Jason-Unpack.rar
- SHA256 250e27ff9985f61aef439203d761a3a4826b65129cdebde61722494bedec69c6
Behavioral task
behavioral1
Sample
Jason-Unpack.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
Jason-Unpack.rar
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
900 seconds
Behavioral task
behavioral3
Sample
Jason-Unpack.rar
Resource
win11-20260513-en
windows11-21h2-x64
5 signatures
900 seconds
Behavioral task
behavioral4
Sample
Jason-Unpack.rar
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
General
- Target Jason-Unpack.rar
- Size 217.8MB
- Sample260703-d8a61sa15y
- SHA256 250e27ff9985f61aef439203d761a3a4826b65129cdebde61722494bedec69c6
- MD5 babc0ffb410bb6e4c7aa6c104d1d820f
- SHA1 084d63fd3046e8c131c97f99646022c6e712f01b
- SHA512 4ef6d714767a59db05415dc310151f0a3f1c3f313c32b4e754ee16d93bb455dfc9eafb63bbf724f2c5907d34850957f95f99d95f827b81d5ce313ebb69e4b04f
- SSDEEP 6291456:8m/7JZ/IePRlt5UcubxVNslwDBJsmNZ6GS/53Flqe:8mVZAE5ToVCWfsmNZ6G853v
- TLSH T151B833F9F15B2E212EE6A700B18E8B6379AB2367B4147C682645F0771B3722F1C71176
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Jason-Cain/Cain/Bunifu.UI.WinForms.BunifuDropdown (2).dll agile_net static1/unpack001/Jason-Cain/Cain/Bunifu.UI.WinForms.BunifuDropdown.dll agile_net - Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack001/Jason-Cain/Cain/Bunifu.Licensing (2).dll unpack001/Jason-Cain/Cain/Bunifu.Licensing.dll unpack001/Jason-Cain/Cain/Bunifu.UI.WinForms.BunifuDropdown (2).dll unpack001/Jason-Cain/Cain/Bunifu.UI.WinForms.BunifuDropdown.dll unpack001/Jason-Cain/Cain/Crypter/sgn32/keystone.dll unpack001/Jason-Cain/Cain/Crypter/sgn32/sgn32.exe unpack001/Jason-Cain/Cain/Crypter/sgn64/keystone.dll unpack001/Jason-Cain/Cain/Crypter/sgn64/sgn.exe unpack001/Jason-Cain/Cain/Guna.UI2 (2).dll unpack001/Jason-Cain/Cain/Guna.UI2.dll unpack001/Jason-Cain/Cain/JASON Unpack.exe unpack001/Jason-Cain/Cain/Miscellaneous.dll unpack001/Jason-Cain/Cain/ru/JASON.resources.dll unpack001/Jason-Cain/Cain/zh-Hans/JASON.resources.dll unpack001/Jason-Cain/Cain/zh-Hant/JASON.resources.dll
File Explorer
-
Jason-Unpack.rar.rar 217.8MB
-
Jason-Cain/Cain/BackupCertificate.zip.zip 2KB
-
ServerCertificate.p122KB
-
Jason-Cain/Cain/Bunifu.Licensing (2).dll.dll 989KB
-
Jason-Cain/Cain/Bunifu.Licensing.dll.dll 989KB
-
Jason-Cain/Cain/Bunifu.UI.WinForms.BunifuDropdown (2).dll.dll 42KB
-
Jason-Cain/Cain/Bunifu.UI.WinForms.BunifuDropdown.dll.dll 42KB
-
Jason-Cain/Cain/Cain.pfx2KB
-
Jason-Cain/Cain/Crypter/Icons/AnyDesk.ico1KB
-
Jason-Cain/Cain/Crypter/Icons/Python_icon-icons.com_68975.ico21KB
-
Jason-Cain/Cain/Crypter/Icons/Thumbs.db6KB
-
Jason-Cain/Cain/Crypter/Icons/Windows_Phone_icon-icons.com_66782.ico66KB
-
Jason-Cain/Cain/Crypter/Icons/file_type_pdf_icon_130274.ico9KB
-
Jason-Cain/Cain/Crypter/Icons/kaspersky_14598.ico21KB
-
Jason-Cain/Cain/Crypter/Icons/windowsmedia.ico5KB
-
Jason-Cain/Cain/Crypter/sgn32/keystone.dll.dll 4.8MB
-
Jason-Cain/Cain/Crypter/sgn32/sgn32.exe.exe 3.2MB
-
Jason-Cain/Cain/Crypter/sgn64/keystone.dll.dll 5.3MB
-
Jason-Cain/Cain/Crypter/sgn64/sgn.exe.exe 3.3MB
-
Jason-Cain/Cain/Guna.UI2 (2).dll.dll 2.0MB
-
Jason-Cain/Cain/Guna.UI2.dll.dll 2.0MB
-
Jason-Cain/Cain/JASON Unpack.exe.exe 284.5MB
-
Jason-Cain/Cain/Miscellaneous.dll.dll 86KB
-
Jason-Cain/Cain/Profiles/Keywords.txt3KB
-
Jason-Cain/Cain/ServerCertificate.p122KB
-
Jason-Cain/Cain/Telegram.txt293B
-
Jason-Cain/Cain/micross.ttf855KB
-
Jason-Cain/Cain/ru/JASON.resources.dll.dll 1.6MB
-
Jason-Cain/Cain/zh-Hans/JASON.resources.dll.dll 1.5MB
-
Jason-Cain/Cain/zh-Hant/JASON.resources.dll.dll 13KB
-
Jason-Cain/Telegram.txt293B
Jason-Cain/Cain/BackupCertificate.zip
- SHA256 19e70e2932586d03a655ce4f87992dd565a3b8bfd5145df7af77ada40d8ec34e
- MD5 cf95b4d8ec672a62f34e13733b1bc1c8
- SHA1 daa380e41bd1c5605233343a9aa9dd5677d7e7a3
- SHA512 ff0a59f5d9e2a488958648612420482075e4fd456d521703449a2f092c7c40db8f675b8d629dfc1aaf3824f9abaee2456510651330a883917bcc5b4fc6a8846f
- TLSH T1BE5118355B00CE33D8818EB1992B261C9857C25BAE136D0DA37BA6169ACB07FE8280C0
- MD5 SHA1 SHA512 TLSH
ServerCertificate.p12
- SHA256 f791b41e3351b13f59264ba2a1d5e57bec10185add62dfc8d277da04eb4ffc4f
- MD5 91fe38147599ae34a88f56fc21b70bc3
- SHA1 353bfee246e284aba8c8d8c6f6c755c020c437f3
- SHA512 327b6d2a5874ad3e58b3abf9c9481927a719c91dd7115aecf92ee7fadfc74375eb1b757a0b66545cd0a5d8ba0bbf8b3f3dddc354f07334eaea17187c9e387607
- TLSH T1D5512B43277EC1343DE858B5D4F899614CA3EAA10EB0F50F6436430E3A30F647274202
- MD5 SHA1 SHA512 TLSH
Jason-Cain/Cain/Bunifu.Licensing (2).dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 634b38d08d2f1e4c4c9f11867886487faedcda360523feea1a128c2700600b85
- MD5 438139ab95fed82dddb339078f5fb3c4
- SHA1 bc7570a67d1ad0f94fcff6d967a88b0f95f08b63
- SHA512 be0e7d71455112259eac8e920c8d25e54ffcda150a0a62546e11bfcef475c4f1db77a710d20bdcf088d80da59623a9aa66641d4b86b024f1a33d9ed4c06d1da8
- SSDEEP 6144:ecm/0tUY5CAfjMeks3NTMwp5wp/hNrAfjMeks3SBegbEpJaCgmIve9:qR0bXNTMwLwp/D8bXSIgbEpzreO
- TLSH T1E125281477A4DA06D07903F29B26CA7C0BA0BC061A1EE66A5EC17FDF3EF1B655908743
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1017906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\wilsk\source\repos\apps\desktop\bunifu\work\bunifu-framework\Licensing\Bunifu.Licensing.Redistributable.v7\obj\Debug\net462\Bunifu.Licensing.pdb
mscoree
_CorDllMain
Name
.text
Size
986KB
Virtual Size
986KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/Bunifu.Licensing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 341c2068ba13967aa5eb56a6bb5f276bb2c1eb42ae190ff48d351a3f55fa9653
- MD5 48e81ee0d1fcafd4326652cc351aa890
- SHA1 91162a08eaf78258109d0b6bdee2a5aa2567f811
- SHA512 63d3c7bc6fb70b523e231bd32a738d96e03b4a9b65b467d818f52f5173ea5e379473e1d193a92427c887061367f872d852ab1e4990880f46884ecc7dd9c862ff
- SSDEEP 6144:ecm/0tUY5CAfjMeks3NTMwp5wp/hNrAfjMeks3SBegbEpJaCgmIve9:qR0bXNTMwLwp/D8bXSIgbEpzreO
- TLSH T13625281477A4DA06D07903F29B26CA7C0BA0BC061A1EE66A5EC17FDF3EF1B655908743
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1017906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\wilsk\source\repos\apps\desktop\bunifu\work\bunifu-framework\Licensing\Bunifu.Licensing.Redistributable.v7\obj\Debug\net462\Bunifu.Licensing.pdb
mscoree
_CorDllMain
Name
.text
Size
986KB
Virtual Size
986KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/Bunifu.UI.WinForms.BunifuDropdown (2).dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd2520db073ed2501dfd268b6e71d44c3de52e43a064d19ce98c2d0fe07d6b01
- MD5 b4bca22e272448f56ee629418168568f
- SHA1 e4f03099d03351c16eebb18d5116f2bcec30b538
- SHA512 cddc7c876a43213bc96fbd580f37aaad835852cd9d29509808a335e406a0c593f21ae3adf69f66e3acf82eed760e34f7495dd197e98e3017003b528569d64eb5
- SSDEEP 768:YyuiR8j8e5ToRtNjCLVzv/8miWvkMFhJud:eroehoR/jcHYWvh4
- TLSH T1E213FA72B3E11BB7C75BCF3E28404046A638AB62653FD3197D9C126CD6B3BDD0690692
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Willy\source\repos\bunifu\bunifu_framework\willy_kimura\__build__\__secured__\Bunifu UI WinForms\Bunifu.UI.WinForms.BunifuDropdown.pdb
mscoree
_CorDllMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/Bunifu.UI.WinForms.BunifuDropdown.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3aed7791e8fa063afb847292fc642ad649ee07ae542b49e7039da3adcf7e945a
- MD5 ac338dc6504178c6cabf32753c2c9403
- SHA1 017ffc5cfe250f120b82224ccbb9077c582bdf4a
- SHA512 6b4406bc877a41e6ae69cc9d5e964e75848b88178fab5db8b887c8faca10e1aa240913a43c843616ada34866507b8a50bd94f0b777dfa6a237b22068f2693918
- SSDEEP 768:YyuiR8j8e5ToRtNjCLVzv/8miWvkMFhJLd:eroehoR/jcHYWvhj
- TLSH T14013FA72B3E11BB7C75BCF3E28404046A638AB62653FD3197D9C126CD6B3BDD0690692
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48190
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Willy\source\repos\bunifu\bunifu_framework\willy_kimura\__build__\__secured__\Bunifu UI WinForms\Bunifu.UI.WinForms.BunifuDropdown.pdb
mscoree
_CorDllMain
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/Cain.pfx
- SHA256 ec0666a766760c05f5e15c61f6860b03ebe87eead43fb77bb17e991d82423980
- MD5 e08e107add006871856a67e0250c74a3
- SHA1 f98d33cc848984419e73ce46b3c6ae5117eb944e
- SHA512 97cb55e0b2420f73309e8ad3f4d08f98784f74fc424255d59722b7fd3cf8f691207271d1ec4d3008f97d0c4072be04b1df95d237ebd76bfee3ea9aaa3d9967d2
- TLSH T1E1412AC919FA507538E7DE9A60ECAD2B49C06B4729083B4FF5397CCD0D91B109889702
- MD5 SHA1 SHA512 TLSH
Jason-Cain/Cain/Crypter/Icons/AnyDesk.ico
- SHA256 ba9cd0db2d731b1a1d57f424dd8f3c1ea2ae79c3ebca8f6a5e6038f59badfad8
- MD5 ec32f19a7209c31bf7d1e60b0b1a7473
- SHA1 02ea8bc2597105c0b7de943a3cb57aa3fcbc4394
- SHA512 697a3124c7822028a90a8489ac9e8de3582ccfebe49f81720baa74ab2f7de31d7f931b371f4f64d57c90114407fb860f0955de5d34f4715123f6944fc0c33975
- TLSH T11231464A60458387C03E0F3099C72699FAF910D67BB31769A6A335B517C3B9F26393C2
- MD5 SHA1 SHA512 TLSH
Jason-Cain/Cain/Crypter/Icons/Python_icon-icons.com_68975.ico
- SHA256 2fc57d79202f05cb997a134cf49c3575bb6e138705ea18da9158270cbfcaee89
- MD5 b10d4eb4a3eb9bfcf7cb73a06bbdf091
- SHA1 f1e2e19b753663a1f72011289ac74fcdd6cbaf4a
- SHA512 92e81ee9772a6ccf9c24b59e4eb822613ce2143c1bdc9194ed0c0833cdf94fff0f240a90f93fde6f2c41ff0afd425e95ece69ee06ff813b1df8d13b06a992f88
- SSDEEP 48:ZGXHD4EAG2EBbhoJTwt4EUQKMUx8H+5sVy8hA30Neq7XU/9tkwYUUyU:4XMEHl4nxO+5se3lqATkwYUUh
- TLSH T1F9A29A257182E59ACA1453744AC2EEF007357E6099504F3BB6F44FAF3DDA3F2A825391
- MD5 SHA1 SHA512 SSDEEP TLSH
Jason-Cain/Cain/Crypter/Icons/Thumbs.db
- SHA256 bc7b160e781a28787e65945b5e103a555b2ec212c16f0d4b7f42aaae4779a756
- MD5 a102cd9afea9ca343ea6e7cf9990e208
- SHA1 7f7827b0bc1bb6ed9608f4be81fdad1dedd5d653
- SHA512 a149aaa8a51caca20f32f123c3b71a98a3221e0969a9682275030d450af667460ca71a684ae9fa46374fdde4264140be0eee824d7a409684e842f72a888d0efc
- SSDEEP 96:VQ89owEZ9CqsH9RvNloCNZWDpt+3F4nHAMtZQYjF72Ky1KEoCgi:VQaowLRFloCN8TUFOgo6Z1m
- TLSH T15FC12A176F80CE64C4DCA2B6EA46CAC553281D00BE37AB053570FF6F767079825096CC
- MD5 SHA1 SHA512 SSDEEP TLSH
Jason-Cain/Cain/Crypter/Icons/Windows_Phone_icon-icons.com_66782.ico
- SHA256 7377488c66a9b2892f5a36e6148934f7471464207ad2e5be4cfdabae771d1539
- MD5 05f9ac039972cdfd99a066eee4346c75
- SHA1 73d68cb97f1c022d7594dce644934fb65a95b96b
- SHA512 e12aa665e21773898b5872587acfabd4dd5568e6635502f3264f1558d375d4f27c76ba3b23774ecbdc7bf5e3f4511c759066ffda7d7a4ce9ae084419d60b335b
- SSDEEP 384:zJlCqe5OThQYuMnJA700eTxzxkx+xMx4ZxDvpVIecOzZuOL:6qnJA700yR
- TLSH T19263F87D718E469BD12480394532A67E3E2B7DCFED051139E305B28A5CB93DCAB3C229
- MD5 SHA1 SHA512 SSDEEP TLSH
Jason-Cain/Cain/Crypter/Icons/file_type_pdf_icon_130274.ico
- SHA256 ef9b4f1343b998dcdb3ba4bc91661973339e0c1a1adcb44ecf752cc5646c84ee
- MD5 116141e2a609c78a5359441accd1ff9f
- SHA1 3671c3412be4b7480c41c0cc5e36016ed0d68943
- SHA512 0c52a293f1333f8911405745bd9dc952a1342c30bc6972bc6b48a5bfdef4ab4a095c878ab696caaa9614f807536d57b63cf85e9965264c750ae8daa68ff44271
- SSDEEP 96:9j9p48+MxvWYJzecO0+0pMaNwO+jO/EX0cNa1rBCNbT46:XpDlvFCcx+0bwO+j4EXS1roTX
- TLSH T12A1264E9F00EF898E49952F5953C85A4108E3CCEF264C29FB57AF92A3A7318355E14C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Jason-Cain/Cain/Crypter/Icons/kaspersky_14598.ico
- SHA256 725ae8e7fabd2344ac044bbf2555a6186b6151faad3bdfb40dfa309787142e0f
- MD5 9eaa06979b607a7692f606677be77e4a
- SHA1 328dba96d2829b8a3e5aac9c1766db275597775b
- SHA512 c9a9c9376d25203890abd125056a1448c5aa266cc5088d42f1b574db047e9b4756124f9c43fa58b41f09c73d0b9e4e613cf443c85e6ac3afcc198f1b23614412
- SSDEEP 192:B4d7WDrLzVjMJAHmovfuVJAfuKKHKKKKOtG5pXUu:AC3nvvO75RUu
- TLSH T1DDA284347986E147C6B8907DC6B6EE38B2319C5DDBA71F113AC6AFAB78B170B0852150
- MD5 SHA1 SHA512 SSDEEP TLSH
Jason-Cain/Cain/Crypter/Icons/windowsmedia.ico
- SHA256 527dbfcc5e54a4bbad6f567e7419c43127381a79ce6ee3f36727281459022af9
- MD5 6b37a8e496a52c1b276681d3519fc206
- SHA1 1ae6289ba83997ff18759646294946bde365c92a
- SHA512 907ead9c2a2832b472a273558b602f803cc3540c312c317b0143258cd359a02f2e78aba966a36f4c1cd6ede0f8cd728fb57a06b5d79fb28de62af9d80a44a255
- SSDEEP 48:UuQDHJQT0PIgjim6MmFXXJrBezpuCx7l80loav4dNwvhTLXjYO4pxbf2GM:6p+0PUJ95XJrBsy0i24wvhTDp4Tr2GM
- TLSH T164C1803A3014F556E88A06F01700E7061CFA3CA3DB0AE1C8B1A279EA727F2F1615A395
- MD5 SHA1 SHA512 SSDEEP TLSH
Jason-Cain/Cain/Crypter/sgn32/keystone.dll
- IMPHASH 044a033e1d43d9089b7d62fe337df586
- SHA256 83423daf0d6c1b13bee188066da6e7a0ecdb8fdb3d52b418ec47366f6ce9c445
- MD5 5a84ffc9eb226376ad8141ce0ad14cec
- SHA1 1fdc2ce9f5de3d029dbfb0c5345da451d73d2e87
- SHA512 294af9da92c919c141d7f8e7ea8d5f9525ff6820c2a0a4c1ba39f7ddec44935f73d97afb8688766a6cfb8d3f8c22b25f5ae64ee05bd2913215b8dc7cc8d06aa9
- SSDEEP 49152:g+/DSuTZOUf1pf20+Ya24kyTq9dEY3yoZSXkPG2:gwDSuTZOm+Ya24kyTq9dEY3yoZYkO
- TLSH T18E36C302F651D52AD44E02344CDBCBAC2B367DA0DF26879376D437BFAC363952A72246
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1308546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
GetCurrentProcess
GetSystemInfo
VirtualQuery
GetCurrentDirectoryW
CreateFileW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
CloseHandle
Sleep
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
ReadFile
FlushFileBuffers
WriteConsoleW
SetEnvironmentVariableA
EncodePointer
DecodePointer
HeapFree
HeapAlloc
RaiseException
RtlUnwind
ExitProcess
GetModuleHandleExW
GetProcAddress
IsProcessorFeaturePresent
GetProcessHeap
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
IsDebuggerPresent
GetCommandLineA
GetCurrentThreadId
HeapSize
GetStdHandle
WriteFile
SetLastError
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
LCMapStringW
OutputDebugStringW
GetStringTypeW
ReadConsoleW
ks_arch_supported
ks_asm
ks_close
ks_errno
ks_free
ks_open
ks_option
ks_strerror
ks_version
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
52KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
150KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=199, version=41118,
count=34, id=223, productName=VS2013 build 21005, version=21005,
count=56, id=225, productName=VS2013 build 21005, version=21005,
count=139, id=224, productName=VS2013 build 21005, version=21005,
count=1, id=208, version=65501,
count=7, id=203, version=65501,
count=108, id=1, productName=Unmarked objects,
count=5, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=144, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Jason-Cain/Cain/Crypter/sgn32/sgn32.exe
- IMPHASH 904f496ba59558eff91492fda9ff7c43
- SHA256 0269e734b302f459336ee2213a443c4847734e8b539b7f70c081bcbe398cb82f
- MD5 e32f51afb11cb6401ea17a6034dcf91e
- SHA1 ed9a187f343ddd4253dfcf918bc9c99be76d4d37
- SHA512 d3e068de19be0e318366dff62df954948c7db73e1ec30482f67d1937f2598a881993d098a23dacd319075e48e47b739d490c8ed5f7d646c54acaaecf671f4a5c
- SSDEEP 49152:dPNJWJcgYRJd9obCcVce4jyctEqaBIol6u:t0dctcBIm6
- TLSH T130E52841FEDB94F6E9031931559BA22F67244D094B28CBC7EA45BB6EEC372D20C37249
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5104
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
RaiseFailFastException
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__getmainargs
__initenv
__mb_cur_max
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_beginthread
_cexit
_errno
_initterm
_iob
_lock
_onexit
_unlock
abort
atoi
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
memset
setlocale
signal
strchr
strerror
strlen
strncmp
vfprintf
wcslen
keystone
ks_arch_supported
ks_asm
ks_close
ks_errno
ks_open
ks_option
ks_strerror
ks_version
_cgo_dummy_export
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
118KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Jason-Cain/Cain/Crypter/sgn64/keystone.dll
- IMPHASH 0b2cafdc48e1ae3e1edb30ae624565ed
- SHA256 1153675cf2be711498725d08da6723eedf8feffd7c43f812f68f017c03673029
- MD5 bdde62654a36a86f2433d661c886d4c2
- SHA1 f7c2da22a8914752ac69583dad9e46b3cca4ce14
- SHA512 ea15158952d89a35b00d2d3c7034ba405a7599303addd074b032b0563f1ce9654bfb9258d9efff40bd56b832457350a6b1fd062edd5472088190e1c89fd93748
- SSDEEP 49152:UPJSjZO8cMBWu5NnHgSGP2Iwx/f2yTIrVWCINa+VSlL7A8iVhhH8CfGkcbKIUWF1:rsv/w6nwJ1jlilX/ftvJvkWc
- TLSH T10C46B14AB651D826C01681388DCBCB9A6B727C64CF23939B32E7337F6D373951EA5601
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1477324
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLastError
GetCurrentProcess
GetSystemInfo
VirtualQuery
GetCurrentDirectoryW
CreateFileW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
CloseHandle
Sleep
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
VerSetConditionMask
VerifyVersionInfoW
ReadFile
FlushFileBuffers
WriteConsoleW
SetEnvironmentVariableA
EncodePointer
DecodePointer
HeapFree
HeapAlloc
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
ExitProcess
GetModuleHandleExW
GetProcAddress
IsProcessorFeaturePresent
GetProcessHeap
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
IsDebuggerPresent
GetCommandLineA
GetCurrentThreadId
HeapSize
GetStdHandle
WriteFile
SetLastError
DeleteCriticalSection
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringW
LCMapStringW
OutputDebugStringW
GetStringTypeW
ReadConsoleW
ks_arch_supported
ks_asm
ks_close
ks_errno
ks_free
ks_open
ks_option
ks_strerror
ks_version
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
67KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
436B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=199, version=41118,
count=12, id=223, version=20806,
count=57, id=225, version=20806,
count=137, id=224, version=20806,
count=1, id=208, version=65501,
count=7, id=203, version=65501,
count=112, id=1, productName=Unmarked objects,
count=5, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=144, id=225, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
Jason-Cain/Cain/Crypter/sgn64/sgn.exe
- IMPHASH 378a28b0af3a6e8148fc8187b0fbb00d
- SHA256 992789486fc6bf8f4aff494fcca27209758db9df0118ca7537540faf2c48d4ef
- MD5 fb5209b01f17d6f34a0348b99181b6fe
- SHA1 9e981dc4d901a94ce55aead21e9bea9aa46f844c
- SHA512 6665b6098315c2de5314d2a5246d7d32a27d7ee6c5ba210818531b17880ff4b87f3341cd10734f0015b3969a969dd9b54982723aa61a43c308d298b7d506ae7c
- SSDEEP 24576:r4/KYfY7a8BF17eWyGWOL+guydQQ3JOcSRzDjvQNH1PjvAOTlDOWgM2x7fi+mlp0:TYg7Fz1733VuyjOcaj8sgeT/vVv
- TLSH T1DAF53807BCE545F4C4AED2358A639252BB71BC484B3127E72A60BB382F76BD09D79710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerExW
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
FreeEnvironmentStringsW
FreeLibrary
GetConsoleMode
GetCurrentThreadId
GetEnvironmentStringsW
GetErrorMode
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatusEx
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetThreadContext
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
PostQueuedCompletionStatus
RaiseFailFastException
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SuspendThread
SwitchToThread
TlsAlloc
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WerGetFlags
WerSetFlags
WideCharToMultiByte
WriteConsoleW
WriteFile
__C_specific_handler
msvcrt
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthread
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
memcpy
memset
signal
strerror
strlen
strncmp
vfprintf
wcslen
keystone
ks_arch_supported
ks_asm
ks_close
ks_errno
ks_open
ks_option
ks_strerror
ks_version
_cgo_dummy_export
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
160KB
Virtual Size
159KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
78B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Jason-Cain/Cain/Guna.UI2 (2).dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fdb983d6a45f51b6681b8769371e9bf3aeb2b515404ac2b33b6b2d8005cb72aa
- MD5 59a41a8e10e5fc5828e9eada36e6c6b4
- SHA1 c6ca2881bcffb84bcb6f6ddb735aca18e7483b6c
- SHA512 139dfd4e70ba91a0ad66f597a46e2ff982e6beef83fe194c619037732a902063dc6e72fff179f43db6086d6906ee7690b58726d64f7c4f0069193acfc43b23fd
- SSDEEP 49152:4KoOW5m269ypJMKS+yU85icqpQEgRjmuaNJMKYKLHJVpW/gyW1vV5aV1LLa03PwC:4KnC13
- TLSH T135A5FA193DD0EA27D16ACE3391D25021E3F1E4632AB2EB0E72E3576C1842749788777E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2149358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ce28962cdcba2278726623edaa495f510984037298b976c454f38c34c5e0e2be
- MD5 0e0a9c6a25832395ccefe5c9fc2a96aa
- SHA1 7e8b4865b89f46e3d62b2a9bf75c77d53b3a14c4
- SHA512 182859de9883597481271c8d67d0f6f9bd1aee0bc39b6228c419e6f5dd5fa67ec9defc039bf0176298c69e6d35bad7924f9c6741560af92135e908395396c8a5
- SSDEEP 49152:4KoOW5m269ypJMKS+yU85icqpQEgRjmuaNJMKYKLHJVpW/gyW1vV5aV1LLa03PwC:4KnC13
- TLSH T164A5FA193DD4EA27D16ACE3391D25021E3F1E4632AB2EB0E72E3576C1842749788777E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2149358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/JASON Unpack.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 61985e3481a0e41f9273f05773e24349d7c666189715fd24a3a89b801a546da3
- MD5 dac9d3f2896be04469f1de2f7c3d1ddf
- SHA1 9849eaa1538d36c0db7506660e2581bac61762d9
- SHA512 c1d93ec36d6fce4695782b72af7644743371026e8a14b8303f94f54ae758e4a9d95d6aed2e093aa5bfab1558d9128c905fc31560ac3010227f069213ce25a658
- SSDEEP 393216:YrLiyiylGNZPZPZk8LCTmapVq0Tdkn9y0ioVYawFk:mLipRAVTvw0Tdkn9ykaF
- TLSH T195E83322BBF4596CC0BCC37880675F49A7713D499638D2CF1284658E1FBB7D28A367A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
298278126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
284.5MB
Virtual Size
284.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c0b868b5ef6339975246110d2fd0bc3c0a20a5f726b67f0eaa8e3b1f695aa8ff
- MD5 2e25cd4027a657eaab90b36d07a5230f
- SHA1 500df550c6304319146c591fcd191426335b78af
- SHA512 768f57287ed8487d7872f8c3263aca897700b3194e6d0618b609b49facade15a9071d1b5236a543e3043340b1bd0450e16046236c1a4f81e6478e668c1f8723f
- SSDEEP 1536:Qa5swoCJbkxyDhRBjMotUV2z1nHB3O1WfYS8dGgE4A:vscA2hDj3SV2D3O1lSh
- TLSH T183835C196F98CE6ED4BF1BBE34B2050513B4D096B513DB6B9C9414E62E273D20E223DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
G:\DcRat-Shellcode\DcRat-main\Binaries\Debug\Plugins\Miscellaneous.pdb
mscoree
_CorDllMain
Name
.text
Size
84KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/Profiles/Keywords.txt
- SHA256 1bb56a608abc68d08f061ff9dbd109311a76b4b0a92a5ddb38a890d852c60e63
- MD5 6e7f4a1a3423307ed5c86f11856e69ec
- SHA1 434432151e19a219addd69f269d9c0cc135e0ee3
- SHA512 dd4fc608b05eb1c454308bc309ea04a4b9773348d45068255fafaab12f1ee1b845392185f4f1f8329f09fb6b3701727e5cfb20fd2f4f37d01a6013d6d106eb22
- TLSH T13F5143C6571693BCE57E978C260352F2754968B181BB7AF30ED4CDDCA641ED82DCC504
- MD5 SHA1 SHA512 TLSH
Jason-Cain/Cain/ServerCertificate.p12
- SHA256 f791b41e3351b13f59264ba2a1d5e57bec10185add62dfc8d277da04eb4ffc4f
- MD5 91fe38147599ae34a88f56fc21b70bc3
- SHA1 353bfee246e284aba8c8d8c6f6c755c020c437f3
- SHA512 327b6d2a5874ad3e58b3abf9c9481927a719c91dd7115aecf92ee7fadfc74375eb1b757a0b66545cd0a5d8ba0bbf8b3f3dddc354f07334eaea17187c9e387607
- TLSH T1D5512B43277EC1343DE858B5D4F899614CA3EAA10EB0F50F6436430E3A30F647274202
- MD5 SHA1 SHA512 TLSH
Jason-Cain/Cain/Telegram.txt
- SHA256 e4248296a8890f613ae6077ae0d903b088894c783a78b5978058fd21817d1384
- MD5 e6ad4b4c433bdb061f5db4c9b2f516e6
- SHA1 d12fc1e78cab9cb45366916974f4f48348856462
- SHA512 e56897a2ae3118149c7be95d71ba175e3c977640a0749668a0cf798c5c94f9782bdc96ccebf5d180451eb2ee30215fcd01ed60650d32beda798014c184796850
- TLSH T102E012998513714A4555C1414840B42DEFE6ADBBD2D56409350C834A0BB9C98466555D
- MD5 SHA1 SHA512 TLSH
Jason-Cain/Cain/micross.ttf
- SHA256 fc5744108eb6112844be3ec63c0fd76fe0eb782aea25c6aaa58c151d8dc19055
- MD5 e7c9ad14477980e5588aa369fe0db2a7
- SHA1 cbb1766944c4441490d4c02250369b1e3e5e3e8c
- SHA512 19f6f02ed8f81ce2f39342bb9e2830ca5dd5e56a85941aa7898111ec1910f077e4befee8410fbfdeb8404e4376a34c11c2454434ee7af8e83e857a15510fe970
- SSDEEP 12288:BuVr6uvjpeRV8CvTKN69G1ARkzSfEzvChdrtBVsurs1y/RQY8HwTWqXOTS:BuV7VN69G1YkzdKoSsQ9THOTS
- TLSH T11B15BE4FE793AE1FE3946639C05593329B43F659C323879B3A4D1A69DC880F8D6A07C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Jason-Cain/Cain/ru/JASON.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6cb4a7c59e2c648549bd91f9f2fd8452f7f7923fc038d625a6bda188c4d7d962
- MD5 4e5ea0287ce1eb04d07d6024167b3e75
- SHA1 bf03d33104009c31fa147491aa5544acdab80887
- SHA512 14f77515d6442c74bfcf744d3a39f443189136ab65a7d6ef4dbc9c941b1f0cdc4890039cc344046960e40f4c435664b847d4997135a961d6808b9fa32e601f25
- SSDEEP 12288:8Ar/PRYMuTHGDhp639ruGmZZ8p02EsYHfT9/yT2wY:8ArpzuLGDrIZRmZ6rbYHfThyT2n
- TLSH T18A75A833B3D0F205C0B972FA9A5377D05532A28DE9388565184C7EA993FC9E3E651BC2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1637870
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/zh-Hans/JASON.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a0744c34da4e7b60c2e8dab2d8e077d0272efdb157b9ba00db17f0cc630ffb8
- MD5 e6939fa51db2cd0c6b71b60db95358b7
- SHA1 e556288b71fe4b425e8314374a8365b762999709
- SHA512 10520abaddd3311830d286e801df82611e8db8cf875246d57a4a54efe20d887fe4d765d6d82020aa35606fd50cf300a2e41ca1bcaaaa5dedf755c9085144c913
- SSDEEP 12288:Qpr/PRYMuTHGD4Hp639ruGmZZ8p02u4YHfT9/yT2wY:QprpzuLGD4JIZRmZ6rjYHfThyT2n
- TLSH T113759833B3D4F205C0B972FA9A5377D05532A28DE9388465184C7EA993FC9E3E651BC2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1613230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Cain/zh-Hant/JASON.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ff2f8aaf398b9ac78b9c8ab78486d72dceeeaaf960b5e572753c545afa0a4c0f
- MD5 fe92f29f99c9b316c3a74b7a733cbf47
- SHA1 8af4ce420f488d2b14bc6001ebf2330691fcacbb
- SHA512 46d886725298b05141d3a52ad8f2256e40b2f92d197285a6c95f10639d4725afab664611d36d604fc9f3fdd53983ca6eca4e4d44af634de56f153e059281080d
- SSDEEP 384:wWCvwjXwgpwq6uhbahh88PwqZwq+kvwKwq6uhbahh88jI:953WP88rWP88jI
- TLSH T127522A323795511FDA51177348B0E3E5A37AAE50EE21CB0E0998676E6F65602BF22D30
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Jason-Cain/Telegram.txt
- SHA256 e4248296a8890f613ae6077ae0d903b088894c783a78b5978058fd21817d1384
- MD5 e6ad4b4c433bdb061f5db4c9b2f516e6
- SHA1 d12fc1e78cab9cb45366916974f4f48348856462
- SHA512 e56897a2ae3118149c7be95d71ba175e3c977640a0749668a0cf798c5c94f9782bdc96ccebf5d180451eb2ee30215fcd01ed60650d32beda798014c184796850
- TLSH T102E012998513714A4555C1414840B42DEFE6ADBBD2D56409350C834A0BB9C98466555D
- MD5 SHA1 SHA512 TLSH