Silver Rat.7z
- SHA256 3fce4b5d26887b84f5f9081fb4b26fc8d8a28bd4e44cc5b7d4f94f1407d4a1e6
Password
infected
Behavioral task
behavioral1
Sample
SilverRat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target Silver Rat.7z
- Size 10.5MB
- Sample260314-t62tyset2s
- SHA256 3fce4b5d26887b84f5f9081fb4b26fc8d8a28bd4e44cc5b7d4f94f1407d4a1e6
- MD5 94306cf12778c76e530c99a79ffbf155
- SHA1 78ff9ae383665885d4c484c225e8db093f379273
- SHA512 91a4bec7c0cf86c935fa182f1bed613389fa6250675e31d262e2ae2e90b61b4d15f0045c9562615c43bba8e057a7bcd52d98ec06109f935d7e8dce02c0d3b734
- SSDEEP 196608:cEqZUYyeiDxFBVwSfSjR4FaVrVqtnBET7erfudD46RqhzXog4pVFArDdUkL3tmmU:cEqN0DzjfiVBqV+ves4aAog4KdUkLFB6
- TLSH T167B63314E4E864E3771D74210FCD65A88A77F9D9C6E8F20210E26F4FB17E4116BA29E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Bunifu.Licensing.dll agile_net static1/unpack001/bunifu.ui.winforms.1.5.3.dll agile_net - Insecure Codesign Algorithm 2 IoCs
File was Codesigned using an insecure algorithm.
resource unpack001/Bunifu.Licensing.dll unpack001/bunifu.ui.winforms.1.5.3.dll - Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/RestSharp.dll unpack001/SilverRat.exe unpack001/bouncycastle.crypto.dll unpack001/bunifu.ui.winforms.dll unpack001/cgeoip.dll unpack001/protobuf-net.core.dll unpack001/protobuf-net.dll - Untrusted Codesign Signers 1 IoCs
Codesigned binary was signed by an untrusted entity.
resource unpack001/guna.ui2.dll
File Explorer
-
Silver Rat.7z.7z 10.5MB
-
Bunifu.Licensing.dll.dll 1.3MB
-
Newtonsoft.Json.dll.dll 659KB
-
Plugins/Camera.dll52KB
-
Plugins/Chat.dll36KB
-
Plugins/HApps.dll30KB
-
Plugins/HBrowser.dll22KB
-
Plugins/HRDP.dll16KB
-
Plugins/HVNC.dll31KB
-
Plugins/Keylogger.dll13KB
-
Plugins/Manager.dll126KB
-
Plugins/Options.dll45KB
-
Plugins/OptionsForm.dll28KB
-
Plugins/OptionsForm.dll.config122B
-
Plugins/Passwords.dll63KB
-
Plugins/RAPP.dll18KB
-
Plugins/RDP.dll17KB
-
Plugins/Ransom.dll14KB
-
Plugins/ReverseProxy.dll12KB
-
Plugins/ScanNET.dll438KB
-
Profiles/Builder.xml1KB
-
Profiles/SocketPort.xml57B
-
RestSharp.dll.dll 166KB
-
SilverRat.exe.exe 25.2MB
-
SilverRat.exe.config.xml 526B
-
System.Buffers.dll.dll 20KB
-
System.Collections.Immutable.dll.dll 175KB
-
System.Memory.dll.dll 138KB
-
System.Numerics.Vectors.dll.dll 113KB
-
bouncycastle.crypto.dll.dll 2.5MB
-
bunifu.ui.winforms.1.5.3.dll.dll 297KB
-
bunifu.ui.winforms.dll.dll 1.3MB
-
cgeoip.dll.dll 2.3MB
-
guna.ui2.dll.dll 1.4MB
-
protobuf-net.core.dll.dll 263KB
-
protobuf-net.dll.dll 251KB
-
stub.cs.js 84KB
Bunifu.Licensing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 661a5be944dc9fb2e0eba01c3c0584feb3ecca44877d77f54d0f409ce801af22
- MD5 c18a9e44e200c7315a1868caab894293
- SHA1 18f65508762d2492f41b22e4e6e5ad19a2226baa
- SHA512 9a5e08bb6ed4535ac92ca446b630b29587cb5a4d7d695234a5d93267d2ac13d702b3738ba0e20606f10020e9642e8e315e7ddc92f1c321b68daf8524a3f5f2d1
- SSDEEP 24576:d2zl/P3R5+dsFXDbzFWIq7GVuU9QS3AJYeyA1xJj4WIbDIHIr:d2ztPhM+XZWrqQAw61bHr
- TLSH T1B155019032F8991AD23F13FDDD11870047A58A4A942AC70EDE87A7E90EC67D1364F76B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Insecure Codesign Algorithm
File was Codesigned using an insecure algorithm.
Password
infected
Digest
ec:b2:77:c2:12:4e:91:29:6f:54:9a:e7:fb:15:1a:ca:da:79:ed:09
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Chains
Mar 3, 2022
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Serial Number
5c:a8:2f:f3:e2:49:8f:60:ba:9b:0f:ad:f3:bc:d4:87
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 31, 2021 - Mar 31, 2022
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 19, 2010 - Jan 18, 2038
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Minor OS version
0
Major OS version
4
Entry point
1345354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\wilsk\source\repos\apps\desktop\bunifu\work\bunifu-framework\Licensing\Bunifu.Licensing.Redistributable\bin\Debug\net40\Secured\net40\Bunifu.Licensing.pdb
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
- MD5 4df6c8781e70c3a4912b5be796e6d337
- SHA1 cbc510520fcd85dbc1c82b02e82040702aca9b79
- SHA512 964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c
- SSDEEP 12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn
- TLSH T177E4395133F89E1AE1DFA774B4708A2943F2F40AE2BAE74F5A45A5F92C937504C047A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
a7:cc:fe:41:40:99:65:07:53:c6:c7:f4:1c:e3:22:5f:f1:9e:7a:db:83:aa:c0:1c:bd:9b:44:a1:54:ff:58:a1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Apr 22, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
672442
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
649KB
Virtual Size
649KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Camera.dll
- SHA256 2c82773466f72756d8152e4d5dc24d2ec954bfe5a6e7cae587d2e1d316ef43d0
- MD5 e9e0b5fc7b1ed6f01d08d981d1cd761f
- SHA1 011ac2fa1b9df6a4cb6d88c14316216bb64526bb
- SHA512 df75359dd9c1bcc6bccb17522186d710ae16054a496c3f75fa171dfe8f09e314fb28a7b1111193e64e37639c6d37de5c77cd99d795f72ab5338459886da6b964
- SSDEEP 1536:K74lunLw1ANlGCkO9bTlqpWQq5As9VG3wEiz:K7XXaGHApPq5cAEiz
- TLSH T14D33028F34850DD11309AADDF01DF5CD85F683C88BF99A2CA285CDBCCB73676462A618
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Chat.dll
- SHA256 0c83898f29762a4e3650fc5f5a8a3c3114d06da8f6a3fb2fa8b990a36716d6bd
- MD5 736292dd81ad93bff84c28ce5de02385
- SHA1 40d46e915d049966f023e8d8c1e059d9b6c22567
- SHA512 c126f17b9ed91994d52e61c7ab75536962a2c0f03cf90cba06fa423dd732379e7ccdf4050dada73267864feee8b677bd5c16ead8a485e3d8bd3f4bcc462015ed
- SSDEEP 768:IOgpJ+MbCCj9fGS7C1mf8O1eJU4Fcn6vELlZbS/uG7lknOez1fVQrgYo1:9gpJRH997DfB+U4FK6vEWuml+z1VQrgp
- TLSH T14403F2F48C952BFF8264B57D4672E37DB361352C0603AEDAE9DD7821554208BC6F2362
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/HApps.dll
- SHA256 d922c1762640f37a503eb116627a732290ae38b52f9b33437ffee608f7853a28
- MD5 a7c3b329ab9f4e20ed40c78b2ac36864
- SHA1 fcb594e1a2a7c27e0208d413411e1ca30fdf4279
- SHA512 870085fabe2ae4768b6ea9d2e7f13dad752f4c26ec6d61debd0b76c683771823b07338e1323e26c0c8e17f9ecf7f5d7fcd4b7d0b148501ef9e278b8b680925f9
- SSDEEP 768:B+Oy2Qaqmlo69aT1+STn1dtU6l5sOyniwSWAqDIug:B+a1oKYcMnt5TbWJg
- TLSH T193E2E1BE80771C7A65193B69F14859FCCF8004D83A5194DA2F9AE6762D437BB2C42D0E
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/HBrowser.dll
- SHA256 55b5efe0a09cb5cb79308874e2e5d25c895f995754bbf960ce9a403207ce3abd
- MD5 ce1d9f8c498cd8c5ee38fa94df4b4907
- SHA1 d3b811137776e4b1dc937d294ce0eff9a12594ff
- SHA512 58c9e62bc32376773a9bb1f266aab617ad2098f2d12b13fba1bfcefdf3edd1f44682c791567cc67035550b80b735ae460111145fd1b9d733325cda9dfbe61849
- SSDEEP 384:a1vknrDG5kbu+MyKCduqwYjrVCSvuC+s6ZxMuzB9uzwVkOLyeKKIyYCiJo9BkzH6:CvO+CnMyKirwkuC+s6ZxPzB9nkZM/Bku
- TLSH T1A4A2E1388DA5060114EE5235CD3F9CDCCF37476E95074BC915C2842A7ED7A488B7A70E
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/HRDP.dll
- SHA256 a475f59f6a1b6b1fb4c6e78f1fbe7df2d38c4f743488ba7da128a5771bf6de86
- MD5 b9c9ea357d04731bda8c8393ae5cd741
- SHA1 8d462aafddd5f37513226523dd4b7a354be2f492
- SHA512 1876e27c5d224d4bac403f99bfff21cbdd35e3d4d91257ff7c2482552e9925d85c69eb092e590ca48251e8fbf19372c131d191caa0e2b8977a2ced36173515e2
- SSDEEP 384:KiHITWv10Dlxk/Apew9M7A7VAmp93Yc9d1CThP3kVL:DdmPkYpn7VAmn79dQThP0VL
- TLSH T1A672E1DBF8641BBAB18F9EE4744B01B0E4428073566D66BA418CDCE3CAC363D6F45C49
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/HVNC.dll
- SHA256 44cb17f3b048ba2c7653409b0dec7c94eb86d2cf0322ac79ce6764d5b8df1549
- MD5 3d07031e76978680240e80cc54451ad4
- SHA1 255f32852fa97990ce16c8bdae766c79c7bcfe56
- SHA512 3595793d4b8e197a60d9c28060415489592da44e20e8f999d91e4c2f164e43ee00aaf94216a0daf4ade1cab8577dd34bb8e02c7ba12b3757b2c82c4e4bb91c7a
- SSDEEP 768:hdLQtzcSzlbMwNVCQZ/7zBcdiWhl/6tVSFn4MU1bpN2OCDSjLBydQEw:rL6oSpNVRZ/fBFMSt2fU5/jCDeLodQEw
- TLSH T1E2E2E064ED977763CA0C3B272F0A0AFA4113DBD5C6C53056F8663E3651EA4CE12664B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Keylogger.dll
- SHA256 c3fd1d11641109c9033fa20af16c6b737008c137fd8a926bf0b4c6630d8ab9ac
- MD5 8e2d761ccea68168d0b991b475155678
- SHA1 2872d722bdaf496d520e643d114e712199ef00f1
- SHA512 e179a1da9f2d00cd74352dc81305462dc928a6e2acace665d42e8a2d0999bc6c8669e5e290ebd17064c6166604f87de2c7e7f31b42b4ea82b23738792c68f68d
- SSDEEP 384:ilOmhksiBTIy2tyzb9UX1jiXGf+histUnXdRcrTZxx:S29FIr4zBqUGGc2UnNITZxx
- TLSH T12A52C0B585D021979090FE267C9678A7005010CEBDAB566C92BF2593F78EB0CF3B5BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Manager.dll
- SHA256 da8c5ffb5d268e9aa5783bcb064502df8f78cba724a0f96793795fe97e62a6e1
- MD5 b17ddbfdf27aaedb6e26ed70783a6ae7
- SHA1 08590ed55d9adc47c53a9dcf7dfafc60b877aa13
- SHA512 0079131280257413f43a01a0de2b3cf393745d2864ab521619888b3b25f7f0ec1f32f9d6f682250b73c92c1483d841f7ca3f8bf34e785e3fc93afae6d086693e
- SSDEEP 3072:rgBZ0kM7aryhNEAXTx0XGgrLU2T+2CdjVz+2YLaBb4oPL6:8BaH7aEE2mXbLU2yz5b1G
- TLSH T1CEC31322B70E8750DB2D03ACA456DEE13055CC40BAE91D678E759F0BE2DE588DE7507C
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Options.dll
- SHA256 3fd7b67e56b40caf53aa9b2df102967f7e2aab0bb4bf90ea769ea725c0498657
- MD5 ff88d61dc7adc644d79b0f898059a7b1
- SHA1 151557a014d6b177fd1ae1496f0719184df08c86
- SHA512 ae06793d10c6c76a994db8cf3fe97a859df2a1e0dd2bc56fac042bba8a93a56e52b4edf28a30113e4cd547157bde07a77383f0295822d8e6ddea51dfcdc0b1f0
- SSDEEP 768:guYdNeZRx4qeyvSlFSOr4eKzBSea9jxOyVKJiN86ajxYGit6N2iX6/bwN45BVFg6:Xawe0SlFSk4eKzBha+yYiF3CNNX64QS6
- TLSH T1FA23F1BFB00B36AC176F498F5887F57A96335E544C983EA8C471390FCD8001AE92997B
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/OptionsForm.dll
- SHA256 b2a0dd7d7b92ec5b99e3b18fb0235b3b039373edf9a4ea51b36447ac7d0ad464
- MD5 fdaa271259f3b58f88bcfce1da990af4
- SHA1 ae2bb4c6725134e9f53f7d63d8920d5c7c4e54de
- SHA512 469507660f15a9b72cf160da089b2b4e44625010ba15cdee3d6e08f467e1d724aa0d177adbd7af926a55b0dddd016d565804ab1b2fb071ee37b48487d553b8d9
- SSDEEP 768:jsyNQnYSA6ncANYj93R++1XZiyTpidYe0Hhhv:1D8Rm3RrXZiyTpiYHv
- TLSH T11DD2E148C000C85EBA9D98B775C1AADC75B01F33A1DA9049E2B7CE434BD86F26BBD50C
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/OptionsForm.dll.config
- SHA256 c53f33a5c3a7dfa005f62bc9d81ae8d6e5eb019463bd2986c32ca00ce9404f1a
- MD5 a78fa19b73baa4b9bb1d29d22dfbea83
- SHA1 f4a03e27396eb1a3f3e135dede8cae930f7cc3a5
- SHA512 e6811ba76e7a0284413af12cbe06884fb9e2f94c09bbe42f9adc03cb506cfee7c081e1002a1d59fd6db910ed33f255de9f4c0236759bf8cd39ad8886f22e3e6b
- TLSH T12DB09243554C6D1347338E23C792461CEF75F3D34416040CF836B7BA1EB228D064321A
- MD5 SHA1 SHA512 TLSH
Plugins/Passwords.dll
- SHA256 31805c53dcd4df47675401e2f286026492a4d2c9ffb13bf5293e8955d5ec96d1
- MD5 67df2a509df555bbbb04264d9177c4c9
- SHA1 4afbe8e70698cc6cc7cb2091c1d7dd8b343e49b6
- SHA512 0b10b268a5590aa4649decda9190df03673f55b09bf66660cab43f76e61cd9afd4e3ff285b6623377f883930f3221933c7abde1b795642ccd909ccb17154712e
- SSDEEP 1536:wCulm7fmXE654s9/i7fiaMLY/u9rU3xgQxR8:/KXE6Wj74L4u9r+E
- TLSH T12B53023AA11ED029B326500F175E89CD00DCDD794AA07AE3A2F9EC4C35767A6D4705FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/RAPP.dll
- SHA256 2e717bd5321a2ac65b38cc39238dafa7e34b7446031a6a6200aca86199a59ade
- MD5 3749325c46c36e83ea28ddd92aa60c9f
- SHA1 a792b9eb154fcbd376660bca5bb1cac11e29cd17
- SHA512 876013df8c6736ac3bed7e8efb03cc783abe33936c2f8b7908b554b5584c42a8e81f953f7c4066576d8ef931026eb4af84618179cc0001519c493f6651ccd4be
- SSDEEP 384:ac5CxOJrR6SkdyR9DVB8PMhwkQAuWh/Z+tBEsLHhJU1thzssJaBVoS7z+8cbt:acUOR7lRxT9+kQdWh/AtBEaJU1ti6S+t
- TLSH T15F82E1C4B1EBD55E1B95B1DAA10886D32CFCBB2A501A7F8F14270245910DF8C4D5BFEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/RDP.dll
- SHA256 c5d5123886fc5e948693a2c1cf14b6b1262f2b98b2ccb6ee3b06bab0c32e6c00
- MD5 2bd24da470e3968fec572600d4637f37
- SHA1 752a3ee7e92e6141c26338b327b5a060c0583030
- SHA512 60df75c2362a991ce108ed2b52d47316b56b527eef67700b89a6aa8dc52cb0f223991fe6b9819d4c047c5445051078d55965209bbf8f7c1421fc0dbc12fbc393
- SSDEEP 384:Iy6n5a9cH8dkubDfK+eTpual9QSiSNkQ0KhEjH66U78:h6whHfK1lWzSNZ3hEjan78
- TLSH T10B82E165D32DE79C642B60878D4E2B68AB32AC71E31064DB930F8F5D17029E997909CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/Ransom.dll
- SHA256 d47f10f19ff148464747bf7e38f7fb44c1d99569d4a9b31eee731abacd540a2f
- MD5 47ced016511c0edca8af7e371ed50136
- SHA1 83306913534c4a2ff234ce1dc399ac017978a476
- SHA512 459333e1c3437b13db1988f901c97f16ab6e99269b3459001e898f661322b4ad034046b29561c0a6b366ff3d2c69a27334d49623744e3ee4f3341789b4bab37a
- SSDEEP 384:mXAJqi0AmyuWlo+Oz+t/7maeJjl4a9Ju4upj4isYZS9TF:m4qi0AoFcmJh4aPNupjXZS9TF
- TLSH T18762CF4F546ABB33432287DE51901962CA461DA701A66D682FC6602ECD3A8CFCD6F0F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/ReverseProxy.dll
- SHA256 d5c47e21b22ddd9087ecda3c2bad283de7d3dd69906802f2023f86bbba92f06b
- MD5 015e7bdd40eee884542840f551074710
- SHA1 6d5d38182998f28129ad8f0f5801b89cee4e6498
- SHA512 a199f5be4a0a83a291ee19868428d147783e55c38067d10c0353fdfc363087c23f88b8b2d44d7fbf7b16c03427342d96fc0dcb52b6cb1064dd84d3f0f28d5afe
- SSDEEP 384:asuofwnSWvLO+H7rOo4bY8IiA5TpISmM3:JuykSWORo2Y8rA5TxmM3
- TLSH T1D642C1AEBE7599D6B463E06ACCF44C63201E08005D77A217765242BB4FE0C968F49B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Plugins/ScanNET.dll
- SHA256 389a2431ed1c413afb6c5361dde893cfe4374c56f5121151f91e9ed8723d0967
- MD5 4a66cf2e8575107a677833dcbe7e1142
- SHA1 59dea7c17ca242a5aeb6a5a9353f711bac1e0eeb
- SHA512 005893f2ee4ae6375ab9464c002326f6c07d1a04fad8034adfcd3a9506358fda43ffeec6600acb20fe4bec25765dc4c3046343a1e51cd80a7d7f1164cdd4fa37
- SSDEEP 12288:05joX7j3jnahCS4ENDHg9OiaDrttMVf8cMSuht9U858W7B5ONJsDy1P+PioK+ci:0Rq3EttwC0V3Luht9Ui8W7rmGuixGi
- TLSH T1539423EEABC588D4CD041769B0E653AB71FA8350473328A7153507F2A7BE9D29D30B16
- MD5 SHA1 SHA512 SSDEEP TLSH
Profiles/Builder.xml
- SHA256 b4b7d0f7878a60e5d641443a7d4720e178568e6febbb38a243d3b9fb8a30842b
- MD5 3fcd4ac4720febae7ed0b81913daaf1c
- SHA1 7d2ec4090023cc93a453c65782c78fe9bcf5afbd
- SHA512 c6a5c5c5d17d2e56fd2fde8705062a8916673ec5557ef9f30c9f62c67877c72f5b8e4528a3a8a8ec24f74e5c52ed385442483606b13972bcc645257a5826f2ca
- TLSH T1B23177B4FCC0F604397B4262B626CE96AEA1D7F045964D38FAC5DB5FB1009903267A36
- MD5 SHA1 SHA512 TLSH
Profiles/SocketPort.xml
- SHA256 7b87c31f6d1163fc236651f5e1f3187cfa0c79d4a85d20c1c05f1dc3056c4823
- MD5 5f807862258a390b2e2f75abb6d2c865
- SHA1 22abc144aa034c6490cbf143a8f1cdd42bd06d1b
- SHA512 b831e4b2eeec23e39544961cef6619c8d57c50b53dc6bad8846682df6f5252041f50ce33cbe182488288d6d5e2e3e5194055ee4143ceb09f9601ed49d39dba39
- TLSH T16C90028840A21719347930B3D154221870109CC1A3B78A345031115324437F114536D0
- MD5 SHA1 SHA512 TLSH
RestSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e7a0f3910741e81f9b4660501b30aab5eee71cfa4fa9dcc9b32acb64c865428
- MD5 09806e18f9f8e3f2351827be22e634e0
- SHA1 54ec870ffb8ce10b3c8b05bbc7fb7ea45142a430
- SHA512 45b5743bd3f50f51b6953bbfca9f8c5d1aca75aaed5cee0d6ef401034a05a09f27b928f539101801450b428ca7eac9ecc3ad0b41f2bc19258da52fbc7dc8ed09
- SSDEEP 3072:JsC2yztWrT99ZTN/ru4Y1Gs1AvVUDOIpjdz4LuYcEFRZ8w/VrvFjsu2i+:JBztWrT99Z5/am4IFsZ4LuVEp8oQ
- TLSH T114F35C1DA3BC4FB1CACE0E3CA0F081008BB5E65B6503DB9A6D50D8F53A17F559D06B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
175886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\personal_source\RestSharp\RestSharp.Net46\obj\ReleaseSigned\RestSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
164KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SilverRat.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 79a4605d24d32f992d8e144202e980bb6b52bf8c9925b1498a1da59e50ac51f9
- MD5 d6527f7d5f5152c3f5fff6786e5c1606
- SHA1 e8da82b4a3d2b6bee04236162e5e46e636310ec6
- SHA512 2b4eb9e66028d263c52b3da42fa3df256cf49cd7a7ebdf7c75da6a2dedfd2c22cb5f2071345b7016cd742539c74a801cad70c612330be79802fa19f860ea2d5f
- SSDEEP 786432:SZYRGnGvovVvAuuglekvAR4vzHcv6lHGH9KdDmvQuLGgJMKV+n9n1vgvVv2jlv1S:Ik79a
- TLSH T15147C602BB049B04C97C347A82FB2E2DA3E5F9CB17718A1FDF1136661DD62B699CC146
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
26378110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
25.1MB
Virtual Size
25.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SilverRat.exe.config
- SHA256 a47f3f83cdb9816f03632833dc361ac5e7a4c5c923af1fdebfa16303f9d68a72
- MD5 d6f1152d647b57f64494c3e1d32ede94
- SHA1 a35bd77be82c79a034660df07270467ee109f5ac
- SHA512 699b5ad93d3497348f8aad8e15d54ddd789bbac43f11a7fb629f19cda3749bee0ae06dc83f4e6246df631488169fda5d15c48585581d3a96d2523b8b45e639bd
- TLSH T1A3F02E2094C8FF658F324AB33A7B9418DBB553B3245C048CF5DF699B4B326994117277
- MD5 SHA1 SHA512 TLSH
System.Buffers.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
17218
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Collections.Immutable.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 67730917b4e856e37a9d78245527584087fac6b20a7377677b2f444cd15db918
- MD5 8f55c22412f7d448d6e7b83102665368
- SHA1 88df86ee0b137992af15a35825804274fa252e30
- SHA512 058431aa2280511b00a72ea55ded9bdaef55420f5bce10c9352d4f92736a11884d1e70706016b988cca560358b3b43ce1bad5c9bd726f11d8ad66e3c91f98ccb
- SSDEEP 3072:gUbJLl+WMe7FJ02NPhVN0T2rcoNXvUJ4C0jucx2ejoVjM4xT56pL:gUVMWNvrxUJ4CDcY5G
- TLSH T127043901738C8736CABF4D77B46285DA9A36C253E183B3DE29DCFBB448933A49D91059
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
33:35:16:55:df:62:5e:90:93:72:fe:bd:fe:ac:db:f2:1e:96:b4:4d:30:e1:68:45:9c:04:3b:aa:ba:f4:42:36
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 14, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:0c:aa:78:6e:dc:cc:42:4c:c1:00:00:00:00:01:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 23, 2019 - Jan 21, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
174314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb
mscoree
_CorDllMain
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Memory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 8, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 2, 2021 - Sep 1, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 2, 2022 - May 11, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
136114
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb
mscoree
_CorDllMain
Name
.text
Size
126KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Numerics.Vectors.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
103866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bouncycastle.crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
- MD5 f0b3e112ce4807a28e2b5d66a840ed7f
- SHA1 54a6743781fd4ceb720331fce92f16186931192d
- SHA512 dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190
- SSDEEP 49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr
- TLSH T132C53A1877F40613D6BAE7B595F09021A3F0F46EB393FB0B6591A7B50C13BA24C816A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2603454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bunifu.ui.winforms.1.5.3.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6937052b86bc251be510b110e08fc5089d3bd687ce2333a85ea6d5c2c09b437a
- MD5 c1d51a0e747c9d6156410cb3c5b97a60
- SHA1 86312cba2eb3495cc6bec66d54d4ab88596275d8
- SHA512 a8d7b2e5555c01076e8dd744d21d8cd901aaffad052af0e8c22269e8c2f765019422ed245368a64d64157652a0e4fcab1a889086fde4e139b4ccf5f7bad08222
- SSDEEP 6144:S8oD4R+RVzdBZI1TAcHoP2iErkSeyoJij/YKEC:S8oMR+RVz2FAcHo5y+eEC
- TLSH T1B754D5017579EA73D9FEA7BD96401000ABB18CD1AB6EE74AFDC853EF2993395500E04B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Insecure Codesign Algorithm
File was Codesigned using an insecure algorithm.
Digest
3e:60:9f:ee:0b:c1:db:79:70:f4:a1:a5:c3:e7:56:69:b3:1e:fc:57
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Chains
Mar 3, 2022
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45
Serial Number
5c:a8:2f:f3:e2:49:8f:60:ba:9b:0f:ad:f3:bc:d4:87
Issuer
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 31, 2021 - Mar 31, 2022
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 19, 2010 - Jan 18, 2038
Subject
CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 3, 2014 - Dec 2, 2029
Minor OS version
0
Major OS version
4
Entry point
300982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\wilsk\source\repos\apps\desktop\bunifu\work\bunifu-framework\__build__\__raw__\Bunifu UI WinForms\1.5.3\net40\Secured\net40\Bunifu.UI.WinForms.1.5.3.pdb
mscoree
_CorDllMain
Name
.text
Size
286KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bunifu.ui.winforms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 578cbcfb7a01234907fb6314918efd23a502882c79d0ee3c2e7d4ae0cf63ebc2
- MD5 686833fccd95b4f5c8d7695a2d45955d
- SHA1 882f60ea47f536c1f01da0f5767dfe5d569fc011
- SHA512 8bb3a8741b73ad7c280de31905dbfc449c2d6f538b8feca232201c7079f917c4291936211632bcdf17c95d6cf5d9b97df2cdd21c57af6cbff486ea7691ff3bc1
- SSDEEP 24576:xyvPvuVgLZSIFzv+qBoZHS5zmq+u2oN2+/:mJLIOJBoY5zmq+u2oQ
- TLSH T109553B4A3FB4976BD2FF0675A026506897F6E412B3F2EB9A2A14E07C1CD37119D02763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1355278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cgeoip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- TLSH T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
guna.ui2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf72939922afa2cd17071f5170b4a82d05bceb1fc33ce29cdfbc68dbb97f0277
- MD5 acec68d05e0b9b6c34a24da530dc07b2
- SHA1 015eb32aad6f5309296c3a88f0c5ab1ba451d41e
- SHA512 d68d3ac62319178d3bc27a0f1e1762fc814a4da65156db90ae17284a99e5d9909e9e6348a4ff9ef0b92a46ba2033b838b75313307b46ab72dc0aab9641e4f700
- SSDEEP 24576:0EYgGsL29WxSrDIFlabtrA8UCf4haho7pcHxvHOVSAF:0dgucgciQj
- TLSH T182655C8433E1DE97C40EA33DE0660668A775D154BB87E793427821BD2DF532B8D06B8B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned binary was signed by an untrusted entity.
PE Signature issue
Digest
a6:b6:6a:35:8d:b6:02:9a:d9:94:90:ab:3a:ff:17:50:0a:a4:8b:2e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Apr 22, 2020
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
1510366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Guna.UI2\Build\Guna.UI2.WinForms\build\.net 4.0\Guna.UI2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
protobuf-net.core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8c80999a13b87b0449ce09ebb7d53344b5771876e5af2e426c8e80258f62dff1
- MD5 7d5a891689dc097d641272a459da8ac8
- SHA1 a5b6efdd77bb8dacafb4b3013ab81919ad0e407e
- SHA512 a618ddfd22fc1ead717c2d0ca98c98d81ac4888f4af0c5952c1404f1c36e8ea4796f57bbd026aef187b9575a8737bf02ec7d5c58079bb89678b09239f4f932a7
- SSDEEP 6144:Y8m4EMIWZbQikB4bhhKKW7on7lrFWp/QiSsKyY:+izkmbhhKKSohF0/QiSGY
- TLSH T111445B1C3FD84A31CDBE5AF47C39C8CA0AB9F606A45BD7C991C091F9648339C6A6076D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
274510
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
260KB
Virtual Size
260KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c814d207eba7589cbb810b1625ac4091a5cb5cdc9be5e6691bddb2c4dde4619d
- MD5 02de5f3f2a4b2e15ab53212bc93dc2db
- SHA1 e71e402ab28cd47d55eb997ad0e55ef1ac29d533
- SHA512 7b1f09cdae30c2f1577a694c6ddbed6446997788f42167b4bb78f59c46154b43405639f0c9de7bc57aac598920fd4767cbfcc5ca01f803599d53820c3da4dcc1
- SSDEEP 6144:jjJ3dANv2SafbrR0h4er6RI50Gqo3DcGDsqm:h3dANv2SaT2h38Ivqo3QGL
- TLSH T16A445C5923EC4A27E2FF6775A87010848AF7F957F562DBCDAC8091FC08627851A207E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
263030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
249KB
Virtual Size
248KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
stub.cs
- SHA256 1ffef5d31a2d6dbc01177fcf7835c9d9eeb4334bd39b20ec76eb2be1ba429f3f
- MD5 255787b7316051d866d8a8a384102c9a
- SHA1 5a9fe0570579b7fe3916ec51abaa6606cf44dd18
- SHA512 3016709d0ca83b58abadf1db647ff313105fa03e738f016cbb6364fa258c1824bfb692117ce325b1189a73242208fbcb58825c0abc022df06b771ed0937594db
- SSDEEP 768:5DyEjJsKMQz84UUQ/0CVnss+Hgr5YDAbZvg6JCPYQdJEFoCG2Q5qT9HGqa7GAgOL:h3jJsKMQz84ELnsAEki3YQdsW3G3y
- TLSH T18F8371192D6395714967E03D8B8BC142F73A901352ADCC65BA5D8320DF2506C8EFCFEA
- MD5 SHA1 SHA512 SSDEEP TLSH