Velocity (1).zip
- SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
Overview
overview
8Static
static
3Velocity/B...64.dll
windows10-2004-x64
1Velocity/B...64.dll
windows11-ltsc_2024-x64
1Velocity/S...lua.js
windows10-2004-x64
3Velocity/S...lua.js
windows11-ltsc_2024-x64
3Velocity/S...FE.bat
windows10-2004-x64
1Velocity/S...FE.bat
windows11-ltsc_2024-x64
1Velocity/S...ius.js
windows10-2004-x64
3Velocity/S...ius.js
windows11-ltsc_2024-x64
8Velocity/Velocity.exe
windows10-2004-x64
4Velocity/Velocity.exe
windows11-ltsc_2024-x64
4Velocity/V...PI.dll
windows10-2004-x64
1Velocity/V...PI.dll
windows11-ltsc_2024-x64
1Velocity/W...er.dll
windows10-2004-x64
3Velocity/r...er.dll
windows10-2004-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Velocity/Bin/VMProtectSDK64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Velocity/Bin/VMProtectSDK64.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Velocity/Scripts/Favourites/Dark Dex,lua.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Velocity/Scripts/Favourites/Dark Dex,lua.js
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Velocity/Scripts/Fun Scripts/Infinite Yield FE.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Velocity/Scripts/Fun Scripts/Infinite Yield FE.bat
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Velocity/Scripts/Fun Scripts/Sirius.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Velocity/Scripts/Fun Scripts/Sirius.js
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral9
Sample
Velocity/Velocity.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral10
Sample
Velocity/Velocity.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
Velocity/VelocityAPI.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Velocity/VelocityAPI.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Velocity/WebView2Loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
Velocity/runtimes/win-x86/native/WebView2Loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Velocity (1).zip
- Size 12.5MB
- Sample260619-v9cvnsbs8t
- SHA256 4ba3a8a29a4adaf21f304239e3c769d4f8da809106e01caef80945fd604b0076
- MD5 69c1ec1744daf4c5dea14f428621dbce
- SHA1 a01c9792d87a5ee761f1953794e5f08cfa3f600d
- SHA512 743cd36db333c7412c9581245c7c570313791ac9c2c3311bd5d5cf425a7a0b47751b469b88e7c5216acb6afca8b1385c9ab0d32f7d49985195de3e748df1120b
- SSDEEP 196608:VsI43uQZN/rzCs2jNH1CKuXYAISerbwoCFWOB3sMXcz0hNRcY8m/gSTu/gjwGN:VztWN/rzCVNE1YbjC8jMXc4Vv5Y4V7N
- TLSH T155D633DD9EA26F6DD17F3873501859CC4FAD296AE5ED012630A8E0C96AC35FC7C80C66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Velocity/Velocity.exe unpack001/Velocity/VelocityAPI.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Velocity/Bin/VMProtectSDK64.dll
File Explorer
-
Velocity (1).zip.zip 12.5MB
-
Velocity/Bin/VMProtectSDK64.dll.dll 124KB
-
Velocity/Scripts/Favourites/Dark Dex,lua.js 769KB
-
Velocity/Scripts/Favourites/Hydroxide.lua273B
-
Velocity/Scripts/Fun Scripts/Infinite Yield FE.lua.bat 472KB
-
Velocity/Scripts/Fun Scripts/Sirius.lua.js 182KB
-
Velocity/Velocity.exe.exe 32.9MB
-
Velocity/VelocityAPI.dll.dll 17KB
-
Velocity/WebView2Loader.dll.dll 118KB
-
Velocity/runtimes/win-x86/native/WebView2Loader.dll.dll 118KB
Velocity/Bin/VMProtectSDK64.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 d43329ee5af52665bc4afc3f7dcbe1d8aa13528f49d7580df15a9c9ced50c0ca
- MD5 3339229041a6aaedfc037afefe58813f
- SHA1 1121e690c877b23a623f57b8d339b494c20b209f
- SHA512 bff891e88d6b956bd75fee560fb6c38577322c4a61a288f6ab7baa8e0906d2fdc5b00a936359fc98f0b060940c3418d74412d97d7ab8abdd11603b6328051821
- SSDEEP 3072:1mcqYHq7Aiytzg2ScpvgJcG5sqYX6UOHNlBS:g0Hq7AiyegZgJZSXmtH
- TLSH T1A1C37C5773E540BBD1B6CA79C8638A56D7B178110B24DBAF03A402162F233D18F3AF62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
67:8d:6b:08:81:64:17:75:82:4d:d1:46:4b:ac:b6:ed:f6:b6:db:77
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Chains
Jun 6, 2012
CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Subject
CN=NVIDIA Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Serial Number
43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 2, 2011 - Sep 1, 2014
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
61:19:93:e4:00:00:00:00:00:1c
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Feb 22, 2011 - Feb 22, 2021
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Pikachu Time Sub CA,OU=Pikachu Certification Authority,O=Pikachu Trust Network CA,C=CN,2.5.4.13=#0c29e79aaee58da1e4b898e697b6e997b4e688b3e7adbee7bdb2e4b8ade997b44341e5ad90e8af81e4b9a6,2.5.4.13=#131c50696b616368752054696d65205369676e6e696e6720537562204341,1.2.840.113549.1.9.1=#0c1274696d6563614063657274732e75732e6b67
Serial Number
13:eb:7d:76:5d:e6:a4:d2
Issuer
CN=Pikachu Test CA RSA,OU=Pikachu Certification Authority,O=Pikachu Trust Network CA,C=CN,2.5.4.13=#0c28e79aaee58da1e4b898e585ace585b1e69c8de58aa1e6b58be8af95e6a0b9e8af81e4b9a620525341,2.5.4.13=#131c50696b61636875205075626c6963205465737420526f6f7420525341,1.2.840.113549.1.9.1=#0c127465737463614063657274732e75732e6b67
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2000 - Dec 31, 2099
Minor OS version
2
Major OS version
5
Entry point
8864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Velocity/Scripts/Favourites/Dark Dex,lua
- SHA256 514dfbb86b40ede6f3d0abd70b5d2935c807161d815138f23ecb0ffffe1eace1
- MD5 fd55d68a2c6b02eca802fd365359c1fc
- SHA1 6cfc853cecb82cc6458e7d9bf1e87336fdd637d6
- SHA512 41feb566b622b8eab94fa8ea53124359a12904f17cf70e240fd8f2dbca22ee9c3f219de22af573c36f1ca7962626819abbaacbb5a484c90ad50bc6d5ea744ee3
- SSDEEP 6144:8DS0p3l3XgRGS+J5sme4dGuRXPnJZXBoiZ0DbQwZNXsDSyGQE4SRJ48RgQxAaNS6:5VYTeCO
- TLSH T119F4830C22898EFE97636D64B0E3158DB2E86263D3D91540E1BD4E1CF24DE5B05B7A8F
- MD5 SHA1 SHA512 SSDEEP TLSH
Velocity/Scripts/Favourites/Hydroxide.lua
- SHA256 e9a0001ea23ed9f391c327a94d65709e0e13662d540686335d5576f172100f3f
- MD5 58379cbb55d775f89a08852a087d4fc9
- SHA1 feab23989e2296d8f732bebe8431541ffa7f30fa
- SHA512 a4beb0caed2a1c7a22df779700f352b751df3b504f639a2412bed96eafb6f5e0a84c71ad447f34ae0042ab28738011b59576e872aa1e15650a16d099b9ec8f9b
- TLSH T14CD02B7FB8A7A1180337CCC9849162A5AE103209778891F3A84921B09A311DD00F0399
- MD5 SHA1 SHA512 TLSH
Velocity/Scripts/Fun Scripts/Infinite Yield FE.lua
- SHA256 1c071c31271791272a4d21bc2ca6b571b20020444a33883611c2b315247f8cb5
- MD5 aa40a2d10223dcc7eea00701a53cfae9
- SHA1 a5772eda1152fd8917c4de08814b7ac69b650c63
- SHA512 65f11aff17166f846ae0ec6e451cf4df0dbc3dbeb4da4a90e472e86db5c0769b0db9b05e1c75eb095c88201811a12e115b7ea5cae86187b69e3ce123c8435b72
- SSDEEP 6144:FGfBMi+jpIPxvuv6oZf8D3xzLdzFI8gOyT8NPle+niXX6rWagl8Wi7ZSnjPuO5HD:AojpIPxvqfyh1F9NniXDX+O
- TLSH T17CA4F79E319E16AD1A17A26DB46308463EBFE03510091A5DF8FC513C6BCD60F81F7AB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Velocity/Scripts/Fun Scripts/Sirius.lua
- SHA256 52a0ca20e499400cd766bc9676ded35d0eb0a9bed6bb20bea5488f3054575fed
- MD5 b5704851fc56ef02c7450068c1c9bbc9
- SHA1 ba88206f41d9607057ef9bd3120e29972b5975bb
- SHA512 d3bc75dace3e36d61d1bd78a92bb31a6028e509326ca0c6d09dd0e1e2749e3cd5bf9e37e7cb49d68a21fa22200b3bb3d20f70c7cb57fd1e2015fc1ce5d948b4e
- SSDEEP 1536:SKsQCXCWXIaIi/f9YeUAaFEuDQTvbRVinAx+j:X9CXCwId7eUAaFEuDQTTKj
- TLSH T1A804C58C316E62FC44A3418EE56B0415BEACB220626D5045F9AFB4BDC8CCB4EC5D67F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Velocity/Velocity.exe
- IMPHASH 606666d1fa3a53647d0747ec602cb219
- SHA256 873fd333cd8e687b874af8dca2f043c50ea1f4bc64d496015ca038da383b91f0
- MD5 83da367e14fe39262fcf57c39dc3180b
- SHA1 a0d2655ceff2d35b7eceb55e2be1058b966970e2
- SHA512 8ce8b77b95640a111d43b75ff76bdfdacfd8680a39c5d5c6a97fdef7aef18bd7470a4df4716fd3c67a51cfed69a710d6c33086c864a0b91ea0c03966b8a97df5
- SSDEEP 196608:ktQ56WdpH6emXAro0JTToUgmwh8qZYOCu51ZTAFLzbjblIjvT7CThIPPBrYjPWDx:kt6pHxmXf0J9A8qCFqAFLKnCTMGPWl
- TLSH T1A9779E22A3A44E3DC99F5773E4B603254335CA06AF43939E581CA69C1F933860B59BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
69184
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
GetFileAttributesW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetCurrentProcessId
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlUnwind
InitializeSListHead
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
_initterm
_get_initial_wide_environment
_errno
_initialize_wide_environment
_configure_wide_argv
_initterm_e
_set_app_type
_seh_filter_exe
_cexit
exit
_exit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invoke_watson
__p___argc
abort
_c_exit
_register_thread_local_exe_atexit_callback
__p___wargv
_controlfp_s
terminate
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
calloc
free
api-ms-win-crt-time-l1-1-0
_time64
wcsftime
_gmtime64_s
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__p__commode
__stdio_common_vswprintf
setvbuf
_wfsopen
fflush
_set_fmode
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
__pctype_func
setlocale
___mb_cur_max_func
_unlock_locales
_lock_locales
_create_locale
_configthreadlocale
_free_locale
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
_wcsdup
toupper
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=15, id=259, version=35207,
count=18, id=260, version=35207,
count=84, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=206, id=1, productName=Unmarked objects,
count=10, id=265, version=35215,
count=1, id=258, version=35215,
Velocity/VelocityAPI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f8b8d05d22c24e9444e8c5da63e5631c762971f4ba6e79ba823fe3880fa95df
- MD5 229bdd461d751c7b63e61c926f5ed6b7
- SHA1 d2569c72e9408de66c36780e5c48074dd605db3a
- SHA512 c416b319574fedc597bb34710b22348751c976606602453890718eef9effa99c8bfd845392c8ffa9dd6c954e778e5e6d5fb57752cf4dbd40821eec9dc49b015a
- SSDEEP 384:BVrr3r+K+ftBdZ0rCbv/YOJaPhLuo2O6xNEQEQrzdaRS:BVrr3r+K+fPh/Y2UyDVl
- TLSH T193721A0A7FE8C677E6EE0AB85871021043F3D7157823FF5D68C7A4992D63B4A4614B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23050
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\yousm\Desktop\VelocityAPI\obj\Release\net8.0\VelocityAPI.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Velocity/WebView2Loader.dll
- IMPHASH c1214c3b09798333b3bc44c19d95ec00
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bc:8e:ea:69:48:7f:f9:0d:25:00:3d:3c:c6:08:63:67:e3:d9:ca:71:71:67:83:cc:e7:c2:6d:32:f0:90:af:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 1, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0a:47:b2:14:d9:ee:b2:b3:0f:00:01:00:00:02:0a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
16528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Velocity/runtimes/win-x86/native/WebView2Loader.dll
- IMPHASH c1214c3b09798333b3bc44c19d95ec00
- SHA256 44ab92c2246ebfb5f98aa5726626fb44beb61543f2ef1803338af9fd295e63f0
- MD5 7b0eeac10cafb4acda98ccaf2f4b8eb1
- SHA1 9af3bdf0f62f6e4b3a936afc9b77fa9ac5a088d9
- SHA512 466b751a90d3b63e6394b47d459da70ee20eb7d6d40c48153996297e460fbaa02f32cab10b737fefd03a2ea62bd273025fc2ccde850faf42c904044c7ea8dab7
- SSDEEP 3072:F6JOAfv0Zj/zjziMy/4rnF4+jqb22EA2TNTEtJAfiPjezIgUW1:F6JNf89Q/In+qPEtJ/QNh
- TLSH T1FAC37B5075D080B1E5BE18390878EAB69B7F7990DF609DDB27841AA94F343D09F31B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bc:8e:ea:69:48:7f:f9:0d:25:00:3d:3c:c6:08:63:67:e3:d9:ca:71:71:67:83:cc:e7:c2:6d:32:f0:90:af:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 1, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 15, 2025 - May 15, 2026
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0a:47:b2:14:d9:ee:b2:b3:0f:00:01:00:00:02:0a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
16528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ