Auto-doxxing-tool[.]rar

resource
unpack001/Auto-doxxing-tool/compiled/AutoDoxTool.exe

Auto-doxxing-tool.rar

SHA256 99872a319b23a3144a3d6afed8f534c1e83415ff42ae66044c159ad1953efe83
MD5 6023706591f0ab599727ef1af8641ff0
SHA1 59f88e81c7ddd253698ea94867c57f01e2eca813
SHA512 1d3fd695f2a72dda60762771a9d16147eb011bf46c1f8e5bd6162b142a80a5c568d7ad40b27136008713597fd092ea15498ed7f3a20e34311ac00e83fc4de776
SSDEEP 1572864:5TbX6mwxefvEKYLFKtmEESy/31UdjtY908:5TbXrwQfvzYRKQso3gjtw/
TLSH
T176D733DC95D9AA9E7717A041F1E6AFFA0E6CF21EE0DB611231409B10B851DC532BCDB2
MD5 SHA1 SHA512 SSDEEP TLSH

Auto-doxxing-tool/.gitattributes

SHA256 45a7cbb7d9942ba7ffce0b20bc8dbe2d1196533bc6e4bd245871d77fb1eedfdc
MD5 13f0aecd22cc1f06c8225ae5e692ff31
SHA1 2c1741fb1014d41275cf6193f806ae86cc951f25
SHA512 8b3114aac168b2271e8c091056d51519d62716285f98cdaae75e289b72bea0e5028bf31d167f6d5b4ab19a23591e616775ac7ec9c439debb9d537576a3b45eb1
TLSH
T1DE51371A9BE45665C3CB01995BC77B597E712A9E3E37723A141FD408B3C22A0D0DA2B2
MD5 SHA1 SHA512 TLSH

Auto-doxxing-tool/.gitignore

SHA256 deab72c393f334c50b9f30ce730eca452ea0ac28f6544cdc2012017f6c9a902c
MD5 2241916aad050c07b2199dd72bdf39be
SHA1 0e753b3baa3d00b4c75556e85bf78ae7fac9ce3d
SHA512 2198883f6069261249d7245afd2f4ec9f943276ba15a4d8c03823d8ffb4f6535801f84487e64d77f21f09f6c8cddac83e3e03d5946d6959dcaa4677456c1cd78
SSDEEP 96:nvZQRlP+CWIR053ssPzcJU+KlMUBFANVCSJLO+JVFwygBZfOXUss3xz4BjvAkCvB:nGRPWIR0V/NKAxSA+JwhZETAkCvB
TLSH
T10BD118FEA56C567B4A8220CEE1F6B804FB6D538493F623F588CD4149B301B44927F0B9
MD5 SHA1 SHA512 SSDEEP TLSH

Auto-doxxing-tool/AutoDox.sln

SHA256 59ce660a278ce486a6f0a8e0d547608f605aa41886d5c547c3a77de13aae4a03
MD5 64a20c3994286725bfb718f9342d8695
SHA1 047277687f234b02cd450bc960c4a6c43708954d
SHA512 dd20b396ce786907e8926f50573e20ac2e86910e5ff5348a11223b4f8de25f97e85cd9f46212dc7710e1bc0e2d92363765ce2a41ae8e7213123d0d39350fbb15
TLSH
T1FB21596CA41EA4708DCE531FD7A509073E73839AD9EC6B7D2A82005CE773A13464749F
MD5 SHA1 SHA512 TLSH

Auto-doxxing-tool/AutoDox/AutoDox.cpp

SHA256 9854bf3ad1eb9064f6aea4f01ec0446f9a92ab45ffd686a6ec62228fbe6b747b
MD5 8e83f17a21c6de7b749aabe0f18c5a4e
SHA1 40f63bf9b2969cc08f80d7a87a552fbf8e470304
SHA512 e89a45dedd9cf9f359913ec3e0f343ea1a0ab1eaa810ad9511a11852dd51b9f2fa5b3f96ce48d2aad951307595d3be0cefcdaedb6ec91cc834cec3eb11781e4e
TLSH
T1AD319513C979E1AA54F31060433E69A5949B321ECB194BAFFD07908A7030427E1BB9A3
MD5 SHA1 SHA512 TLSH

Auto-doxxing-tool/AutoDox/AutoDox.vcxproj

SHA256 5d93772a9a8f4f588919892cfa31c9666a2ab3b15dd7128ae193810d22ddec11
MD5 d6f1d10f91ae936441dbf26d58b84171
SHA1 59adb86e7c20858f5ed3388a541e919b0d58b126
SHA512 0ab91c0fa76d531be38b17ec2bc3769747d330c519acb98915e8f2ecc07226858924a9d0739522c03f53beb187d1705a730bca74484d787501f510f8b67670c6
SSDEEP 192:UmFW7wIeBIIpBnUt/yPcg/hPcJ/KPcb/ZPcr:UmQF/q5/VY/ia/tU
TLSH
T10BE1B894D4F05AA6C1AB022BE5D719418FB0C3931D6A8C6CF6AFD7184F2B6487313B72
MD5 SHA1 SHA512 SSDEEP TLSH

Auto-doxxing-tool/AutoDox/AutoDox.vcxproj.filters

SHA256 b6fa2e901572e7302a9abf998c4f2e3ef5f406514de776428b1a1348302ee807
MD5 ece2823bd470972055a498e1bc58932f
SHA1 1eb94869818c226ddff480af68e043a33e0ea8b8
SHA512 7b8a9491b123a0a0fce9a45c5015d030f7b604fe110760de126b7f95c96909dfe32859d51967021c86a8e47fafeb2f3274c8d29a5acc91909ee75464a4e45453
TLSH
T12E119C21C8FC2BD96125AD17FFC486196FA9E2F731D0118576EDC4032BE631C6927768
MD5 SHA1 SHA512 TLSH

Auto-doxxing-tool/README.md

SHA256 20d6edcfe199958dc862457cb4fa22d1b34052bafac6ae81194e1d33da2cc55e
MD5 30d37f8ee92f8fe6c8fac31f1724abf1
SHA1 631573050756446fbab7c065ab746d1dd6918f1e
SHA512 ba028d1190fc8871cc91e808875813c12893f83f6e4b273668fa98b494354211927a656b732afce48f38193532117b6df3462a6c8d7446e3935b6e1433dc1bfc
TLSH
T1A801C9D791227CD4678316C38A466366F70791FABA8F685CB539514AA9C6833FC2A083
MD5 SHA1 SHA512 TLSH

Auto-doxxing-tool/compiled/AutoDoxTool.exe

IMPHASH a15389e7a3e3d8aabef3d1422091a217
SHA256 6e6d5ce16def18e5479bd1bcef009b07733e6fd432764ad9599e584c4cc4aaf5
MD5 e07ca593e4564db58853b7c5641b7a29
SHA1 d89026733a9c55d63aeea1d456e3b1e50b34e5b3
SHA512 92aa09751343f3fba9e9bab391d747bd901e5b6d7aaf3800f20c4adaf839467e176bd0122f414260369b9064cdb237902f72b41dc3dcf5cf726dffbdf8ab288a
SSDEEP 1572864:C/7EpN1W90CcEi5+IzE4xyJbDfcVkpZ5PGQVY5i26W3o1:SYVGuLE4xCbbg+Toioo1
TLSH
T11FD7332CF8D768B9C2DB48F0D5D29DFBF151BD700448B46D839A7AA4B677700E2912B2
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

47:d9:c3:42:45:f0:bb:21:63:1a:97:6d:77:28:bd:af:0b:93:bb:ff:bc:94:49:ab:42:4b:fc:b3:17:08:f2:af

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 2, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:56:c9:20:2b:1f:74:32:5d:2d:00:00:00:00:05:56

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 19, 2023 - Oct 16, 2024

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0c:52:4c:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 6, 2010 - Jul 6, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:d0:77:08:aa:ef:a3:17:c6:dd:00:01:00:00:01:d0

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

4342

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceA FormatMessageA FreeLibrary GenerateConsoleCtrlEvent GetCommandLineW GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessId GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadResource LockResource MapViewOfFile MultiByteToWideChar ReadFile SetConsoleCtrlHandler SetEnvironmentVariableW SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _lock _onexit _unlock _wcmdln _wcsdup _wcsicmp _wrename abort calloc exit fprintf fputc free fwrite localeconv malloc mbstowcs memcpy memmove memset puts signal strerror strlen strncmp vfprintf wcscmp wcslen wcsncmp

shell32

SHFileOperationW SHGetFolderPathW

Name

.text

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

55.7MB

Virtual Size

55.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer