CSDemo.zip
- SHA256 6fe184c59a83ac0f9a9f43508ab2f211aa8ce0fa2dec7ab4ebc2bf9ab3fe0260
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CS Demo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
CS Demo.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
CS Demo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
CS Demo.exe
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
wearedevs_exploit_api.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
wearedevs_exploit_api.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target CSDemo.zip
- Size 2.3MB
- Sample260528-s5txaaex91
- SHA256 6fe184c59a83ac0f9a9f43508ab2f211aa8ce0fa2dec7ab4ebc2bf9ab3fe0260
- MD5 6fa5c20865cc6ce796ce4d9711b6a0eb
- SHA1 aab2f18b641b9e746ba3d4fe70ed74d0ae9a21bc
- SHA512 ab89fcc77f9003e74fdd8eb2af67f778422a95067c06ff3909cdf358d83a2ff5e02465274c54a16adcb71517fa74f96ed6a558c58fc4029ccf8322f9d448bf77
- SSDEEP 49152:3S19wyYYdjDQnCmkZV91Wu1gP7SqH8DvmlS8NzYnJsnC:3S1ytIjDQCmWhWu1gObDvc3C
- TLSH T19BB533A341C2D0D76023D46B7C8F9F29BD08B97046C111F2A36AB74A25673BE794CDD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/CS Demo.dll unpack001/CS Demo.exe unpack001/wearedevs_exploit_api.dll
File Explorer
-
CSDemo.zip.zip 2.3MB
-
CS Demo.deps.json413B
-
CS Demo.dll.exe 7KB
-
CS Demo.exe.exe 136KB
-
CS Demo.pdb13KB
-
CS Demo.runtimeconfig.json515B
-
wearedevs_exploit_api.dll.dll 6.5MB
CS Demo.deps.json
- SHA256 3e69892657a424a6cb68d1fbf59b782f6b045f8801ff8e1e4cc56a55640f5501
- MD5 307ae72785d416b052df5e86ce5bc8a0
- SHA1 87b74ea2c2b0f166377870c3d90fbb780e037221
- SHA512 4092979d1e24d7cb7eeb1e8b80354031af71b7ab63655044f14de2ae8c8446ff779e4814f3a4b95ecb6f78ef849d6514558a227a636caed4adf7765a4541dec9
- TLSH T1B1E0DF09D1C40E9700F62BB294369782F5325B33042A180A7AFFD81C0F7291B6411FB9
- MD5 SHA1 SHA512 TLSH
CS Demo.dll
- SHA256 d3258cd1c0caa3500d173b00778cb2b5c5fed295b31e464ddfe9f6914f0965aa
- MD5 f52a124f2b1b05a7bc501c472bb82d0e
- SHA1 2ac83e6604825bcdbdf8a2248015cb7c44a3cc27
- SHA512 3d52c56a5af69f2e5e28bab3dfe7b4bbedd2f593abe010081a4e77529c8e3e34d9c2465b77d4afbaebae754ac1251561e2bdf5ece806566020050e3aa69bcd8d
- SSDEEP 96:L418BUSfBka0807VmNv4t3VIa9wcC1EdOZ9zOQfhnUFwDtkx6c9GSxRH6vnx8kzj:LUivqVIa9wcqSS5OsnUWDt8hHor
- TLSH T173E1D924FFE84133C57A07B299B355500B73B7166866CFAF689A208F5D63B014A53BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Bernie\Documents\GitHub\WRD Exploit API\WRD-Exploit-API\cs-ui\obj\Release\net8.0-windows\CS Demo.pdb
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CS Demo.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 4dd69d0e77c00a8897f2e9c65f2be43fe761ef928a9047281fbd32dde91b22ee
- MD5 76c59031677474c10fefb5abe881dc1b
- SHA1 b99a7096222e9966f9f52b0cb6d0b6280f99352b
- SHA512 283f202e9404a0ba32b2336afe8f4adc3756f0d42135670a8167669972d2e675de44255362078f0b9e91218c72eb691c5920905a39b081c7da5415a9ecf2a680
- SSDEEP 3072:b454jE83DwHBoi2r7Z9V58lmpCnclxuZmPYBZV:b454jECi2rd9V58Mp/xuZmwB
- TLSH T1D1D32947B2A800FDD1BBA37889A21A05F777B819477297CF0390857A1F67BD09E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70752
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=34438,
count=1, id=258, version=34438,
CS Demo.pdb
- SHA256 322f97a78fbe7ccff7715d59c9a629d251600cd1ba959edda7c5e93ca70dfc32
- MD5 72ca00fb4a9994c72a35e913c5718cd3
- SHA1 c67152cecdc3cc1d745e2399e85254ae2e94743d
- SHA512 3d0595728ab469c812e6f0303a52afbfa903b06c5eae20aa978387fca74fc9d9f23ea3bd734b6b58495b8bf6416fc777c090ef5743004a2681e98ecca26d1deb
- SSDEEP 384:UQ09Bhc9K7HN6uaJKxKH+KSB8skxWwLN7AnIPJwyY338xr/5/HpfDBBjEY2dzNh4:Un97cltxWM9xjUcidg
- TLSH T15652C377839DE571C84629725936C0CC3B3883246789EC78F1D86A08EDBFB9943B6176
- MD5 SHA1 SHA512 SSDEEP TLSH
CS Demo.runtimeconfig.json
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
wearedevs_exploit_api.dll
- IMPHASH ffdc802f2129bba4ff3c5a288fcee893
- SHA256 8395222042500439f699fe10368ac6149e6e455134ea7a855a6dca249a725a13
- MD5 394a86e73331ff6b5f9151229a55bdc6
- SHA1 4b21d89f178f25b69e5d552eccf39bef6fc97689
- SHA512 cd609e798edd8df98a93dc78595fa13bb81c266c65b52656e26062607a5584eebf6f65414123cee7f89aa4b29f494d32d5cf7c198f652809c58cbbddd237910f
- SSDEEP 49152:KK2ylR0GZTx1mrKqf06jEN7TO/9F3iDe4mEhl5hXmAygTf8l23HLAA2SE0YS11JH:4zvFd9JxE5VNKlOSoD97
- TLSH T14F66D716A77960DAC17FC07892839B22BD21749D07393BF74991866A2F20FF8AD3D354
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4663952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
wearedevs_exploit_api.pdb
user32
FindWindowA
MessageBoxW
IsWindowVisible
kernel32
GetProcAddress
InitializeSListHead
IsDebuggerPresent
GetProcessHeap
GetSystemTimeAsFileTime
LoadLibraryExA
HeapAlloc
LoadLibraryExW
FindNextFileW
RtlVirtualUnwind
HeapFree
RtlCaptureContext
SetFileCompletionNotificationModes
QueryPerformanceCounter
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
SetThreadErrorMode
GetModuleFileNameW
CreateThread
GetConsoleOutputCP
GetStdHandle
UnhandledExceptionFilter
FreeLibrary
SetUnhandledExceptionFilter
CloseHandle
SetHandleInformation
WriteConsoleW
MultiByteToWideChar
K32GetPerformanceInfo
CreateFileW
QueryPerformanceFrequency
GetSystemInfo
GlobalMemoryStatusEx
LocalFree
SetCurrentDirectoryW
GetModuleHandleA
GetCurrentThreadId
GetFullPathNameW
GetModuleHandleW
FormatMessageW
RtlLookupFunctionEntry
ReadProcessMemory
GetConsoleMode
FindClose
VirtualQueryEx
IsProcessorFeaturePresent
GetSystemTimes
GetProcessTimes
GetLastError
GetCurrentProcessId
GetProcessIoCounters
FindFirstFileExW
GetSystemTimePreciseAsFileTime
WaitForSingleObject
GetFinalPathNameByHandleW
DeleteFileW
GetFileInformationByHandle
SwitchToThread
GetFileInformationByHandleEx
CreateDirectoryW
MoveFileExW
GetEnvironmentVariableW
GetCurrentDirectoryW
SetLastError
GetCurrentThread
SetThreadStackGuarantee
OpenProcess
SetFileInformationByHandle
lstrlenW
HeapReAlloc
GetCurrentProcess
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
ntdll
RtlGetVersion
NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateFile
NtWriteFile
NtReadFile
NtQueryInformationProcess
NtQuerySystemInformation
RtlNtStatusToDosError
ole32
CoTaskMemFree
oleaut32
GetErrorInfo
SysStringLen
SysFreeString
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
WakeByAddressAll
bcryptprimitives
ProcessPrng
advapi32
IsValidSid
GetLengthSid
GetTokenInformation
CopySid
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
secur32
InitializeSecurityContextW
AcceptSecurityContext
FreeContextBuffer
DeleteSecurityContext
DecryptMessage
FreeCredentialsHandle
QueryContextAttributesW
ApplyControlToken
AcquireCredentialsHandleA
EncryptMessage
crypt32
CertEnumCertificatesInStore
CertGetCertificateChain
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertFreeCertificateContext
CertFreeCertificateChain
CertOpenStore
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
ws2_32
ioctlsocket
getsockname
getpeername
setsockopt
getsockopt
closesocket
WSAIoctl
bind
recv
getaddrinfo
WSASocketW
connect
shutdown
WSAGetLastError
WSACleanup
WSAStartup
send
freeaddrinfo
WSASend
pdh
PdhOpenQueryA
PdhCloseQuery
PdhGetFormattedCounterValue
PdhEnumObjectsA
PdhAddEnglishCounterW
PdhCollectQueryData
PdhRemoveCounter
psapi
GetModuleFileNameExW
shell32
CommandLineToArgvW
SHGetKnownFolderPath
powrprof
CallNtPowerInformation
vcruntime140
__CxxFrameHandler3
__std_type_info_destroy_list
__C_specific_handler
_CxxThrowException
memcmp
memmove
memset
memcpy
api-ms-win-crt-string-l1-1-0
wcslen
strlen
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_cexit
_initterm
_initterm_e
DllMain
add
execute
initialize
isAttached
Name
.text
Size
4.5MB
Virtual Size
4.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
337KB
Virtual Size
337KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34321,
count=3, id=259, version=34321,
count=7, id=260, version=34321,
count=15, id=261, version=34321,
count=349, id=1, productName=Unmarked objects,
count=471, productName=Unmarked objects (old),
count=1, id=256, version=34810,
count=1, id=258, version=34810,