e190e22c71
- MD5 b45837ebf5cd2f6e63284b8a8aa5a3f3
- SHA1 fdf773448014f4c1453ee9e481e7c617cced06d7
- SHA512 bdddd11c45e3c811ebdd23b1f9f490b2a59203f7a13b4caee9367946238144dd6812d55eef399cad9815b87f4b5a61e4d3018c6d9d7528a2493404e8a42c3c1f
- SSDEEP 6144:NtT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rT7a:P6u7+487IFjvelQypyfy7T7a
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
e5:51:05:0c:1f:f4:65:1e:46:27:a9:f6:ed:85:86:c6:af:62:c2:93
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f736c152b3d1812f1142ed0da99e0ac8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 78acaa343a31b3474452e4deb58753f16b72e9ba9ec2f537fd7d7431f699c246
- MD5 f736c152b3d1812f1142ed0da99e0ac8
- SHA1 5df819dd9a3c73b64b33950ecfac1c690fa0f03d
- SHA512 a3b30acae19dfcb40089e64bab3dae770b1f26d0de54c90a288a280f06a7656cf1739304b1eae8b0d7c12f1bdcd81780bb6499770e255d37a940dc138496b041
- SSDEEP 98304:hyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4X:hyeU11Rvqmu8TWKnF6N/1wC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3430773
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.>fc
Size
Virtual Size
191KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.;`{
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.`n(
Size
5.9MB
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
996B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f780377dd90d33c8280734d882fc2ac9.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d44c91defb81890cb0045d3a612485a4db65c1f4e52ce405efa453b8a07229e7
- MD5 f780377dd90d33c8280734d882fc2ac9
- SHA1 2ca8e1e97f1d9893389ea6f7505fe7c24924b387
- SHA512 ffa397cbe485bef45d52cbe19527bd7e16d5fe3847e80844dbb45fe96effefb8f0c3cfdcfa9d164786a063d6bc74a38c99ec2bab132b3841caaefb72b26be643
- SSDEEP 384:SL7li/2zcq2DcEQvdfcJKLTp/NK9xa4f:MYMZQ9c4f
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f7a96bf0830c5f7513d65086e0f7eb6679565b6ffdc6d1e325ee21303b38fec8.exe
- SHA256 f7a96bf0830c5f7513d65086e0f7eb6679565b6ffdc6d1e325ee21303b38fec8
- MD5 d32fe3fb50984221124e7fff0ac80a1a
- SHA1 471d011cd362c6b27c2b5e8a031fe012a112a793
- SHA512 1168ce8efa4050bc761b7665c88dc19c74f3228ff1e5a4431091cde297ce962802d6010158f2be9b81812ea2a6bcaf85829106383fb1467efbde8ee177ec75b0
- SSDEEP 6144:l0WD+E+QaLl/ymeKHhhkJgOY1/9qz9I3/BNmYEBbsJJutJOp:qVOOkJg3lOk/rm9+Ju/
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
69:99:f8:52:90:de:7d:10:3b:ae:d2:e6:1a:b0:6c:96:88:81:3f:58:15:a3:1b:23:bd:dd:16:8e:02:3e:90:3d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 13, 2022
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
PE Signature issue
Digest
69:99:f8:52:90:de:7d:10:3b:ae:d2:e6:1a:b0:6c:96:88:81:3f:58:15:a3:1b:23:bd:dd:16:8e:02:3e:90:3d
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 13, 2022
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Jun 4, 2025
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
68:b5:f9:08:2e:c8:38:ba:1f:19:64:06
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2021 - Nov 18, 2023
Subject
CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE
Serial Number
01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 10, 2014 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Serial Number
33:00:00:00:3b:6a:c0:1e:2b:21:e6:15:dc:00:00:00:00:00:3b
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Jun 4, 2025
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
SERIALNUMBER=14198230,CN=Crystal Future OÜ,O=Crystal Future OÜ,STREET=Pikk tn 7-5,L=Tallinn,ST=Harju,C=EE,1.2.840.113549.1.9.1=#0c1563656f406372797374616c6675747572652e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
68:b5:f9:08:2e:c8:38:ba:1f:19:64:06
Issuer
CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 17, 2021 - Nov 18, 2023
Subject
CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE
Serial Number
01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Issuer
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 6, 2022 - May 8, 2033
Subject
CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE
Serial Number
01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jun 20, 2018 - Dec 10, 2034
Subject
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Serial Number
45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Dec 10, 2014 - Dec 10, 2034
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
291KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
f812ad48d0a6d53611389e30fd8ae9f80a245fe3360b52dc833f6bf7b7b7859b.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f812ad48d0a6d53611389e30fd8ae9f80a245fe3360b52dc833f6bf7b7b7859b
- MD5 5269f6855d30bdd88ba0d88453c8e722
- SHA1 d87ffc99e105315bebfef48296f6b0e6e87ae5cf
- SHA512 7ab21f5e7d7fd6bb2149b80582bc50711941bce8128c26d48710c8e9a60d3eff153ab3f39696451b1a946da052b3dd2a4de444b9bb9e6bdb884bcbe03f654819
- SSDEEP 1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKE:xPd4n/M+WLcilrpgGH/GwY87mVmIXU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
137582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
516B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f8173be0fb3bebc0120e2cb017eb9922adebbb430734d0363e2d38e28ee47ea4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f8173be0fb3bebc0120e2cb017eb9922adebbb430734d0363e2d38e28ee47ea4
- MD5 1ac86e8c4255955942b4edb5a8acb787
- SHA1 fe54e3650b28e546955ae62eff32c87c5d3c482d
- SHA512 0cf48a59624c10566b282b202bc2f8c02e400eea4178ee6e7b0d17c76d2fa87c974a0d19fec41b0547b65b124e68f8d65b39c82a5033cb58ca3daabc282497f6
- SSDEEP 12288:6vqwgObFPVle870XxdD2ndNDXBCx/OJb:6vKBXxdD2dNDXBCx/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
569758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
548KB
Virtual Size
548KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f835ddaf4933c7bd4a3aa1f015442bb48b69f863f467dd8d1db09e6f2a427fd7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f835ddaf4933c7bd4a3aa1f015442bb48b69f863f467dd8d1db09e6f2a427fd7
- MD5 78be6e34e084a276a492dca4ab0c244b
- SHA1 ed34261034f95ea92460e82d0af35ffabf6ba7ec
- SHA512 298d5bc97c6c47c81bb5eec2985276e078739971ccaebafbb3c289f55daaabb9d3a871682b40caa5fc499635e892be93f51062aa1b903a41487bbd32c98d53ec
- SSDEEP 3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIbjiT05t4Ziu8hBVv4TPcXQZqn:sLV6Bta6dtJmakIM5BGtMMnEcXs7hmk2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
124818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
f846950431f463a0a7e663ea7003e31c.exe
- SHA256 4022f2227edc7bd96dfbdc2dd88697774b5f47fa7b50a0098e14dcdf0cc8d4ef
- MD5 f846950431f463a0a7e663ea7003e31c
- SHA1 d503a8270aab52268a1668b129be687bba0faedb
- SHA512 330c48bc86fc75fd0fccd1a04800192c46cea7b1ef1e5e9e39873a4e95c0e8ee766dd9e77a9d6dfc1b3f09c1e1c8833abd5a3c7ae099a2c4a618e35a76696d88
- SSDEEP 6144:YeC4EwZFoobUk8qp0qpgogZfpjkNaXiCEa4+U:8fhuLwflkac
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
225KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
f89219b77e5fde5a7a1581e3e4cc0b00.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6c8d0a52686544703953357f4d7655e5e1a27a90e2f1aeac9eccdddb618333e5
- MD5 f89219b77e5fde5a7a1581e3e4cc0b00
- SHA1 557c9ff996b42056c0531e63ebf5e7d794b23b19
- SHA512 9ba62300e547e971ff79e4ec0209e07197414071ddf0b90d4a951e06a82f258ab2abcd9653b5fdeb5febe9b6fc8b6a28ce52f7360d94b63283fd0485168b6a40
- SSDEEP 3072:bC6UBkwelNBVB18I8qk49NWa+miRztQYi+GVnkgLmVv3yniVH9T2mZP:bdHvH8+k49wa+LRBQYi+OkgKLVH9T2m
- MD5 SHA1 SHA512 SSDEEP
-
Detect MafiaWare666 ransomware
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103522
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Downloads\Compressed\EncrypterPOC-main\EncrypterPOC-main\WindowsFormsApp1\obj\Debug\Cheat Point Blank.pdb
mscoree
_CorExeMain
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
199KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f8a3f1d5a1d18a666d9b81a974e212b0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a72f747218f7c4c8a3c47d51dc510daae56df59b626c36b32aa64816a7104487
- MD5 f8a3f1d5a1d18a666d9b81a974e212b0
- SHA1 035f531e396979a8cde58b592c178d96daa46287
- SHA512 d9848e80f2b05385f0148e32c7485107753978e066f56833d602ba98c1f0386f62dcd6b3f830ca17da3a934957ef796c542c87fe3a2f30853b0ceaaa18e6b0d2
- SSDEEP 768:Wu/6ZTgoiziWUUM9rmo2qrUgYo2Br/wBPIw7+Vcxti2M0bDQL+m6pqetavz60CNq:Wu/6ZTgle2PgABTpw7+Vcfi4bDPrQL6i
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f908d30321810e4c87131f6fea397e39.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 876d81ff40086b50fc13a3f7e3a6789ec7671a261ef4b6639611e205eb8ad715
- MD5 f908d30321810e4c87131f6fea397e39
- SHA1 31c5d474199c401dece4934cf3fe6c9159c36097
- SHA512 b449207f9bfd37aa4bc27b698b5f0a8540c0347d5216ee52ef8c97f46b819ad1fb2fd8480b50ca6a251c36798701cd67f5200abc72e939e8607a7416ae33f51f
- SSDEEP 49152:TrYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:TdxVJC9UqRzsu+8N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f926cc363c27c542c23e14398096eda8.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ec0c9de9d6eef69bfe2c220f21971d4acc91004194cd8cf993a2bd34a04e31df
- MD5 f926cc363c27c542c23e14398096eda8
- SHA1 03442d6ea4a9acd36987b916ffe0261810e6dbfd
- SHA512 581d105843a37d51aed86b071aed97c4188cb4bc8aed8b8c9bd9f7c297d5b3ba79d1d93f0a3d9bb5da89dbb445385838f7df229bec27b36d46b13757eb16491f
- SSDEEP 24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f947bf8f07543c9beae3fdba615ba1dd.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 12386309263eabae4e6435bd13586f4964195b0fc7a5435a26eeb1d0d21b589a
- MD5 f947bf8f07543c9beae3fdba615ba1dd
- SHA1 abbb9d1fdca37cbb2b19e4cd275fb48a6ce49118
- SHA512 a9732511b6e4e89c48de8a1305973d18be50b01eeb8572c7523399af78648d072c3f31f17de905e96d59508fcbda3d9a9b1cbaf64e799f59267f8055ec3f8a77
- SSDEEP 6144:FtT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rcnKHZ:X6u7+487IFjvelQypyfy7cnKHZ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
72:d6:96:85:12:f2:c6:c2:de:49:89:a2:a2:62:73:61:68:f0:33:16
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 4, 2019
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7BF1-E3EA-B808,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:19:a8:1d:78:2e:73:69:b2:09:00:00:00:00:01:19
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 24, 2018 - Jan 10, 2020
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f97418dbfcdd3f6d26c6cad46d16ec06.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a1d077893568830b15dbf3996ed1a5c53a32314f128663539032289c686e61db
- MD5 f97418dbfcdd3f6d26c6cad46d16ec06
- SHA1 6a27ff3bd4f16221eb56f00bd0618c33ebd77973
- SHA512 959257a8be5831e26baab82a6df907ad9c796f181d74f02baf3c05eef102122606610e08a815bba73da9a24251555136b636c943a59f375f26609827bdda210e
- SSDEEP 49152:q/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4Cf:
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2135038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f98ee08aed6b41b1f9e6e1ca752d22cc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 82db60e8849ee07cae78c7f49afbbed2e3544618bfcd5d01daf09b120e97b1e0
- MD5 f98ee08aed6b41b1f9e6e1ca752d22cc
- SHA1 0ad8d0bac5c76e5f79ba872cf3ae18a6717ee6dd
- SHA512 63dcfc32399062ec5bb65a3a579c75a86bd80bc9bae28d63ff5df3510ef319a5e3237629fcea17232cdbaf96bca0347cd8d8b7669698188cbf08bdc2f3caed5a
- SSDEEP 24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8.exe
- SHA256 f990d850e111bf361124a5a27c29b5634503f2c8f2c710bbf0693bd4f557f5f8
- MD5 54681d828ea105cc3603c08eb985dd5b
- SHA1 6958c3b1c8ab17e3e574f2ed899d02e0e97ae32d
- SHA512 e8f62f02e5b81f4d6384b5289ff9e358297559b92f7519a991ad14de14907adb390a014434210f759d0ee8a6290dee8c5bb9a10ec3addcf614b02f7caddd6e25
- SSDEEP 98304:RRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/0:Rkj8NBFwxpNOuk2H
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
f99ae4a3786f8c8da71654ddaba30b4791692d795c93ec1f60b0c58f3be43c93.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f99ae4a3786f8c8da71654ddaba30b4791692d795c93ec1f60b0c58f3be43c93
- MD5 52e4554ec87085ec0d31bca66d35df00
- SHA1 3196fc8f3064b5d80cd8829c0b3fd6730b2141c0
- SHA512 04070464d0489ec88509dc767f9c5f0db4dc2e1b3bb06ac3719441a5a923172d9fcac478dfab1b7ad4cdd2bbc0a39f77c6dd0d5d256dfd82d474e74e1b9af899
- SSDEEP 24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
f9a573b21a7be92000f27a3802bb3518.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8b4ae69ee8e9c474995753217333a2e9257b0c5131e811c6c0abedc8f19877ce
- MD5 f9a573b21a7be92000f27a3802bb3518
- SHA1 f1d683fa18e0877c057d201e9af7b518ae82c7d0
- SHA512 6467c1c32ccce29cee3e70fa02dc1b19519464e0ae6089570fae5dd77ed8dd4745808fe40f251a2e19c21aebea4fd27aaa8c0c96a065a1a4dba896fcb220b334
- SSDEEP 384:b/iH4qi0/JZtbH9KyM+2bzmgHvis2gbjrAF+rMRTyN/0L+EcoinblneHQM3epzXW:Li7J95M+2b6g6tgnrM+rMRa8NuKft
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
fa0d8e0c80c4d5be75d4ff442d6a85ea4750bffb3526d4d2d3b2e03f3ccfb28e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fa0d8e0c80c4d5be75d4ff442d6a85ea4750bffb3526d4d2d3b2e03f3ccfb28e
- MD5 0284698569314699a47d0ed2411da31d
- SHA1 2013c6c44d36797c516eaefcda085494fb5595ac
- SHA512 f9d4ad9c5959680cae1b648f970fc9c7dff71731d825bf5522d658ac02ea62764dbe149b4f5360daf0200f3bd7c09885dc3de32ef6c5cdc112b82f491ff5a839
- SSDEEP 49152:yvlt62XlaSFNWPjljiFa2RoUYIm5RJ6sbR3LoGdD1sTHHB72eh2NT:yvX62XlaSFNWPjljiFXRoUYIm5RJ62
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3269598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
fa8e531e0860851ba2d1fb27a07f1879162d4f9bee94df2b818bae9d7834a884.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fa8e531e0860851ba2d1fb27a07f1879162d4f9bee94df2b818bae9d7834a884
- MD5 61d8d796a3ad816357cb444faa6e393b
- SHA1 ce40cb81364e079c7b9e11b16d61c94419b43610
- SHA512 4c5de9f0c8cc9e8aec193955378b823bae3406b07cf6820e9fbff2f478d2550affeeaaf96a1edeb8f17045ec1912d23965ad4085620d7fe58e2be0ca27e86db2
- SSDEEP 24576:wD39dlfGQrFUspugRNJI2DJnUw9W/j+BeKJWqwH6p:wF+QrFUBgq25eKu6p
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
04:24:d2:55:6c:af:3a:61:af:b8:bc:ab:a7:38:3b:63:23:70:27:dd
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
722670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
698KB
Virtual Size
697KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
fa942bbb984e2be3a2e1d8414cc00cd7.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 07419cc322e8ed4baae30a8ba72afc56634175dd54b57c513112e420a9cc69b4
- MD5 fa942bbb984e2be3a2e1d8414cc00cd7
- SHA1 822821106f149cbc674cccf5d8cc1aec612bb8f4
- SHA512 57f062fa5d5fbfa9ebba4ca401e42954b0ed16ec7bc4f28bc6ca00b06e273bbe6dbcab895fc6e460262fcb42cd3a0705a61bb4de2d8a2a08baabb738868af2dc
- SSDEEP 12288:zzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:zzZvuGD2PvA5YxwmbZB6Uv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1013790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
982KB
Virtual Size
982KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
776B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ