TheExecutor.zip
- SHA256 89cd188ad3d8e7102263c71a7ff6a9fba0cf40c6fd4e240abbdeaa77bc91ddc6
Overview
overview
8Static
static
3TheExecutor.zip
windows10-2004-x64
1TheExecutor.zip
windows11-ltsc_2024-x64
1ARMClient....on.dll
windows10-2004-x64
1ARMClient....on.dll
windows11-ltsc_2024-x64
1ARMClient.Library.dll
windows10-2004-x64
1ARMClient.Library.dll
windows11-ltsc_2024-x64
1Autofac.dll
windows10-2004-x64
1Autofac.dll
windows11-ltsc_2024-x64
8Newtonsoft.Json.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows11-ltsc_2024-x64
6System.IO....ns.dll
windows10-2004-x64
3System.IO....ns.dll
windows11-ltsc_2024-x64
1TheExecutor.exe
windows10-2004-x64
4TheExecutor.exe
windows11-ltsc_2024-x64
4Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
TheExecutor.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
TheExecutor.zip
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ARMClient.Authentication.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
ARMClient.Authentication.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
ARMClient.Library.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
ARMClient.Library.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Autofac.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Autofac.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral9
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Newtonsoft.Json.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral11
Sample
System.IO.Abstractions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral12
Sample
System.IO.Abstractions.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
TheExecutor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral14
Sample
TheExecutor.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target TheExecutor.zip
- Size 1.2MB
- Sample260707-2k977sf14q
- SHA256 89cd188ad3d8e7102263c71a7ff6a9fba0cf40c6fd4e240abbdeaa77bc91ddc6
- MD5 28a0ffffca83ecd53dc379b3f849dd66
- SHA1 287cb75f7d078d452f28dc7cd130ddfcb1479751
- SHA512 cf0a030f6acdcd935c28c13d1026d537d0379e5365b74b5c7307d79fba3f8164ebe49911a838a46c3fa97748c5e4f0ffd210b40a7f895566ce16fb320ac00b6f
- SSDEEP 12288:ri3ge/iD56RmzoV537Ogr2VAHx7JijBZdPfP+Q4AFUBNgVr7FMQPlZW:0gfZoTS3VAHxKBZd3PT4AHfFMmlo
- TLSH T163457C4427FC8767E2FF1B75F474421687B6F406E96AE78E1A48A5FE18937808C10B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/TheExecutor.exe - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Autofac.dll
File Explorer
-
TheExecutor.zip.zip 1.2MB
-
ARMClient.Authentication.dll.dll 66KB
-
ARMClient.Library.dll.dll 32KB
-
Autofac.dll.dll 203KB
-
Newtonsoft.Json.dll.dll 531KB
-
System.IO.Abstractions.dll.dll 53KB
-
TheExecutor.exe.exe 305KB
ARMClient.Authentication.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9931b5d62e7fb38eeb8f86f6204b6055f7eeca08cba780698167c8846ca90647
- MD5 bc1b4885c1bcc757113a7e2c000f4821
- SHA1 e1153f6423567ca4a2b7d4947cbdb1aed5ca11d8
- SHA512 5fcdc9d31956437a4bdf459e337b76f93070bbf430121a651e52517e833d79f38ce3c3c124d099bda5e039252ccb32f40f64ae3517250a47f73134402e0433c8
- SSDEEP 1536:M9vycbM2Ur9ozNPl9kIzGcGJVOvALlqwhuPDmLNzR4INnS:Pcj7kIzGcO0DSRLNnS
- TLSH T196636C85A7FCCA23E6DF5ABCD1A4D1471B72E7966810F78E1C8CF4EA244338046416AF
- MD5 SHA1 SHA512 SSDEEP TLSH
PE Signature issue
Digest
c8:cf:e2:a7:01:57:68:28:91:d4:60:e4:89:5b:84:76:d1:69:49:9e:70:d3:f4:0a:33:33:51:53:ea:bb:71:98
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 11, 2017
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
bb:8f:7b:9b:ee:f6:f9:b6:bd:92:8f:6f:e6:c8:f9:47:b3:45:5d:a6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 11, 2017
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:af:83:ed:a8:3b:b7:a8:4b:68:00:00:00:00:00:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 10, 2017 - Jul 2, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9f:67:f2:b5:a8:23:06:5b:7b:00:00:00:00:00:9f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:46:90:c5:f6:a2:10:8c:b0:56:00:01:00:00:01:46
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 21, 2016 - Dec 11, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b4:43:3a:1c:fe:b6:ba:52:89:00:00:00:00:00:b4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
56722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\repos\ARMClient\ARMClient.Authentication\obj\Release\ARMClient.Authentication.pdb
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ARMClient.Library.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 90d4ca5ab2baf128d46a3f5d5a71bea524c413f40bdbc4a03668436bcfcce5f3
- MD5 d6bb28c67f08bead73403ae90787b64d
- SHA1 449086e0b990918fc4f15c8ef9e8d48a6486b7d1
- SHA512 6b29dec43b7ccdea3c74afe7a40d6391e26702238f4a9ecfd0fb223d279021ebbe0801723006beadf340bcd50ea8752adb696622dad83e0b32a5e75c6663fb1b
- SSDEEP 768:OZmbSucRuI3sUeaHj2eQLUrDj08BkaXQyu6ewxaaicmhH9AIIKqU:vbj3yeaHjTQwHPkGQLNaa2IdkU
- TLSH T1FCE27CC48B6C9523C98B5EB896A8C1436E35D3DA5D21E65E08DCF8EA1CD33C9970473E
- MD5 SHA1 SHA512 SSDEEP TLSH
PE Signature issue
Digest
a6:3c:c9:ea:73:de:b0:bb:85:88:a5:26:65:22:8a:ee:78:78:90:6d:82:b4:7b:65:c2:0e:8b:71:5d:13:5f:a0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 11, 2017
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
e4:5b:32:17:dd:0d:50:79:84:b8:c3:75:29:b0:e2:86:59:4f:ca:2a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 11, 2017
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:af:83:ed:a8:3b:b7:a8:4b:68:00:00:00:00:00:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 10, 2017 - Jul 2, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a3:ef:1f:22:20:81:63:dc:a5:00:00:00:00:00:a3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:46:90:c5:f6:a2:10:8c:b0:56:00:01:00:00:01:46
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 21, 2016 - Dec 11, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b4:43:3a:1c:fe:b6:ba:52:89:00:00:00:00:00:b4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
21386
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\repos\ARMClient\ARMClient.Library\obj\Release\ARMClient.Library.pdb
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Autofac.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c9e70658befe655ab80b4f6caf38bcec57d9d3bab143305cd214bffcf9abd8cd
- MD5 e0dfdb31cb96160e2a56c168665c8ece
- SHA1 955888cf96ba50a6637f76cc83f3b3729051f121
- SHA512 05a1f7539af4aa7f97454db8fe8ead032b5bc18c1542144477105085d0784d3f6af518fb1f2d17f934704e912d9394623a970f34812b4d14e44284ebff64d616
- SSDEEP 3072:oJtUPVpBadGe/W/dSmcLOZPWHQ17n56Wwmz9lWbv7C9DahVP:oeXe/ikSJv17n56Wwmzyz7C9DahV
- TLSH T180143A4523FC2737D1FF4B7EA47450418BB6F517E845E64E4F9810FA06A2F05AEA0AA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
214094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
201KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7b1bbdd36dfccf96d8b941782bc79a43072130989331242548c3553d5c8578ea
- MD5 859adf11b4d2a656a8ee2d070b726743
- SHA1 d53682045cf3b3d674b0c957643bc2abc7fa42c4
- SHA512 6540acb9f3e8884af60394aad8e17964d4cf1469d7f0df589dee86a672f711588b70d3fd4033ecef5d954ef4cd7ba8581c2855d6311921da68a6a9b7c20e0eba
- SSDEEP 6144:YeC37wbJmJ5bd4m15M+S50cK7q2UGu7WEYEaWdDBLH5WHxJ16Wi/h4aBTBFFu4J+:s37Ogr2VAHx7JijBZdPfPi
- TLSH T19AC43A502BF89726E6FE2771F438061557F9F45AE67EEB4F5A4095AA1C837808C00BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
PE Signature issue
Digest
fb:e7:94:b6:38:5f:88:cf:eb:68:48:e0:a5:ea:71:cf:51:0c:73:f8:3c:b9:f5:20:76:fb:fe:b5:91:c1:97:56
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 11, 2017
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
94:2c:27:e1:f2:94:0a:a6:89:e9:ba:7b:ca:45:5b:0a:db:b7:96:69
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 11, 2017
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:af:83:ed:a8:3b:b7:a8:4b:68:00:00:00:00:00:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 10, 2017 - Jul 2, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b4:43:3a:1c:fe:b6:ba:52:89:00:00:00:00:00:b4
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:46:90:c5:f6:a2:10:8c:b0:56:00:01:00:00:01:46
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 21, 2016 - Dec 11, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9f:67:f2:b5:a8:23:06:5b:7b:00:00:00:00:00:9f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
530998
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\Net45\Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
511KB
Virtual Size
511KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da16ef846948a94f665b694b9b65e6882496dbb27ba57a17abfbb51f7cf07be
- MD5 f239405f612d8f172eaa8291be224ff1
- SHA1 3328282fd11c277af4e55747dcfda358243d9942
- SHA512 038d20ea3aa0419032b34c7dea4e4b613fe4f7bc75256820c94cbaf7bb8a5dc5f6bbcc08d21f3a6129cb5fb9773100d11bf7561dc11844a04dcaf3d6bb6ef0b4
- SSDEEP 768:Dui8/DurjNnJRqqjqqBqqjqq5c55c3dxgYk9A9yu6eTLSnEKmh0QSnE5:Dui8/DurFc55CjgrA9LNHCIHh
- TLSH T19B33F75C2FF4E157DC2E05B479A0C22A6B38D682C803E31A2BB5BDF56C733A5C61245E
- MD5 SHA1 SHA512 SSDEEP TLSH
PE Signature issue
Digest
f6:b5:6f:a5:1f:15:6f:50:4f:b2:cd:52:7e:a1:6a:ea:9a:c9:30:04:a7:28:d9:a9:22:c6:a2:ce:cb:fc:95:08
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 11, 2017
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Digest
f2:68:29:8b:13:87:59:1e:39:94:03:17:25:a4:01:db:fa:f3:ea:c2
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 11, 2017
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft 3rd Party Application Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:af:83:ed:a8:3b:b7:a8:4b:68:00:00:00:00:00:af
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 10, 2017 - Jul 2, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:9d:20:9c:56:77:55:d4:28:9a:00:00:00:00:00:9d
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft 3rd Party Application Component,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:46:90:c5:f6:a2:10:8c:b0:56:00:01:00:00:01:46
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 21, 2016 - Dec 11, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Minor OS version
0
Major OS version
4
Entry point
42818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\system-io-abstractions\System.IO.Abstractions\obj\Debug\System.IO.Abstractions.pdb
mscoree
_CorDllMain
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
TheExecutor.exe
- SHA256 576b74eb4ab1287fc39e4f1dbecc478deb8b0bd14f7104ae1c6446946ffd4a28
- MD5 6d9dcaa75e1846e79d6f0eeef87aae10
- SHA1 0d6231f8ed4445e7b1e716bb34b55e5e362a825d
- SHA512 eb8edd40ff7881b15c809febdcab209ebaed7a6ea1098425f035d2b0cdac3f4e0ce832ef35b5e3802e7cbb4c7df661c38f471145c584ec3ff167654ca6c4f88e
- SSDEEP 6144:jIQ4WYGDlFUBnNgVUq19v5pwOMw1cilZg:0Q4AFUBNgVr7FMQPlZg
- TLSH T14C644B86636CC7A1E16F1F76B86282EA8733F9069CA5D7DD194CE7EC18637818C10727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
93:f8:bb:ad:00:f5:ab:d5:a3:09:eb:e2:cd:a7:78:48:77:d8:2b:17
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Aug 16, 2017
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c6:78:80:36:01:75:1a:69:72:00:00:00:00:00:c6
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 17, 2016 - Feb 17, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\repos\azure-functions-cli\src\Azure.Functions.Cli\obj\Release\func.pdb
Name
.text
Size
236KB
Virtual Size
235KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ