LibSploit.rar
- SHA256 c2247bcf4e0db0ad4a7f731c385d8459d2e780e347d2cf1575475680a510def0
Behavioral task
behavioral1
Sample
LibSploit.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
900 seconds
Behavioral task
behavioral2
Sample
LibSploit.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
General
- Target LibSploit.rar
- Size 7.7MB
- Sample260712-1fbneaa17t
- SHA256 c2247bcf4e0db0ad4a7f731c385d8459d2e780e347d2cf1575475680a510def0
- MD5 5167bd5ed84757a4d9893df2f72ce75e
- SHA1 eeac6df92673f0578a6dd36da85ae67c7a528525
- SHA512 043a72e2e9fe873072729e8b5a5b63a508734b032263db1048f2fe48a75e7b9d8c4097f29d9ae87482a1b71aa52c20b8ea307ef69e7cf4d6cc5ed438be2ef616
- SSDEEP 196608:rWJOzryp0iZDt5wBxcCMjF15jzTpPidCyq9xqztM3f:rwqiLmapJLVwCyq9xEtM3f
- TLSH T19E863364739545C2CBC29FE8F56B098D45263ACFA3F2D2A7F9B3CCDB86506910C86385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Dracula, Samurai
Dracula aka Samurai is a stealer written in C#.
- Detects Dracula aka Samurai Stealer payload 2 IoCs
resource yara_rule static1/unpack001/LibSploit/PatchedTemp/Stealer1.dll family_dracula_stealer static1/unpack001/LibSploit/Plugins/Stealer1.dll family_dracula_stealer - Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule static1/unpack001/LibSploit/Panel/Client.exe family_sheetrat_v1 static1/unpack001/LibSploit/PatchedTemp/Client.exe family_sheetrat_v1 - Unsigned PE 102 IoCs
Checks for missing Authenticode signature.
resource unpack001/LibSploit/LiberiumUltimateExploitPro.exe unpack001/LibSploit/Panel/BouncyCastle.Crypto.dll unpack001/LibSploit/Panel/Client.exe unpack001/LibSploit/Panel/dnlib.dll unpack001/LibSploit/PatchedTemp/Action.dll unpack001/LibSploit/PatchedTemp/AntiProcess.dll unpack001/LibSploit/PatchedTemp/AutoRun.dll unpack001/LibSploit/PatchedTemp/BotKiller.dll unpack001/LibSploit/PatchedTemp/BotSpeaker.dll unpack001/LibSploit/PatchedTemp/BouncyCastle.Crypto.dll unpack001/LibSploit/PatchedTemp/Camera.dll unpack001/LibSploit/PatchedTemp/Chat.dll unpack001/LibSploit/PatchedTemp/Client.exe unpack001/LibSploit/PatchedTemp/Clipboard.dll unpack001/LibSploit/PatchedTemp/Clipper.dll unpack001/LibSploit/PatchedTemp/DDos.dll unpack001/LibSploit/PatchedTemp/Desktop.dll unpack001/LibSploit/PatchedTemp/DeviceManager.dll unpack001/LibSploit/PatchedTemp/Explorer.dll unpack001/LibSploit/PatchedTemp/FileSearcher.dll unpack001/LibSploit/PatchedTemp/Fun.dll unpack001/LibSploit/PatchedTemp/HVNC.dll unpack001/LibSploit/PatchedTemp/HostsFile.dll unpack001/LibSploit/PatchedTemp/Injector.dll unpack001/LibSploit/PatchedTemp/KeyLogger.dll unpack001/LibSploit/PatchedTemp/KeyLoggerPanel.dll unpack001/LibSploit/PatchedTemp/KeyLoggerRemover.dll unpack001/LibSploit/PatchedTemp/Map.dll unpack001/LibSploit/PatchedTemp/Microphone.dll unpack001/LibSploit/PatchedTemp/MinerEtc.dll unpack001/LibSploit/PatchedTemp/MinerRigel.dll unpack001/LibSploit/PatchedTemp/MinerXMR.dll unpack001/LibSploit/PatchedTemp/Netstat.dll unpack001/LibSploit/PatchedTemp/Notepad.dll unpack001/LibSploit/PatchedTemp/Performance.dll unpack001/LibSploit/PatchedTemp/Process.dll unpack001/LibSploit/PatchedTemp/Programs.dll unpack001/LibSploit/PatchedTemp/Regedit.dll unpack001/LibSploit/PatchedTemp/ReportWindow.dll unpack001/LibSploit/PatchedTemp/ReverseProxy.dll unpack001/LibSploit/PatchedTemp/ReverseProxyR.dll unpack001/LibSploit/PatchedTemp/SendFile.dll unpack001/LibSploit/PatchedTemp/Service.dll unpack001/LibSploit/PatchedTemp/Shell.dll unpack001/LibSploit/PatchedTemp/Stealer.dll unpack001/LibSploit/PatchedTemp/Stealer1.dll unpack001/LibSploit/PatchedTemp/StealthSaver.dll unpack001/LibSploit/PatchedTemp/SysPlug.dll unpack001/LibSploit/PatchedTemp/SystemSound.dll unpack001/LibSploit/PatchedTemp/UAC.dll unpack001/LibSploit/PatchedTemp/Volume.dll unpack001/LibSploit/PatchedTemp/Window.dll unpack001/LibSploit/PatchedTemp/Worm.dll unpack001/LibSploit/PatchedTemp/dnlib.dll unpack001/LibSploit/Plugins/Action.dll unpack001/LibSploit/Plugins/AntiProcess.dll unpack001/LibSploit/Plugins/AutoRun.dll unpack001/LibSploit/Plugins/BotKiller.dll unpack001/LibSploit/Plugins/BotSpeaker.dll unpack001/LibSploit/Plugins/Camera.dll unpack001/LibSploit/Plugins/Chat.dll unpack001/LibSploit/Plugins/Clipboard.dll unpack001/LibSploit/Plugins/Clipper.dll unpack001/LibSploit/Plugins/DDos.dll unpack001/LibSploit/Plugins/Desktop.dll unpack001/LibSploit/Plugins/DeviceManager.dll unpack001/LibSploit/Plugins/Explorer.dll unpack001/LibSploit/Plugins/FileSearcher.dll unpack001/LibSploit/Plugins/Fun.dll unpack001/LibSploit/Plugins/HVNC.dll unpack001/LibSploit/Plugins/HostsFile.dll unpack001/LibSploit/Plugins/Injector.dll unpack001/LibSploit/Plugins/KeyLogger.dll unpack001/LibSploit/Plugins/KeyLoggerPanel.dll unpack001/LibSploit/Plugins/KeyLoggerRemover.dll unpack001/LibSploit/Plugins/Map.dll unpack001/LibSploit/Plugins/Microphone.dll unpack001/LibSploit/Plugins/MinerEtc.dll unpack001/LibSploit/Plugins/MinerRigel.dll unpack001/LibSploit/Plugins/MinerXMR.dll unpack001/LibSploit/Plugins/Netstat.dll unpack001/LibSploit/Plugins/Notepad.dll unpack001/LibSploit/Plugins/Performance.dll unpack001/LibSploit/Plugins/Process.dll unpack001/LibSploit/Plugins/Programs.dll unpack001/LibSploit/Plugins/Regedit.dll unpack001/LibSploit/Plugins/ReportWindow.dll unpack001/LibSploit/Plugins/ReverseProxy.dll unpack001/LibSploit/Plugins/ReverseProxyR.dll unpack001/LibSploit/Plugins/SendFile.dll unpack001/LibSploit/Plugins/Service.dll unpack001/LibSploit/Plugins/Shell.dll unpack001/LibSploit/Plugins/Stealer.dll unpack001/LibSploit/Plugins/Stealer1.dll unpack001/LibSploit/Plugins/StealthSaver.dll unpack001/LibSploit/Plugins/SysPlug.dll unpack001/LibSploit/Plugins/SystemSound.dll unpack001/LibSploit/Plugins/UAC.dll unpack001/LibSploit/Plugins/Volume.dll unpack001/LibSploit/Plugins/Window.dll unpack001/LibSploit/Plugins/Worm.dll unpack001/LibSploit/dnlib.dll
File Explorer
-
LibSploit.rar.rar 7.7MB
-
LibSploit/LiberiumUltimateExploitPro.exe.exe 53KB
-
LibSploit/LiberiumUltimateExploitPro.exe.config.xml 176B
-
LibSploit/LiberiumUltimateExploitPro_1.0.0.0.nrmap12KB
-
LibSploit/Panel/BouncyCastle.Crypto.dll.dll 3.1MB
-
LibSploit/Panel/Client.exe.exe 43KB
-
LibSploit/Panel/EncryptPassword.bin82B
-
LibSploit/Panel/MasterKey.bin32B
-
LibSploit/Panel/dnlib.dll.dll 1.1MB
-
LibSploit/PatchedTemp/Action.dll.dll .ps1 27KB
-
LibSploit/PatchedTemp/AntiProcess.dll.dll 10KB
-
LibSploit/PatchedTemp/AutoRun.dll.dll 331KB
-
LibSploit/PatchedTemp/BotKiller.dll.dll .ps1 25KB
-
LibSploit/PatchedTemp/BotSpeaker.dll.dll 14KB
-
LibSploit/PatchedTemp/BouncyCastle.Crypto.dll.dll 2.6MB
-
LibSploit/PatchedTemp/Camera.dll.dll 94KB
-
LibSploit/PatchedTemp/Chat.dll.dll 43KB
-
LibSploit/PatchedTemp/Client.exe.exe 43KB
-
LibSploit/PatchedTemp/Clipboard.dll.dll 13KB
-
LibSploit/PatchedTemp/Clipper.dll.dll 15KB
-
LibSploit/PatchedTemp/DDos.dll.dll 106KB
-
LibSploit/PatchedTemp/Desktop.dll.dll 696KB
-
LibSploit/PatchedTemp/DeviceManager.dll.dll 14KB
-
LibSploit/PatchedTemp/Explorer.dll.dll 487KB
-
LibSploit/PatchedTemp/FileSearcher.dll.dll 15KB
-
LibSploit/PatchedTemp/Fun.dll.dll 46KB
-
LibSploit/PatchedTemp/HVNC.dll.dll 37KB
-
LibSploit/PatchedTemp/HostsFile.dll.dll 13KB
-
LibSploit/PatchedTemp/Injector.dll.dll 50KB
-
LibSploit/PatchedTemp/KeyLogger.dll.dll 17KB
-
LibSploit/PatchedTemp/KeyLoggerPanel.dll.dll 13KB
-
LibSploit/PatchedTemp/KeyLoggerRemover.dll.dll 6KB
-
LibSploit/PatchedTemp/Map.dll.dll 13KB
-
LibSploit/PatchedTemp/Microphone.dll.dll 485KB
-
LibSploit/PatchedTemp/MinerEtc.dll.dll 23KB
-
LibSploit/PatchedTemp/MinerRigel.dll.dll 20KB
-
LibSploit/PatchedTemp/MinerXMR.dll.dll 25KB
-
LibSploit/PatchedTemp/Netstat.dll.dll 18KB
-
LibSploit/PatchedTemp/Notepad.dll.dll 13KB
-
LibSploit/PatchedTemp/Performance.dll.dll 15KB
-
LibSploit/PatchedTemp/Process.dll.dll 16KB
-
LibSploit/PatchedTemp/Programs.dll.dll 16KB
-
LibSploit/PatchedTemp/Regedit.dll.dll 31KB
-
LibSploit/PatchedTemp/ReportWindow.dll.dll 13KB
-
LibSploit/PatchedTemp/ReverseProxy.dll.dll 15KB
-
LibSploit/PatchedTemp/ReverseProxyR.dll.dll 15KB
-
LibSploit/PatchedTemp/SendFile.dll.dll 24KB
-
LibSploit/PatchedTemp/Service.dll.dll 14KB
-
LibSploit/PatchedTemp/Shell.dll.dll 16KB
-
LibSploit/PatchedTemp/Stealer.dll.dll 132KB
-
LibSploit/PatchedTemp/Stealer1.dll.dll 140KB
-
LibSploit/PatchedTemp/StealthSaver.dll.dll 221KB
-
LibSploit/PatchedTemp/SysPlug.dll.dll 13KB
-
LibSploit/PatchedTemp/SystemSound.dll.dll 483KB
-
LibSploit/PatchedTemp/UAC.dll.dll 23KB
-
LibSploit/PatchedTemp/Volume.dll.dll 479KB
-
LibSploit/PatchedTemp/Window.dll.dll 16KB
-
LibSploit/PatchedTemp/Worm.dll.dll 2.9MB
-
LibSploit/PatchedTemp/dnlib.dll.dll 1.1MB
-
LibSploit/Plugins/Action.dll.dll .ps1 27KB
-
LibSploit/Plugins/AntiProcess.dll.dll 10KB
-
LibSploit/Plugins/AutoRun.dll.dll 331KB
-
LibSploit/Plugins/BotKiller.dll.dll .ps1 25KB
-
LibSploit/Plugins/BotSpeaker.dll.dll 14KB
-
LibSploit/Plugins/Camera.dll.dll 94KB
-
LibSploit/Plugins/Chat.dll.dll 43KB
-
LibSploit/Plugins/Clipboard.dll.dll 13KB
-
LibSploit/Plugins/Clipper.dll.dll 15KB
-
LibSploit/Plugins/DDos.dll.dll 106KB
-
LibSploit/Plugins/Desktop.dll.dll 696KB
-
LibSploit/Plugins/DeviceManager.dll.dll 14KB
-
LibSploit/Plugins/Explorer.dll.dll 487KB
-
LibSploit/Plugins/FileSearcher.dll.dll 15KB
-
LibSploit/Plugins/Fun.dll.dll 46KB
-
LibSploit/Plugins/HVNC.dll.dll 37KB
-
LibSploit/Plugins/HostsFile.dll.dll 13KB
-
LibSploit/Plugins/Injector.dll.dll 50KB
-
LibSploit/Plugins/KeyLogger.dll.dll 17KB
-
LibSploit/Plugins/KeyLoggerPanel.dll.dll 13KB
-
LibSploit/Plugins/KeyLoggerRemover.dll.dll 6KB
-
LibSploit/Plugins/Map.dll.dll 13KB
-
LibSploit/Plugins/Microphone.dll.dll 485KB
-
LibSploit/Plugins/MinerEtc.dll.dll 23KB
-
LibSploit/Plugins/MinerRigel.dll.dll 20KB
-
LibSploit/Plugins/MinerXMR.dll.dll 25KB
-
LibSploit/Plugins/Netstat.dll.dll 18KB
-
LibSploit/Plugins/Notepad.dll.dll 13KB
-
LibSploit/Plugins/Performance.dll.dll 15KB
-
LibSploit/Plugins/Process.dll.dll 16KB
-
LibSploit/Plugins/Programs.dll.dll 16KB
-
LibSploit/Plugins/Regedit.dll.dll 31KB
-
LibSploit/Plugins/ReportWindow.dll.dll 13KB
-
LibSploit/Plugins/ReverseProxy.dll.dll 15KB
-
LibSploit/Plugins/ReverseProxyR.dll.dll 15KB
-
LibSploit/Plugins/SendFile.dll.dll 23KB
-
LibSploit/Plugins/Service.dll.dll 14KB
-
LibSploit/Plugins/Shell.dll.dll 15KB
-
LibSploit/Plugins/Stealer.dll.dll 132KB
-
LibSploit/Plugins/Stealer1.dll.dll 140KB
-
LibSploit/Plugins/StealthSaver.dll.dll 221KB
-
LibSploit/Plugins/SysPlug.dll.dll 13KB
-
LibSploit/Plugins/SystemSound.dll.dll 483KB
-
LibSploit/Plugins/UAC.dll.dll 23KB
-
LibSploit/Plugins/Volume.dll.dll 479KB
-
LibSploit/Plugins/Window.dll.dll 16KB
-
LibSploit/Plugins/Worm.dll.dll 2.9MB
-
LibSploit/dnlib.dll.dll 1.1MB
LibSploit/LiberiumUltimateExploitPro.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0f7fbb6808ba80d2c789804d4f41a3edc3df048960c4791659fae0a13f9ec7c9
- MD5 e52de9f5e5ca4a1d8e318fafb21fa3ec
- SHA1 68c48fe3bca3b345c5030c20f1721660fa564cc4
- SHA512 5aad2ed27430f5281e564ed5dcfd759669acbfc0eed606a0015982220d0703944daffbece29240a8b376002a98b692b872df532d8d89ba74ad3f28a7e4d44270
- SSDEEP 768:hcC7WP5hL2QdNQ2nng6eWES2fHmNqEGyyhBSpG2C5LjsMLp+DGfm+2TcRLkOC/cu:hcC2nuNm/GybG2C5Ljswp+VhOBu
- TLSH T1F9332A46A7DB6119C9BD42B508F782C613F5F7072B33C74E2E8B24BE6E527A12350B91
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
59422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/LiberiumUltimateExploitPro.exe.config
- SHA256 ad8267122c40d37dcd9d99e1412d763187a1825732f378db8867f3ecf675cf70
- MD5 21fa0b1d75c0cc7369f1e735fe90c7a9
- SHA1 e2d01a1b6aa66e5d3ed575aca79560b014bbfefe
- SHA512 60f6704cd1b3035a1a3403ee3870c7cbc13d6e601172745336ebbffa2ee3dc21785702470ab006c69dbbde0d5525625bb25ade5c641c80c8165fbc46fdad2ad0
- TLSH T1D8C080154098BD274D334F176351C525EBB072526464040CF42F9657073104D4247326
- MD5 SHA1 SHA512 TLSH
LibSploit/LiberiumUltimateExploitPro_1.0.0.0.nrmap
- SHA256 66fbf3c9890ac7ce8dae6f5e56eaa376b01a60ef1692ae97aa2f4f84530079a3
- MD5 360651c0d62f148dcbd222969747c873
- SHA1 9026208ee6d67a0b54bca1c3eb62aada9cc0d287
- SHA512 c4db4d7d1286d0ee4cbdc7d9d471d838c82352c462485c36f87c2b93dba51efd413b3a9c778651d4b7c3776125f3ee2f69fc9a7ecaf793dcae27a5ce6e5b7d0d
- SSDEEP 192:DWHh7NPwRb2I1FZuITkUBk8oN7Xm2GNANNW:ah7GzZ2XmCq
- TLSH T16B42A5D852BE7DF6EC1A1A252A85586AAFE8D547A125C03CF5174C1FCA2068533FB3F0
- MD5 SHA1 SHA512 SSDEEP TLSH
LibSploit/Panel/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b474be40249aab5de303b3052c52a1349a06e27e8e54f956085465ce140d2bac
- MD5 3e02a7007f6abc85bb077a955b32b308
- SHA1 0567f20d06efab8f228d2a9f5ec706d9a38e5d24
- SHA512 cde8ed77552afac2489fc301454902b827dac98f0c2f82ad392a8559c454f868a7a65d0f5f8d80605e776bf28b8176cb5cf4e49457100a34867017ead41d555e
- SSDEEP 49152:a8X5gU7N2D0wtc8/ZiM3nxiwhra7HKaGzHIkMNKs6wc2iaoxcglc:a8X5gzDL/ZlXxiS/rxc4c
- TLSH T1F6E57C197BF81F23D16AD772D4F00042A3F2F82EB363DB5B2981A27A5C57B405D416AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3288142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BouncyCastle.Crypto.pdb
mscoree
_CorDllMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Panel/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 793480a061cb2af067bf9697649b8e5d0c9d1d58def4e0979feb39490fb47826
- MD5 d605020e1805c860e6b3c059baec938d
- SHA1 17998293f75054f9e2e12a863290e4b4283c0b61
- SHA512 d51a6cdb6caf66e139f424b6d55f1a683b440eda8c77b5e9a67ccac537cb74b16f120599eaefedb4eba12b52440c458d98d45c4470f181803695fda50a259a15
- SSDEEP 768:D7xBmd93XBHhlMywCyloyvc2vN2bdaQ1Z8rnj0Obd66wSEfgy4R:D7xBmTXBHhlMywCyll02vN2bdJ1ijwO3
- TLSH T17613D5407BC88A35E7AE4BF8A672521C4272E3636913D70D1CDB05D92532BD5EA01EFE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Panel/EncryptPassword.bin
- SHA256 1b35a7c3e50bcf979fa01625011836f86d6a96b121c877d4ec786928c5ea6baa
- MD5 c846ce1701c77e44a8651dda8de5e946
- SHA1 d880bda61362f91b1a252a16468c3a0c9d50f0e2
- SHA512 7485f6c5e62ca513a6ee448b33a33c955d309911c7e2980c02c5b174d4f681715266074331a4a48fa43dd380b9b6e22782e5cd48aeb6b180f7a715262d5d9ea3
- TLSH T1E0A0127686304809C110007010045116889E820409CA004492921301150C552149B4A1
- MD5 SHA1 SHA512 TLSH
LibSploit/Panel/MasterKey.bin
- SHA256 6315e5740bf9386a2c9c752541d0c3bf9a898d6046e7db028a4c6503270914cd
- MD5 e461db55765b040c11df241188aa23da
- SHA1 52bbb7b4ce0e02c53226b052fee9e12080b34084
- SHA512 1dea46cec3f8e868744ea3eb4f75fd91cde702ac29f87715b688840c319fcb18224e18897d754c26b9527b8f3608d5f32ad9011884e621bb3f010cc0fd242d18
- MD5 SHA1 SHA512
LibSploit/Panel/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f2c1f407811acfd1e926e61d6b71195b2f1c5aa54e59c2a43e6bb63c4e01a1d1
- MD5 fb5ecef1d457e3c5755f15988db493b2
- SHA1 eae333a1e2755155e7b7bc9e6e90706384dc5614
- SHA512 f50268facf89c751fc2f0ff766b4113672c6133d7e6dac670c69bd9df883323376b3962771b1ff041e4689b8eb16c5dd0b4c204026fc4d68f7e7908def3c4d0b
- SSDEEP 24576:kVXy+xgfrjQPiV2X03v7fww8CHvN3GygvHNfU:kVC+0r9t
- TLSH T161455A1237EC9B77C4AE477AE43116580BF0E80A676BDB4F6A58F36A6C437409D113A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1177550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Action.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2457360684ee121c193dd7d40159bf4dbbc8e04b3aaa60bf5662b1724147d111
- MD5 11e47ca0a30c1da351f79c8231f0195b
- SHA1 1b0632d8a57748c8e5838e8238eae7d1aea6f15a
- SHA512 22e213776cc2013c4b1ff17aca62c2e663cf87c75eb2bb1bba7ef2dcd0372c2c7798591a1d759c19aa5ea0c9383eae0f1b2c64e3d626d35add0725deef9ece1d
- SSDEEP 768:uIIyYkFY/dEMKix0thSCBsFY/dEMKix0GQYB/8p3bk4TsHuH8tjOp:bIyY8BUtbpTuuHDp
- TLSH T1DCC2F804F7D82A34D2BF47758DB11A14EE7AA146EC72C90D39CC40982B727998B61FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/AntiProcess.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 772c9c26181af9ca953cffab8f049b0b5b5a37071156bc7bc7206d7c30adf7c5
- MD5 ae95b2c228a9e7b3e88015c86e8f77c9
- SHA1 13b58677741b55a1deafbd9ed4c2e1419d1bc540
- SHA512 16d39e7e134a9076a53b50ee11b82c4d54bb57d6a90fdc7b32b52a6fb6612b7809e696466532467cfb8080792b5fdded7fa8478ee42e0df4fceda005bd4746c2
- SSDEEP 192:Gf6SGGKzmRlcJN/jB50Hk68bTygXAF+cPKjVIS2aTt:GF3cJduk68bTDwF+cPKjVB2aTt
- TLSH T18022EA00D3E88610DABD473D6973970A4A34F1049C13CB5F29D847F67C517FA56D26AD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/AutoRun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c56eaed7ba689488f402f15a77fbc1e82a46bd8fa7ce16a700d09b6b0cfa74d8
- MD5 e5097fe2534952eec15cd7c5271f5588
- SHA1 1eb492f91f8fc48fb63ad467b793df1f33f08c53
- SHA512 d42bb4f5487f56cb7ab208ba7bc6693545af745408e79ec7ee1a9ca7dde26bf2175f45075e56fa3a3a9515ace5ed62952f7bafbd3e9e6e70b2069dfec0af7911
- SSDEEP 3072:JWO+X/4Y9eKEkHfTpjZ4J9t0SIjRAerO9/3n7OSUrwi920aYW9Ba+bQaKxwd8jed:4OWEkHLpjZ4JIi37NULlaba+bQZ
- TLSH T167743A1523FCC627F6FF27B8F4B250104BB8E40AE56ADB4E4D84A5D86863704A5523BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
345374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
329KB
Virtual Size
329KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/BotKiller.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2702a9b1b8db0be6923411c49c4e33641fbeb434f5336060b8676f3a09773cde
- MD5 89a0eb919065d47293aabec862da29ba
- SHA1 8d552f936c43a5cb4c9d132968ddfd4efa04c5e0
- SHA512 aad085e53376843ca5e7bb713fbbe2fc895a8b19e4709c7cd526ef599fa2ae294c0ecf97634cfa9d2ad04beda02cb0fbe23fdc9c833990efc8474d7c045f1e9d
- SSDEEP 768:AKfhsJovFY/dEMKix0GMMgnNyw9WbJ4uDCZ+RLjO:VfhsJohNubJ4uDy
- TLSH T1BBC2A611B3DD6230D7BF4F366831661086B5B4269C22CE8D3ACD92890B36760E671FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/BotSpeaker.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e6d4603b254d3c8c01c8ca32ab919d9f6ab8f1bcfae10c65d63fac292677d375
- MD5 2d3e49ec7ef387d54bcb8eab62187415
- SHA1 639b0b67787020051815d032c9ba1161807118ff
- SHA512 fc0ff3aeb279684fe2507e34e2712dea17d7b2aea8f735e88882cfd357e07225f0535fc96cf8e3645d9e9a1f595c82ec45caf158e42797db563ba21812f27313
- SSDEEP 384:IJ8WObHDe/6BM7GHlZpE19NCmBM0bi+D9l/y4Fp6qjV8HIERL:ISBXpRmHbfntfjSHIE
- TLSH T18952EA0463E48B31E6F946BE58A397844330E7016C43CB0F3DD895E96C53BBE6B517AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4e96822024623d1af6373cd9b99c3ad6f2f032cfff1eb5407399dbbc859f45bf
- MD5 4ddfc7d10eb27b55c7bf36bc5b9bd1f6
- SHA1 9aba749b082c2cb6010d4e9a69cb21b2751b98b5
- SHA512 1b7221fd4e5aad81c3cc09ace3b8d6a479281565bac88a4f018d360ccdf11b3a8053a444e44cc1b35e300c637625b2030422f38be140b18ac62824c029c9f941
- SSDEEP 49152:68Xrm7N2D0wtc8/ZiEqlxNjQEhra7iKaGzHIkMNKI6w:68XrJDL/Zx0xNjb
- TLSH T153C55A197BF81F23D16AD7B2D4F00042A3F2F82EB363DB5B2981A2765C57B405D416AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2731438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Camera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e3f7add6f43fb47f21bccfb3088a65ae6cbbabb9d6a8e029150f5f63c882ff92
- MD5 b187464ba2a5d8710182a33768286c5a
- SHA1 53b69b8a35407fee44cde5d653a867e6a0ffed5d
- SHA512 d990741af3d596b45a8e3126793cce034af2f391ce3a757e09eb6c2a73126876c486599a44eba1bfe9b80cca9e83ba097147cd4b4edc649dc9de13e599ad9ca1
- SSDEEP 1536:izK5Tq8IKK7UrqH9AyXHxyvJ7hbV7iPUB+a0u6XMRf23FzWPOa98beQSkrNJzY0:izK5q8IKK7UrqH9AyXHxyvJlH+w2VKPS
- TLSH T10E935C1127A8C927D1BE47F8A0734B449B319206E117E7DF1EA454EC7C63B528E632EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22a5f61bf440e4128e63da45bada825a99104c97ea0148db796278daa7e28925
- MD5 b66d6221309eac7db57eed9c0734e5cc
- SHA1 d2df16629311b518bb92b3df77b7f7458138498b
- SHA512 6d4d72081b461e45ddd1c19d058ff848516aa23f4c737e010a4f5419c82bc0e132f1ba78b7433b4baab5e1ec3282b774409f1e85153e8f47505d05ea5af52a53
- SSDEEP 768:k+vKUUMJviAItCmt1mHXnNucgU+0IhTPbFbqacBabaGaZ5AURjra:k+vKUUMJqPa3nngU+0IVPbhqaBbaAU5a
- TLSH T111132900B36CC92BE6EF0AFEA41056A403B5D3627883DBDA1DD464EC19D3BD556212EF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1115ed9b00cd8f91464c757054a6e382810efa258b449d96195cb9f8f451ec54
- MD5 4664e61fbea05dc6101d1dcbf29f981d
- SHA1 5c5c2927e3ffe63f348ae1f031726b8762e415e4
- SHA512 ff9b2d172f781bb8663b98860a5f68cbd52a9fa560fc4feed48ca44485ee98f5efd0b7fcda023b9a8fd64d20c1eb6b78cdd7c55f6cecb4ad51fda087c1414d30
- SSDEEP 768:Dixzhko1L3pZAUF4rYbSyv02v32YdaQ1Z8rnj0Obd66wvEfqy4N:DixzLpZAUF4rYb7c2v32YdJ1ijwObod9
- TLSH T17513D4407BC88A35E3BE4BB8A572521C4272E3636913D70D1CDB05D92532BD5EA02EFE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f73a743fe5d169226ea5a0bd0b4b6540380986c44be438e417fb062348e78c82
- MD5 8d9771f206d988de793702dd27842cc2
- SHA1 0ab4ffe0e9c190570fbe1ea52d7ff96fd5bf9a89
- SHA512 b251cbf940db31e38e154ad54e2a0d923c2f6007ff696e8f10bd98c0b4760df6c4eb581c34c759fe73c296d02f7b5171f5c8f1baade7f2dc55a67b159f958705
- SSDEEP 384:qNOEAk3GksmpCZhlYmBWbRaDEOCFF6qjVJA:wUk3Gksm03lYm8bWPCbjbA
- TLSH T17652D90463A58632DEFA43B7696397488370E2019D03CF0F3DD8A0D5AC47BAD7A257AD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Clipper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 548abc91d8d83b541e13f2415066751b74d54d87580604c1931dc79b64942a63
- MD5 411504d37226aea52a142cc29ac28baa
- SHA1 a25c64ee59fbd7ee9af2df7858c428fbfc24416e
- SHA512 2dec14934b04c612ecc739a10279ab194dc70207faca49c8f1c06487757bbe959a6f741e6b9a9468cc947250f6d8c404e826abb2d59215825c0172b0200ca63f
- SSDEEP 384:UO+We6MOo5uiSqmBrbFaDtfhCxFPaCjVJ8q:UkeJOo5xSqmBbyJhCxhj78q
- TLSH T1A7620904A7D48632D7FF17B694B3A3484330F7018C43CF1F2DE465D96962BADA75069A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/DDos.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0f6159d812da58484b11fa2fcc9e639f6bdea21b8281235dbc7c810d4185c6c8
- MD5 f6bdad4f11ec34c8bc512880d64dc09a
- SHA1 d595c22b120b11162014c18ae29efd3b4c2aad91
- SHA512 74e8fa88e2fa753d8d6a38e443c9a7ce4960fc50628c0f4e75fa0891ca813ecc0df7c085a12550df47cc38e96b03de1a4a397a6d51656b4caf319cc84a96c65d
- SSDEEP 3072:4QhLM2KXKZi6xb+7jd35qlWj/RxfZwryN:BLM5Cb
- TLSH T1DBB3941473F04328F2F7177DF8F95616AA76F642FD32CB9E2965021E0862B448942F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
115102
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Desktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e99959000919a40dce1999242fbcc7fa365cc209e40025e0dc6f39d71ad06d91
- MD5 72c7b681f192b264800ad40bbf8588b4
- SHA1 9a90ec6bd778eda6c8c6d9bf6535615ee162198a
- SHA512 b82b94ac141e2ebf1e78566c2f43532c9dbcf8f53000e159a979a1788893fc487448d41fdee4e88d4e63aa444b3436fa30d8a3ec2df5db72d0eb78c3232fd62c
- SSDEEP 6144:TzES5DdJeWlNgDib1ahIZNs4z8pjac43jB0ZnmcTyO3EyTFhbZV6i+h6CUYxokHu:TlRVlO41ZNs4z+jzSAmOy6Tn634gxY
- TLSH T110E42852EF6C9F22EA0F3ABDB411791311B392411701A547A886E0F91FDD389CB1A7DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
718750
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
694KB
Virtual Size
693KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/DeviceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5a01fbedf7022c952e363faed3ed1a2eba77c38b18790974c30d850214e7df64
- MD5 ef0ce42438fd5907d40207dcca025034
- SHA1 b56fb0a649e5613968dbe012e0a989dcf69f5528
- SHA512 389f70cd3c00adee644be08a3d933768b319c9561d4d8195177acf75ff4a98a9811039b4398c414d8e5568e88ba1d83902e5ebd22dfa2e880edde4440edcbeab
- SSDEEP 384:0IwvokI9/IGAIcmBj8b4+DEJHFK6qjVQtD:0IJwNmZ8bFOH6jCtD
- TLSH T1CA62B60467E59B31D6FE83BB9CB357044231E6419C43CB0E2DDCD1F56C16BAD6A212EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Explorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 18c4662c9b52c3eb9f1fb9d1fcee79ba848b55441880ff2c80d41f43e68a5535
- MD5 b6fbdd59e1dd65aa39ae98869aaffa53
- SHA1 65826dc56e9b255ba10bb2c5fa733b58dba7e139
- SHA512 827cd1651a4e04d8a1bd59f4cf13fe23550915327dcac55f10dcd1ef42439628db9cb1f103b496fa0d904ecdf1da723ef652d3abf7552a1822106449ec7dcd1f
- SSDEEP 6144:gNxD5PKrveMBl3GeG3HGtSV41OJDsTDDVUMle6ZjxLV/4x2ICsbCtOeZ05:gNp5ySwDAmS4msNUCe65f4x2ICu2
- TLSH T174B49D4123E8CA57F2BE5775E4F381608770B017B93EDB8F6D8064EE291A340A9157BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
504798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
485KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e8257b5229a2c12a477ba67b0462aa23dd093f59c757c867790e632bef1b525
- MD5 fa5aa9906afb134e45c5e553804b981e
- SHA1 51c79cdc5c2c984f2f75a29894c39b1b04b1c77a
- SHA512 2c24970afdbc1b36af35ce1ef7ab908a0fe74f6cc1f8f6c51e07c754f054bc80404d5397fb4900379aaf8fcbe6a5773e269c5c387de7373e2dc31291d711796d
- SSDEEP 384:2cd+hty8YUqNnVCBo2nmjmBabhHDnFIYFuxxuzmjVYnt6Xm:2cEPYUqvugmobpFpINjWt6Xm
- TLSH T1FB62E80823D59631DAFE03BBA8A357048638E101DC53CF1E6DE859E4AD13BAD26517EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 262345b854cf223a10e8bd1182acf39c8132678cf17a8cee687d308661dee966
- MD5 ba62df3a90e54102ce3bf4572bea4568
- SHA1 736b9dfa7d99ade5fe6f668a3bb536fb5741b432
- SHA512 9f171a545d8fdbb9bbd124e42e13ee3d90d52fcbf1275fb8b1737b1b1c3ba079decc7e1d0a8210997291083de965a39a0e3e9790e76ad4f2e0f9191fd2433a4e
- SSDEEP 768:/Ji6alsCGi0S4+zEeCqo2lt5q5Lb7AZRoJjXlXYsjzESP:Bmy2Ee62lt5qlb7Are9YgP
- TLSH T195234B0733E58262C6BD06B5E0B34344C236F24BA412D74E3DC955EB9D72BC996A4BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b200777ae24dbef873f0d4b4c6e22341f39ddf481777c8732f5fafe8c2a857b8
- MD5 ef53065ddf4d341289f338e486057a3a
- SHA1 5561e06629aea5d1c1c0009847b7e57d46beaf5a
- SHA512 1ad4a934f636bf73ad789a57a9b4117f24b85b7513fc85b730d978f4ffd9a4c8471b94743c58ac0cbfa2062e0d1b3aa92a2e1b3cb798f9b354a5f86a0899e9ae
- SSDEEP 768:a6Vk1FTSUcYj9YkJ1EBOI6JEPyi+b05y1/o6NBjX:alF9Y+1/JEEbuk57
- TLSH T129031945ABE68220E7FE0779F4B347548634F1831842EF0E2DC861E4A66BBD49514BEF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/HostsFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 14e9e7cd7c7c119acf5b69c6e5ed40047f52a49eb563ed7607f9980fc80173ab
- MD5 3d6d89642e092292180cbac97e0ce6e1
- SHA1 d89432c060cc07382d2ae3946edffcb7105e48f7
- SHA512 3a4426bf127342d858b48d860e47cab984118b52e18463e31d35fcb1370b90c1b5b7c57182a8339900caa99e348e588bb58675d1b84a84c471581245084b2f98
- SSDEEP 384:VBKJZ9HYmxBxvnWqmBlmbR+DEQOXeFS6qjVtl:yJPYmNn1mub6QuajDl
- TLSH T12052C70867E45A31C6FE4ABB58A397944274E6018803CF1E3DD891D5BC12FBE76217EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Injector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6ed638058f4242fc022abfdd1432e1923627dcc8ee97e40703583cca97545e2e
- MD5 29ffb9b3fa77db4fecf5bcfdccfb2e2a
- SHA1 3d0cf192b814f7a0db9a82d867420fac4a51cb15
- SHA512 2e09a94abb11422d3d1a917b3cb8a00ba4bb757f5851efe152a3b690d435f136b77cf76999eadb0501af578a0ece810cd1efa6d3f0fb40548bbdd60f662d6624
- SSDEEP 768:DMo7GvsEsp4bc7+2dMLaIEZyjL7PIHADRDl/BYqbeKx5U1bRJPj3K:Dj4nsycq2yWvYAHAdDlyytvKbRpK
- TLSH T11B3339647384CA23CBEA477A84B71F0843B462558E52CF3F1DC4B4966E13A968763F92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/KeyLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8c1918de2b3f9a35d0069822c5fd187e3bb73d76ff14afd8bf750540784bf9d
- MD5 04bac72721373267cfab4d7ba75d1102
- SHA1 5ecfad5c1154bdb6db4656a7efbb7c48f98bce4a
- SHA512 d87a6d5314cbe19f8d8065be64c8261ecfde3370f9a75ce2fbeda56726405516b37108b6b8628f7c5c7c52514f8f56bd37fb319cc7d43f7d2b498f0cebffeb4e
- SSDEEP 384:uQWT505u92CwlSLX3G+BQbEbo//gY3UFF/6ajV0JB:u+BALG+qbJAYkfHjqJB
- TLSH T1B9820809A3E84B35D6FA067A59B3571587B0E3005C43CB2F2CD416F6299BBF653212EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/KeyLoggerPanel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2a5dc97b3f778b5188f5bd19887f621e6526a6bf0e98da94aa1cf682eda716ac
- MD5 a10b9a5a4ae971d152dd1f389e85a7b7
- SHA1 40e0751e5a1f87b3b8bd2b84c3726d15b1bcf663
- SHA512 a2975a5dd201cca0996c5abb42f710f9f0bb3ef868f56d32a1bf36675a5719ea27aa525d3160a5f1a4ef8f7275caa069b46653969bfee44c4de39d292fdd3393
- SSDEEP 384:6ciFQxlH/vVDBsomBkbi+DV2Cj5F06qjVKzj:biQxlHXVd9mObf0Cj5MjUzj
- TLSH T1D652C804A3E49A31DAFE17BBA87357444374E201D843CB0F3DDC92E67C12B6E66616DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/KeyLoggerRemover.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e393da61fd5eb93a9ce2c913c08ba0fed4c14f1ad4101902c3fc56ea29f69c48
- MD5 b5ce8935a42d83b84e4f4be42c15ed41
- SHA1 431aad4f90a9c3b69942bef5480565588586b3b2
- SHA512 474d498d7cad1a0465a2f507bd659346a2a91627dfeb2480be214d8de6d708e3e1c9ac32867848c01ad5a8f3a7c6004ebd8ad353cf6522bbe2fd9fb8edcf67d6
- SSDEEP 96:OWl8oXGxkO5u0H7H/6BJ3DZ3oFyBFPdHKgMaO3kKjVILrKw:O6+1u0bH/gRTF1MapKjVIa
- TLSH T1EAC16310B7E89632EDB74B36ACB213410679FA64DC33CE6F98E0424F6C166158A71F76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Map.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 39f1cfe6a1f927edd564665ccd41c6ff205436104c15b60e052b2a96e4bde416
- MD5 76e1afd6b89c801713e796eb1aa60384
- SHA1 6cc259f29a0ccb760551387d11331fc091c1c682
- SHA512 550a3fbac3bb8c18592b1efce59dae6fcb0a46a8af78758e8367902f1a767a7004d823ab8880d4120f12c8830bc8d36b1abf766b436d07628978787d7d45bef1
- SSDEEP 384:Dkexv8mXSYABh5AUdmB4b68+tzyFxq6qjVUsQb:8YABh5AUdmybE1y0jfQb
- TLSH T17652D80463D59772D6FA077BD8A357444274E2069803DF1E3CE881E4BC12BBD67217EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 08b954af7295bc136a4f637ac506111b0e70e9a18064d66a4bf75b298e089e59
- MD5 8356f11073c672c005919b31579cc2f6
- SHA1 60c599c5293496d7b0e48986eb5118d3db231ea8
- SHA512 071fbe0abd909d82cf80f38e3bb17fa9c322575bd5cf3bd818450059c1b0c27fdca7c29ef757c1160f944ccd896c0ae6970e7e8250ecd20d7c0da596a4704589
- SSDEEP 12288:/tZtJ7AQMbiYM8pHGBSelQLSJrAgK3FyDvAyMX:lZtv4iYMOuSz7FyDvZMX
- TLSH T1EEB45A0137E09957E0BF2776E4F1091787F3E0467263EB4B1A9496A92D83B869C01BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
502766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
483KB
Virtual Size
482KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/MinerEtc.dll
- SHA256 b26d2d8e80a144777f96593aea59f38f76c7090564b56491c29be943d14ee4d8
- MD5 d0a8a4ee835f6c78160ca09325d602b6
- SHA1 d4e0d4247d41521a84aad1b0f83a82c7c3f6cbbd
- SHA512 ef608d7c6d41a321e161b88e8ece5c16e00ce9d525dd81a567295ba9763479d91b86ed30cdaf1bee88cecf3c01093ed8b70c7a256fda698c2d925bbbf221270e
- SSDEEP 384:5Dt55zXJfTmvqyFo79YKlx0lOMhr2bn0ubcMvq/SLPLStLaFVDB65FzD94yaujVl:ppzpTmvqkQfr0lOM12oubnqsLeujFEj3
- TLSH T17BB22942B7D88631E6FC57B658B357088770E5158C03EB1E1DD8B1E92C2AFE996007EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LibSploit/PatchedTemp/MinerRigel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bb3dd10b4251c445830107b013a9d255265262b4c74d8c7436f233baad6711d8
- MD5 0b5f48c9493b9de8a481800055f11ed1
- SHA1 790ef144510f48cdd33f3e357727d02e0b6bda6f
- SHA512 64a648581aaa1557c16036d4134ca5914807756223afa6203c0ba765bb7019e5bc02e9606816ee460ab2ad048053679282c63a2d900408f6fbee61093bc82822
- SSDEEP 384:ABA1QLlvdDLV8shOqqAbydmbLqvqoSAYIKLaFNncHDB5t4UayjVbLs6hmRB:ABA1MvlLV8NAb1b6q/RuuGqjO6hw
- TLSH T168922A0A6BE55530EBFD0BBA98B347484670F6035C03DF0F2CD861E86816FA996117FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/MinerXMR.dll
- SHA256 98bd206bc83de11644b1fc78b30dbe08ea541bbbb74570a6cbca0e0d901d5f01
- MD5 c32b8e32d70c085e4432b43554c3c551
- SHA1 87ef10c06313f4779315d340b422f565166aa6d5
- SHA512 9b39070772ace1a5a9941f2ea9a3d0be77bb4397a6ab19df1b49fbf37c2af66c178bc8638c27adf7e2523ea38e41e3c90367c613225c7422183a663b47ac9c9a
- SSDEEP 384:R/vCgXJYjuXKJgcko3VxyQVFh/nZubcMvq/SsPLhKLaFVDBi5tDJ4yaujVZgaH/N:RCg6jeaXiABubnqfLwujhEjPgUN
- TLSH T1AAB229467BD94735E2FD43B6A8B357098730E6078C03EB0F1DD4A0E95E29BD899106FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LibSploit/PatchedTemp/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4912c8e1f295a689f95c781919a15508209039e8ec25b9f4ee1b30b0278d59a7
- MD5 c3741104cc285360e00b3b3290acb41d
- SHA1 e5f34fca980f31dcf619fab8530e8b518822190a
- SHA512 81fb078f97e6b0d11cefb3c56be0921de335839c6381c3955f933fa2af61c1b73adbe893707dd70e44717c6bb0f6a154f598afcf5a8420c07605d82c15e8a01c
- SSDEEP 384:QvDVNbQfDM8OFZcyt/uXC/JBvBTb9ZDwx44XWFIfaCjVrv:Qv3Q7oZc+/K+JBvJbPU5WC/jNv
- TLSH T16482F90457D99530D7FE46FAB6E3130A4374E2425C53DF0E29C860E97D22BF8AA117DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Notepad.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 60881c6180fa887e0a7382ef56df5e91bcca2b80d83a2a5778ebc367db46d3fd
- MD5 c5227a22d7c54a46485d8f6b89617287
- SHA1 abf96ae3666a68c3a6ab32254345264296c2ae57
- SHA512 aa020134224c09c8b182c3aa58c4dd04009bdf060be2d4d275342eab336b94f6b2058b1a64c9608b7fd652bcc4c78bbdef5529acbef8a6cc7e4a346c225c96a8
- SSDEEP 384:EiOOC2xrzq4QPdLkMFzm1fJs6/6KpTYegmBnb6+DHTeFdO6qjVag:trzq4ydLzo6ecDmlbnzeP0jAg
- TLSH T10552F90CA3E58632D6BA47BBA86357444238F7015C07CF0E2ED885E5BC52BBD7A217E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 069d55232704aeee9f7515e1061fca5a333e088f2b1cc414e621ca744b87b398
- MD5 b4d416e71196a181c17d3dc2f1e1b4f4
- SHA1 94581f3cf34be581c79affd7be2f5a03ee28f388
- SHA512 cdd251310c021a9f5f7a0fcff71bbc643d7c34dcf09bfb167a753b7e33378f4f1e33c9e79fe1778c8e0a0682e129fd9ffc091fd15f4816a942d5ecdc6770080c
- SSDEEP 384:id3Z5FO7YXWLUkZ4r4p/jzBRbdUD9N8YVpxFo7JuzmjVb9Hf3:idjWpary/jzDbIn82cjLH/
- TLSH T13062F704A3F58930E2FE4BBB597307054674A301DC53DF1E2DE451F4A857BAAAA12399
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Process.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59ecaf0383356388bbe574102c06e9f8a421fdaced51113351ae5ac08a58a63d
- MD5 5cf781dd40007ff018e07d07ed0cfb39
- SHA1 4165b5b32e6ea61c73e070e8cb8a005c8dcf9e5e
- SHA512 04ba2100beca52d90d4f98798a0455bd928b19e566bdd04f0ff7299e850d0e190b7e102f3dc3c2f8eb56015ae1ed3ea5299ad56c13c5e9b3a159946840933608
- SSDEEP 384:gFw7aJS5vZWgPTBadbB9rDqUOpdG0X6FkaCjVR5/n:gFwOY5xTIdbftz4jzB
- TLSH T1C572F70997D88A31D6FE06B5A52317159A72F3014E03DB0F6CD860E66D437F8A631AEE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 021725be59041329c27f2b7a3f67efeda1b8fa1f9f3732685e17ee2a93277a7c
- MD5 937849c616cea0610badbd1d54e2a60d
- SHA1 1c75e975986dfedf8eadfb86f620cb60c92dc6af
- SHA512 27efd0a920af498374839ab6cb6f3783326e331906efcdcedb4aa9bac8dd50c2201d4eaa1b14a61f2c2069631fe383f9dd76c5ed9327171adf97ea842e96d660
- SSDEEP 384:Q5ExsrMXI+sgghmZQmb/KDEQjsG9WF4a+jVU8:QCsi8zhmZb0dksjW8
- TLSH T18972090897E58234E7BA437994731B4842B1AB059C03CF1F6CCD64997D13BEE6252AFB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f35da680ababc256b36c531a4411a7f01954eba9c86b230828967abe5ead5c05
- MD5 06d956bd32e8f044e60a30fc429d6045
- SHA1 605c7e0813a2a4aa111157b3f2017390db1f51f7
- SHA512 e042d56aa0ac4b8b6c2aed9e44dbe6b28132f25c7d06c6a95691945e747e46c4168c019c135c2df2fe6b34be892595e775b90ec162f45293ae026d082f707fdf
- SSDEEP 768:XwI759NEdzqnoGjZML6t2AnBRbD5lNc+n6jY:gInKeoKn3bDbS8d
- TLSH T184E2190567E0C336F2FE0BB999B295088770FD12A923DF5E1D8850F558537C9A9243FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/ReportWindow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ad7156920a2649f18df0ac60fc0f06ece2efd5bd8e9446ce8fbf001068e13c7
- MD5 4e727dc06a5d3aaad60049515b6b4fc5
- SHA1 37add0c654dda8133946c99d79dfcefd55b0e6e9
- SHA512 0b02a423d0c4485b45ffa8eeae13686e1170ed832d3349458ab22ee9631d60b1c53d9e7c3c641da728963aa734d05e99c90fb26516c40d0767c07830f9716bf2
- SSDEEP 384:ofDMg7MgCyih5U37mB4JbAS+DEd7F6UuzmjVmYf8A:of5MgCl7UrmyJbE+7oOjgQ8A
- TLSH T1CA52D80497E88972C6F547BB55A397084670E3019C03DF1F3DE881E66D12BBE66127EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f6418ed357f750352d91d9c13384410b98487be44a62c42d6a1ea9b4c0b3c286
- MD5 570a19748e82503f47e2cb2f0b59094c
- SHA1 9cc29db11ce11717bb47233db6bff270ab841f75
- SHA512 097101eb6431b9c03736809d809f1185bb16e46f1d85d699bd2df50e2d980078fde4457f58aad9ea72e8c5d9e157c6c305d4c9c12779d3e1276870504c65e809
- SSDEEP 384:xMeo0hS7kwKPO9JRiTXx/B8wnpdNNZ6BbRpDEafFGq26ejVIeMC:xMshgvit/3fZ+bv9fAxjqlC
- TLSH T1CB62F70493D89633CA7D87BA54B393498734E2019843DF5E7CED94F5BC02BB96A113AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/ReverseProxyR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f8d12f94117eb24e6470ca0762f3c810cc418ddbdc41bedfd5632894ba370b3d
- MD5 8dfed861b67ff0999b2cb80ccc3d515e
- SHA1 6f36c49d01ac5e4d52399f622881389b9fe4ba42
- SHA512 627596f079c3b5e1ff4c43b4b0699416f44075d65e990ab23989f06a57e18f7304551a64566947eab9b2b2c2c46ee746e42fc3012fdade9798b5a9915028a055
- SSDEEP 384:QMi8Vt6L9+iX0FggGIlKFybAGBEnz+FyIyjVu7c:QMilL9R0Cgyyb2z+41jsc
- TLSH T1F162F944A3F99936E5BF0B72A0A313484734E605A843DF0FACD970E55D13FE992127EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b68dd6bb714b36173da2f92de61a8ee43c39925ca5381d7677aaf1bb4a0ec245
- MD5 295ff7d4ac032c467d330979cca5ff25
- SHA1 b9ac5782e891640f7515ffbacffe638972fbcc89
- SHA512 0936b3f1233b9ef0b61643a0056e135da41f1aed2e1c8f2d018d2c621f1f10d3503b36615fc44d656364a22e20be0bf824827e93ad40bf23f0cc0d31c7d046da
- SSDEEP 384:1vzC8HgIBBK1B4I/eIi5BnobmF5i/RPVzx/8UhZFc5MZZaCjVnS72N:9zrHvBBK1neIi5ybXvFphZvju2N
- TLSH T1A2B21944B3D49971E6FE0AF95DB317454B30F2029913DF4F2CC990E83E977A5A22079A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Service.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 efa82a2f50b2593fb7923b596040295c85bcb20f31a04532f13a267ed3c1f87f
- MD5 256c0c1a33edeb36b0852c919943b6bc
- SHA1 38f3488e9e05900b6d77c16dd871e0b95159b6f4
- SHA512 8d205d769527173f96ed5ac740f6337ee84c8f7ec6a050dc00c4b0508760dc3b5976cc37aaea0fa99b9b6cd078f99c3fb15bb614d4c240e2954ec8824bf444b8
- SSDEEP 384:XUiJKddghLwkmB81bwIzDE9QFdBuzmjV+nD++:XEdgJwkmu1bZ6QNjsq+
- TLSH T17662E90857D28632DAFE46BA55A3A7094371E3019C03DF1E2DD851F5B943FBDA32139A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f95b40dc67682a335395842067dd4f48135feb4b10dc0618682768c1fef6702
- MD5 0782d9c884a2f5837487783b29648c21
- SHA1 79674ec5d56ce1eeeb1afdee753998c77d92b1bd
- SHA512 d83b381825b8f37279a813e40c5ba07f3b4fc0a6fc1a8dda95228edb2c23810ee4d4528f5f316fe783ccf272053327269d4e6bccd5f44fcdbee0c22293ddd87e
- SSDEEP 384:a+uudTnxKUwNXeMBZdmbe1S9QNXstZ8F5aCjVwU:a9udbxKUgXHB+bjgXPjiU
- TLSH T14772080897DA9B21D7FE46BF15A3670082B1F2018D53CF1E6DC961E46C12BE967413EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e07360c119f556a3270af6f32e78ad4555a4133c4b7f1e8822138282b14d482
- MD5 8b487a1d80d03aecee1d2a4f0d8bc540
- SHA1 9cfe31585e0467fdba3eb92f2b37bac13ac86148
- SHA512 4dce7836d58de036497b0e5367bf8b8386b770232ef4aee67037ba1ae87200ad1d0d39048ff8a90ac1b216a5835bebebd37e9000e93d880b8fbbbe638b8df3fd
- SSDEEP 3072:bYO84N3zbtpZhT4NTUZcL/JJnblH3xP93RPvFQgn3N1VZTtnTX6e8phzz+dbEiyr:sdXN8pN+dbV
- TLSH T11ED32B543BE98D16F3FE4BB4E4B201144632F429A932D71E2DDC60BD1B23B489954BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
140990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
130KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Stealer1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 adaab4398bf5abde6e4a38ac78774727a296c208ba137a2f17fd3a69e131a4c1
- MD5 b0986690b53f6801d87957d85174a70d
- SHA1 6ffff61f8c19d16ce439274e64796126d3be85d3
- SHA512 3436d5bd9ce9f4d03ee31e78df31b2b0d9183e09b4686e00d8d882c17242cb202053beefda7286c50eb4ccb0971de53793c804c83af847985277074a0ffd51ad
- SSDEEP 3072:LwuPudyI5IDem48NB6sbD4GL0bLPUEKNM9Apep6:sxdx5IDemVB6sbx+L8EK
- TLSH T11EE33A6837FD4949F3FF0BB6BAB1918C8A74F4366A03D74E2EC520E91A11B45A900777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Dracula aka Samurai Stealer payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
149214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
138KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/StealthSaver.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 184d8441d76de0d0814c8292c3364e487cd67cbd92b61afbc6d2df7b1b52c2b9
- MD5 1eefcc8432a30cdcc9bce2d2ac291134
- SHA1 14c564910ba68d0b0b5c48609a63ac4dc86dd93e
- SHA512 829a1b2292745e5fe3efc3567290c1135b3a082f4591d65aef1833b1d0e452584b52c1bb7141cf9a73f6a033dcde4e22ede8a914480cfc78a8f13b31f072fcba
- SSDEEP 6144:XIfh3POUUuZYXjxKd01xcmF+SI/F9/Ybv:4fhfOUUuZYXj11xcTJ/
- TLSH T1F5246B5573E408F9E5B78239C8524645F6B2B8160760EBCF07A0477AEF236E09D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
232718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/SysPlug.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b3723c13a9dd13f0a22ef03d66dde3152fb277113073dc655b187d6e11fbfaf2
- MD5 3d26ad1d1f785c13dc4de99c0d8467a9
- SHA1 cbcbe183a0435c66a1ce2bde8d912d358a7635af
- SHA512 c440cb7b859386773d2565d32733468ca2ee8079df463632241b1ae994b1f077a838cefac15324d5cf221f2cd8df4fb89f0f8397e4b91d1e46d072032d2d0098
- SSDEEP 384:Y9tJAe9cdGFJnmOmBKbR+D1XzFM6qjVJf:AbAe95Jfmsb6Fz8j3f
- TLSH T1CB52B50867E5CB31CBFA467A6EB3A7044234F2055D03CF0E39CD41E56C46BBD66623AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/SystemSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f385ecf85c39ef2e153969690dc6aceffe2bb471b83240e8844dbd1222511f36
- MD5 ae11003380a0c5bd3c9cf0d88fe902d3
- SHA1 963508363756048186067d8790784878bf18774c
- SHA512 bf1fe130b1a4735f6cefef5f34782ade6dda82418995f9f02d0916fdf4b839a3a0a1a743f9fd7412b9217f4c61ff6c4a20d01ecaf81e981e71206de75723fbdc
- SSDEEP 6144:lQBj3SmoKVmlPEVHZfgJFesOLsEvWhc1uWnBWyhje7JfPzGxcFUpLVbZ+abkiMKn:lQJ3Smv4bTzrhNu44elaOFozSKT
- TLSH T146B45B1537D49A57E0BF1376F4F1092747F2E046B2A3EB4B269496B81E83781AD00BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
500606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
481KB
Virtual Size
480KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/UAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ded3b67007edbf50b2ba29e1d5b5d6b391ea0689c909e029a3512dfc1e0fd71
- MD5 74a36cd8d9447d836cd36343ca7c0726
- SHA1 bbdd1c5e6d40cdc6bbe151b9aa8485b9a7e59c2f
- SHA512 1d4ece027fb6a5befe25c526540a8b21da51e3536c37530048f4f4c3b46ed80d3c263cecfae43d8c172919a3c2a7f03fcd558430078f311820eb1405683614e4
- SSDEEP 384:Z4T5SOH5gGKiacSN/nKKbE69bdbaSOq+bDzri3nUAkYGbHFtslaDu5JFixO66jVw:iTdZgIac4/nKobRdbJ+H3i3nLJoxEjXm
- TLSH T1F6B20941B3D88521E7BF4B796CF202214730B5670C23DF0F5DC545A829B5BE8A771BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Volume.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 78f4e185097677ab2e38660ca7c7b3eebaf8081bc1933435ad24b42ace9b0867
- MD5 a5e165a4a602531a493cebf501fe87b0
- SHA1 6343ccac305e3c7ec75a8c39dda6277ee5b1daa3
- SHA512 9e887ff008b2a726d4c7cfd51956e9b61357f46ec78166643ef8b9f0cdfce686e91d229c8efa6116fbe6d4b4f90ec5adcca31bc5b396efc6867200dfc615622a
- SSDEEP 6144:8o8TJK/Mc4IRrLPp/XryJaf/FrvuRhFQ5KvqjPFUprYbY+rbsBCdyCCMTKP+o:8dTJi4S/mJa1rvuRDHMFoodSt
- TLSH T10EA48E5137E4E52BD0BF67B5F4F2091347B1E04A7222EB4F069896AD2D83B91AC407B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
496334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
477KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Window.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c14a8a627ba5b348ff9796fbae02683dcdce0315ba59282d276a6a7b27e63b41
- MD5 9589d029775f7bd053f2c7fdea8f2241
- SHA1 97497f6af78c9ab3e09e3d69bced86a6fd3aa7ad
- SHA512 8b69ecf476b31222b4fa8c6aff37e6471a08c59f2eb1e8a2327f67c28c1f797667ae2116f405baa7510a2b2f95c89d3fafeeda61db3d84307de1db2402edeb5d
- SSDEEP 384:YINbISZPx19uC7etI3a/hENKEOUgjoB6bGArDI9QmJyKIFHuzmjVbBM0t:PDPX4ogbGoa4hj1W0t
- TLSH T18472F80A63E58A71C2FC06FAA5735B058270F3529843EF1F2CD851E16D52BAD72027ED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/Worm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 279fb3a93afc6feb0577334e3b7945ef34e45b9a95e644850cefa4a434f82c12
- MD5 61d7d19343646c52e078665098390113
- SHA1 1776715dbc12351e3ce6d76b133fd708aefd9cbb
- SHA512 f4f0cb97775eee0715b5e46e2ca7f976a14799b0ffeffc1be3d92dc0fec3038afacfec6c6fb9df9304e0ef919a8b514908b563db7d2560b3e838efecc138f6cc
- SSDEEP 24576:3khZMaj5N/pDoP4eG7Uxmoq+HHgkvjK47LJb1LPE4KTv7fSWyHN:35zgCmOHFvjNLPfKO
- TLSH T1FFE5D3026EB49D3FD33A1AFF90E1433456ACAC0B92DE964A757CFD691C72A401BC4762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3059822
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/PatchedTemp/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9ba7282d0d97815e7416db225b23fac54059323a02792084142378994f10f0ff
- MD5 e1e5e8f9b21f4555cc5a8b9bc34281b4
- SHA1 cf9d356d375eb747548de43681aec678de3e8f90
- SHA512 8f0a62534c06bcafc5bf1dd7b16fe6b323e7d255ad48ae4c8657e7ead65975c00bc61e6af1f70a61986741dfc4fab358b4bc606f5527120b9aeb3b756133e6dc
- SSDEEP 24576:0TEHvKA1YRQPiV2X03v7fbw8CHvN3GygvHNfU:0TivjYHt
- TLSH T183455A1237EC9B77C4AE477AE43116580BF0E80A676BDB4F6A58F36A6C437409D113A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1177742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Action.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e02c7d4772460b5ed8c9deb4d9c42f9307ab2e91dcad88d370c56852e2cb3cd9
- MD5 6bcf7dcdd6201723e287296fe6a137a8
- SHA1 90ae2ff990a5d7262303adddce63d966f37b2880
- SHA512 a87be64c53ad55b75dd7273207a1e8ed40c4d37b7936683409088d5d4b961eea9b016133cf79e19fa32e8de2d8819f83c1536bf4411b1580a3e4ac5762cfd185
- SSDEEP 768:GIIy4kFY/dEMKix0thSCBsFY/dEMKix0GbYB/8p3bk4TsHuHTfjOW:zIy4tBUtbpTuuHGW
- TLSH T1FBC2F804F7D82A34D2BF47758DB11A14EE7AA147EC72C90D398C40982B727998B61FBD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/AntiProcess.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aa5613397f63e46ba3c6d8f23f15cfc3968715c15eb3c8bb3f7e1e6ebfe05a95
- MD5 48442e4f33ba1c798b8cd9185ca1d9aa
- SHA1 7e525947abdd2a75c2f17bbb99c25f137efd4cae
- SHA512 08c6fedf9c38c73396e7354b6fe4d58657cac480679f310bed206d1c93cbf38e0f6a66dcfa0667c1ecf33c53129213968449e1e0a83cd76a4c14bb32546079c9
- SSDEEP 192:lfNRGGKzmllcJN/jB50Hk68bTygXnFCcPKjVISBaTt:lFbcJduk68bTDXFCcPKjVBBaTt
- TLSH T1CC22E900D3E98A20DABD433EA9B3930A4A34F1049D13DB5F29D847F27C517FA56D22A8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/AutoRun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 07b7c2db79493a5ee49b608360ad480376efb5a2decc53e17938615d0e246143
- MD5 4571541b931bd8b3e7250de365c99b1b
- SHA1 b2896b06c324d6152d38f25b7f77e2795dac917d
- SHA512 1a3e85a04c255b87fa4e9ca99ac0b8e00d70ad78dbf19cce047038ed12874f5b15db559baa162b5b8e26d6fc1ffb062e12f289ccb27748f8d05c663696462e38
- SSDEEP 3072:Kyl8eHoRnxKZILoWl7rjvMy86pJERnjwTqerO9/3n7OSUrwi920aYW9Ba+bQaKxT:/l8vn1LoWNrjvM/Pmi37NULlaba+bQS
- TLSH T115743A1523FCC627F6FF27B8F4B250104BB8E40AE96ADB4E4D84A5D86863704A55237F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
345198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
329KB
Virtual Size
329KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/BotKiller.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 93b2051501eafa809166efd20947d3b25dfa09dd8d7e32baf41345cfdde421a0
- MD5 ec8363fdc41624cbb8125fff1ea17ee5
- SHA1 25edf29bfc2a06f8ee9e9968d9578b298334173f
- SHA512 d447a78c4dd5539413e4a116c14d96d48c023d9c03f76f972757dfb1ce936e8075a0de0c677d99a37f2f3976506cf74f548cb576c38fcdcde0bb2845b9bfa2b0
- SSDEEP 768:PxBV0x47ieFY/dEMKix0GAMgnNyw9WbJ4uDCw+VLjp:jV0x47imNubJ4uDK
- TLSH T142B2A511B3DD6230D7BF4F366832661086B5B4269C26CA8D39CC92C90B36764E631FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/BotSpeaker.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5dd8a71a59d707ce9c6391bad79a89fb25ae00c46f366aa4732aada6190b49ad
- MD5 e15b848a004a3e3f53519bd78faaaf13
- SHA1 4d7aec7bfdb0db34fc95430c68bfb7d7fa1a46e7
- SHA512 1ff0c1e30104cf0bc7d9a18ce3e246fddfb9d05cdf1ac5c01c77c28be4eb5d74319326a2e2683ae31f3a27cfc563a17a8f2d18a4cbd08de78cafe685d29a4578
- SSDEEP 384:bp8WObHDe/6BM7GilZpE19NCmBM0bi+D9l/yvFH6qjV8HIbRL:byBWpRmHbfn0ZjSHIR
- TLSH T10952D904A3E48B31E6F946BA58A397844730E7015C03CB0F3DDC95E5AC53BBE6B517AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Camera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e686aa88a2f25a1b966fbcec46be82bf0ed96c54715426ac090b1b71c8972ee6
- MD5 45c5a5745280597756692c69d0b46565
- SHA1 8219006f2631ebd020138b3272c6e4b3c31cfb55
- SHA512 7a97ed692ae722e5c9ce091e1ae200203dc6cccefe3670eacb11546b7ea1a03ba651cab84b214c7a22263db96b0f02c87a98026966792ee1a257682b065b2a21
- SSDEEP 1536:kzKZLDqMIbKrEraXK6upJ8i6f7g27iPU4+a0u6XMRf23FzWPOa98beQSkryrzYT:kzKZqMIbKrEraXK6upJ8i6ffPw2VKPOh
- TLSH T105935C1127A8C927D5BE07F8A0734B459B319206E113E7DF1EA454EC7C63B528E632EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4bab443475ee2926ef442a2283c55d81dac20d4c7dc4631f54bad03cd1a2f302
- MD5 7b5cf68bf0f453bd53d0ca28e5598923
- SHA1 b3e40dab5a8c8dd76cf07b6c46d9b17c3c346f8d
- SHA512 fa4eed927f6a54e390fe10e648bca6993e2b95eccd05fe317e2256f6e6e5c6478b5e97b5962766ecd61d5228410303a1b1a009ea832af526c619f0ed9ae4d064
- SSDEEP 768:E+vKUUMJeiAItCmtSpiXnNucgU+0IhTPbFbqacBabaGaZQSURjrJ:E+vKUUMJzP0anngU+0IVPbhqaBbadU5J
- TLSH T1A4133900B36CC92BE7DF0AFEA41056A413B1D3627883DBDA1DD468EC19D3BD556212EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 94f58501a3d911b7da346861e3f3215ef42ea5af5ff9df6283a278f9322b4d62
- MD5 20cae6df4dcf8d4b8d881037609cd62a
- SHA1 a28ab97a517185ee9c0300d6e4c178c616ef09a8
- SHA512 dc4c6c6f7c779035dfdb48aafe1273f7c3f3cfffaddb622863e792ca9c572634ebce5d89402e0391a552a6a34667f7d2682952274ba0a3f0b6cfa38115ade291
- SSDEEP 384:UOEAk3GkJmpCZhlYmBWbRaDEO1Ft6qjVJt:UUk3GkJm03lYm8bWP1Pjbt
- TLSH T13252DA0497A58632CEFE13B7696397488370E2019D03CF0F2DD8A1D5AC47BAD7A257AD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Clipper.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a7ed33f5a2ca75094f83d98a2fb9193442cde93aeec09544eee2771ee5340b23
- MD5 e66aa80ce46ee990a4c4a9b097e5edb2
- SHA1 1d3b0f7438b41cbf234400eaa8ea091441808b29
- SHA512 7b17f7ae05d53002fd9af858227502ff0e8cffd16aa122fae59c359cbd10ae8862120364ced0cda7777d79e1882ec3731b357210a147510a88be6e95c8093387
- SSDEEP 384:QP+WeZMOo5uiSqmBrbFaDtfhCYFhaCjVJ8p:QJeeOo5xSqmBbyJhCY3j78p
- TLSH T13D620904A7D08632D7FF17B694B3A3484330E7019C43CF1F3DD8A5D56962BAEA7506AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/DDos.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22e6b4d12488c38461a4eaa8024c903394f6b2ba0fd079cbaf8e6e715117bfe5
- MD5 4e76455fe46ea39ef8af3b4c6b73b428
- SHA1 2c53a21da2baae658e2f2c963236a11a82a519c7
- SHA512 91cc4e2ba53f3f8c44c0f084bc8e091bd45b28e857057a344af20da800b35d005aabf93f182f4e4287c9d15387d0df19ac0650601929012d3000f191b344f57c
- SSDEEP 3072:06Yh3M2KXKZi6xb+7jd3OqlWj/RxfZwvyM:Nk3M5Cb
- TLSH T1F4B3941473F04328F2F7177DF8F95616AA76F642FD32CB9E2965021E0862B448942F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
114910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Desktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d2c817db4843f8f230dfb9fa3b66ef4aebc75856f1cec3cfb3c3397b8b83092a
- MD5 5c76bcc70a1b202cfc53fdab3fba72b7
- SHA1 0a69734dab5cb32af267b90405c6a6884b69948f
- SHA512 a84aaeb21666dd58014d2a546df4b6ebcb27128e70ad23c7c33a8452628cc6fbc16624eaa888770843e4b9c2d22b9b6adf7e6fe1e860085ef7b79ea3737403cc
- SSDEEP 6144:DzkAANJKjDlNgDib1ahIZNs4z8pjac43jB0ZnmcTyO3EyTFhbZV6i+h6CUYxPkHu:Djz3lO41ZNs4z+jzSAmOy6Tn634gxZ
- TLSH T175E41852EF6C9F22EA0F3ABDB411791311B392411701A547A886E0F91FDD389CB1A7DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
718574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
694KB
Virtual Size
693KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/DeviceManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 badae34033402c006e2d03e6c70be61acbdded08fcc8807d54a9f9b93e23498b
- MD5 c3cf46e883658b2b343479cd24d4895a
- SHA1 4f6b2d2ad0fdb3c47fa7aa72854f293313ccd704
- SHA512 5400862287da511a3c5d5ac0c41bd512c6f0723e6f10f24d58506401c8e454591098fa14a3ea1087014eccad9580a11012eef70fdc45b8a7a5a9124c4fcc2edf
- SSDEEP 384:8IOSKkIS/IGAIcmBj8b4+DEJ6Fi6qjVQWD:8Ik3NmZ8bFO6OjCWD
- TLSH T17D62B60467E59A31D6FD83B79CB397049231E6419C43CB0E2DDCD1F56C06BAD6B212EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Explorer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f668357d772efe95cb67d4862cf8e4c704867e9ff947f9b9fe5787943872325e
- MD5 e1138018bec3e3fc193b3e6bdc13a898
- SHA1 5ed9c7f7c4dc3f2026a3a360c31f8fb5f2a5cfe5
- SHA512 943e3b30e8606b8301e9ff148d55aef3b8005239ee28917ebceb510e07a86e151933b4f026c751bc562de59d924754de104ecd1c5e44684ac366e73d9b80ad09
- SSDEEP 6144:GisNZ8n7y/YMlvgl3aGtSV41OJDsTDDVUMle6ZjxLV/Dx2ICsbCtOeZ0q:GiMZ22XghBS4msNUCe65fDx2ICu2
- TLSH T134B49D4123E8CA57F2BE57B5E4F380608770B017B93EDB8F6D8464EE291A340A5157BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
504622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
485KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 01d485ddead7eb29b1a527d22238eae750d016d1b5bee284b7bd1dffd7d00465
- MD5 8a32955f786580d1ea3ea939569db36f
- SHA1 b287e384138c5b1cfed04720a1d7b4c3bfbcf6d3
- SHA512 6680814db67a3d05aaa6b2fc6ca18e0de456adde0e1b56180cd41f688881b5dfcef3dcf12c9db16005835472751fab3a1f1f8eb52fd3a603d868bc81534e21da
- SSDEEP 384:ZzfMGgy8YUHNnVCBo2nmjmBabhHDnFIPFoxxuzmjVYntNX:Zz0zYUHvugmobpFAaNjWtNX
- TLSH T19662E90823D59631DAFE03BBA8A357048638E101DC13CF1E6EE855E4AD13BBD26117EB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 44a82bef77fdf86a1c7ae60e32bad307497ec23297955088d4c63f539cc0b633
- MD5 ba9a2ec4e9766f9eacba2321cba5ce6f
- SHA1 ccc6022417b3a0663a470c59a319729644470783
- SHA512 eccf7701c73fe8b7d3eb655a6e28751eb6da41698acf1720f253cd4942e8a08083d4a555205882172741f52bcd204efdb68097df0072af19dba57039fc513585
- SSDEEP 768:EJA6alsCGi074+zEeCqo2lt5q5Lb7AZRoJjXETYsjzESw:qsyHEe62lt5qlb7Are6Ygw
- TLSH T121234B0733E58262C6BD06B5E0B34344C236E24BA412D74E3DC955EB9DB27CA9694BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5d2f19c5efeeeee22fec995a617b21eebf40c38b5d0e14de4b764aa86c963239
- MD5 86db41a040959249c72e5a703eec63dd
- SHA1 1703051f1a1140e1778a5436ddeace6d1dd1d45f
- SHA512 cf086bd90cf764368c84ed8ef30c9ac8534187d4932e0f9f794d052142d8680d1f106a88bc8b783e90a9492f56797ba9cd854369adfaf591de0c0d870523e103
- SSDEEP 768:B6jOFIGAqIYj9YkJ1EBOI6JEPyi+b05y1/fUNBjK:Bmqh9Y+1/JEEbukMu
- TLSH T11F032A05BBE68220E7FE0779F4B347548634F1835842EF0E19C8A1E4A66BBD49514BEF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/HostsFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8a901c2b7aea3bce3b048db6b66edd05880fb57ac0eb58e95a9bf261c7f7e506
- MD5 849e72579bc700922795d971048396b1
- SHA1 5b74858941df8179e64444a6382db6404e815e9b
- SHA512 2670a769fdad774445b327ff9ca1f4c3ad07f3a6c99f12dc8ec5074e0200cd552f273f27209fcfd91134adb82d1a5047fe2cc18a0f9a7ba6ce79c3312b127c02
- SSDEEP 384:gUKJZ9H9mxBxvnWqmBlmbR+DEQOXRF86qjVtp:KJP9mNn1mub6QhgjDp
- TLSH T17F52C70867E45A31C6FE4AB768A397944674E6158803CF1E3DCC81D5BC12FBE76213EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Injector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9af2bddad2a7aab91a75a5f86c11d8147ab0618a75e177b66ce0a705de210edd
- MD5 028d94e004c208adbdc0c6da95cb6650
- SHA1 3809ea7fc8b27006fc3ee9b07eb520aa0a33afe9
- SHA512 ba34c1b1c906b7313d7c503cd64a7ce6f3d270e4f6bc7195f87e588e10c172f25eec56022f1a742673813eb6fecc3b374e9ee5e4210110932493edec792f3fce
- SSDEEP 768:XMo7GvsEsp4bc7+2dMLaIEZyjL7PIHADRDl/BYqbeK05U1bRgLj3D:Xj4nsycq2yWvYAHAdDlyytCKbRID
- TLSH T17F3339647384CA33CBE9477A84B71F0843B462558E52CF3F1DC8B4966E13A968763F92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
56958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/KeyLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3abe054a19d9eed6650b71e8b3b43e742671913e3369f7b37a509487328f57c5
- MD5 a25083291f5d796bc734d6b2c7952fd4
- SHA1 c51e46b0dabc36b4c0311d6e0e766c17cd474fc6
- SHA512 65dd93283d8e17a09795f87890f8cff4e9d2b1768b7e27f671a6d95c15c857d3cbf7bbd3c642602a8942a725bd13f28e84afe5d79012d7478ca245e53a6ea398
- SSDEEP 384:LWT5YO5u9HCwlSLX3G+BQbEbo//gY3bFf/6ajV0J0:5O8ALG+qbJAYrdHjqJ0
- TLSH T158821809A3E84B35D6EA067559B35B1587B0D2005C03CB2F2CD856F62A9BBF653213EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/KeyLoggerPanel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0db6e52cbb6c4a34c6127393aeff43c1d19837522e0d4a6d5f099dac30e69c7e
- MD5 32ad32137101fba2a40ef0a73553cd3b
- SHA1 ae86410363800c5cea11e98b364fb7afddc736df
- SHA512 05b26a33d5a5171463d9ee13e866f0babcdc9ab1fe1efb4a34c69bded426051d7bd78cc2938a64cb0f390772f13069a9e80e7cf3ddd2e2b97d59c02fcf8ff613
- SSDEEP 384:GciFQxMH/vVDBsomBkbi+DV2CjQFG6qjVKzO:niQxMHXVd9mObf0CjQKjUzO
- TLSH T11F52B808A3E49A31DAFE17BBA87357444374E201D803CB0F3DDC92E67C12B6D66216DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/KeyLoggerRemover.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6089816c43423f86c25765171b3ed5ef2fee9470e7771705759e758dde8428a6
- MD5 6ee4e88dcb148b9b2e1a0f03bcf3f772
- SHA1 343403678ca22676c142fce59980556f1951cf89
- SHA512 160824f3f9509d9efda0d55244efba1edae11d98dbdd6f0dc9b984a43b093f8645b0e163154160ee8319efcc3285d674950c423bcb16e1deeb7e232873091be8
- SSDEEP 96:l3kD5XGxkO5u0H7H/6BJ3DZ3oFJdHKggYO3kKjVIIrKw:l391u0bH/gRmF1gYpKjVIX
- TLSH T1BAC18511B3E99632ECA74B71ACB3534106B5FA64DD33CE6FA8D4824F6C126148A71F62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11950
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Map.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2a1cd7c9c76b9067e7873fa1c2d567bd41f6aae77f481b878eabda6f47ba5089
- MD5 7b65d81fbed62f1f7ea80fbb4b1ddb28
- SHA1 ecc1ed33381141e3ca773fd8d0f1d53b4b2cf44e
- SHA512 a9d7e32d53226953fe4c23da6b22383a5838e104bb03bab0332bfda2fbca13f65b4c584555451f5492d4b277c341059a1ed97f9eada2b2e190ffe8b00fa9647c
- SSDEEP 384:vL0epv8mXSYAXIh5AUdmB4b68+tzlFxs6qjVUsQQ:zgYA4h5AUdmybE1lmjfQQ
- TLSH T1FA52E809A3E59732C6FA0777D8A357454275E2029803DF1E3CE891E4BC12BBD6B113EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a5a05f525dacb211a560d85331c3e3119811a52c15917bb7d954958ce33fa4ce
- MD5 1b3cbf9085d475a5cfa7eab2767ca505
- SHA1 b59e5486ba330a46961fd42584470fdc445827a6
- SHA512 899587dad68680a78852b18c803898f11de2651d0c58c8a399306cf1491baa3d303cff9d73ea34ad8d53c76fbb31d21eb6fa2ecfa673b30cf96868cf20266eb2
- SSDEEP 12288:nZw7dtAVHW606/8HGBSelQLSJrAgK3FyDv/yMX:Zw7U26060uSz7FyDvqMX
- TLSH T1FBB45A0137E09957E0BF2776E4F1091787F3E0467263EB4B1A9496A92D83B869C01BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
502590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
483KB
Virtual Size
482KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/MinerEtc.dll
- SHA256 fa71752c440c0b763fc2eeb8d4364400767e9a3eb9c49aa2ea654c635956e3fc
- MD5 095b2fb3ac77c2ce5edd12daa62fd3cb
- SHA1 b0a090bae7040dc21078c4b93914c3fa8a76371a
- SHA512 39dbc25e289a38878b824e3a44c05be2165cd08c5d31c68bb9e40c9a72ebbc627c41f340207fecaf8642d5262ec10e9abb000ef4b6fed88c242075cf235f5515
- SSDEEP 384:zaIt55nXJIgxnhg36Fo79YKlx0lOMhr2bn0ubcMvq/SLPLStLdFVDB65FzDR4yaO:fpnrxnOcQfr0lOM12oubnqsLehj3Ejd9
- TLSH T193B2294267D88731E6FC57B658B353088770E5568C03EB1F1DD8B0E92C6AFE996007EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LibSploit/Plugins/MinerRigel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 857995576d06879326c198b39b55338b320d16154e89913128b27404527286fb
- MD5 b028283d5080ff26395b30e8a13ed498
- SHA1 7cc243a888943622dfcdab6a147090e079180a68
- SHA512 ec63439180f1320b62a1d5f3257ac59c156a5d0976827e5a631f0ca05438bdd359fda832820f5bc71016655198bfb6c376803665eee7b2767cfa74fa3e61a095
- SSDEEP 384:LAhQLlv4ewV8ohOqqAbydmbLqvqoSAYIKLdFNncHDB5N4UayjVbLs6XRB:LAhMvjwV8pAb1b6q/RhuWqjO6n
- TLSH T14D922A0A67E55930EAFD0BBA98B347084671F6074C03DF1F1CD871E86816FA9D6117EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/MinerXMR.dll
- SHA256 6819f0620988f4c952fa1d4371767d358f28cb0aedd56579c15631f8dc587ac3
- MD5 1157eb3177da21c6b4d3adf97b9353dc
- SHA1 cf2fe6bebdfe50b325332bb02a911134d2a6c0c2
- SHA512 c9c932f4a5230c4d5d812f59f370b91da81fb9460baf8a244e3ca81107582d7fa811b1177cf1429a6e8fc6093ad16e0e89db89f04279f8d40add5a5b72f97e0c
- SSDEEP 384:y/vCJXJ2PiEDEJgcko3VxyQVFh/nZubcMvq/SsPLhKLdFVDBi5tDt4yaujVZgaHl:yCJIPi4QXiABubnqfLwhjnEjPgUt
- TLSH T144B229457BD94735D2FD43B6A8B357098730E6078C03EB0E1DD5A0E95E29BE89900BFA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LibSploit/Plugins/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1bb5ee2c61b63f26c33d7a98f83e8387412f3cb18b518e393aa05ecd075aa692
- MD5 f2647ede5797a23641406ea3e2f157b4
- SHA1 6cae531068816813f7f870295c373b1f64c7040a
- SHA512 a37c8dd752a5de666f2bb81528c108cfafa5d56cb8c2ce7bc41ad542817e21ced4cd4e1a9926e5cf5a464bbcb7605db65a2559738b2413056a3ab2da468c2952
- SSDEEP 384:cQDV9bCfDM8OFZcyt/uXC/JBvBTb9ZDwx44X5FWfaCjVry:cQvC7oZc+/K+JBvJbPU55E/jNy
- TLSH T1A982090857D99530D7BE06FAB6E3130A4374E2125C53DF0F29CCA4E97D12BE8A6117DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24702
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Notepad.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bede3169c6a9713e3287911115335f106db0d6ea27596d8a35e5c13f879318c0
- MD5 6d693ee095f5f6d9b5019e37d1f39dcf
- SHA1 e5c827a825d649eb44d296a7e964caa997e38ed6
- SHA512 9c27eda6b1c933b29cde610c71b0478f08b8beb79121ba52ff80c6fbbb79688a938f3d0afa64e66ed95218fa2f4d114d5e4e734eda6b1fa8d501b023f1f936ef
- SSDEEP 384:EijC2xrzq4QPdLC6MFzm1fJs6/6KpTYegmBnb6+DHTRFc6qjVao:przq4ydL0o6ecDmlbnzRQjAo
- TLSH T1B952E80CA3E55632D6A947B7A8A357448238F7015C07CF0E2EDC85E5BC42BBD7A217E5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e031c1a988b61a5b446ca1acf56c997b9b11d4727e87c09424d9bb8b16141ff7
- MD5 88020763ccaacdab2a2f15cf53b7f7e9
- SHA1 931965a2de1366492c81b16794c982b65fb7bca4
- SHA512 afb6a555e9b5dbe137fdc3a2f71fa0be42bb1c1c1b9ea094c06508c7db9c02921f01eba93becd76b826c2d92a00c20eb31edf6e9a6668c8eb07e7af487e8db61
- SSDEEP 384:1C3Z5FO7YXW2Uk24r4p/jzBRbdUD9N8YVpYFo7juzmjVb9Hm3:1C/WUxry/jzDbIn8ZojLHA
- TLSH T18F62F70493F58930E2FE4BBB58B307044674A301DC53DB1E2DE851F4A857BBEBA12399
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Process.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3560905f6f533e37ef84d5c4c431b51f930e5c31b394f1abf1b62344f65b95ce
- MD5 f0d4a366d7eea4476a0fc473c6c0399e
- SHA1 0ed962695e923653df3547388b90cc4f703ef529
- SHA512 1029d56f6efe54e743de2e676b869260b6dbe1801cf04b0ed696a93f9b6eb7c9c4ba521cb5e268d960ef0659d9192a618df7b3567885d231bdc8282bdcf62fbb
- SSDEEP 384:MFU7aAYSWvZWgPTBadbB9rDqUOpdG0X9FMaCjVR9/n:MFUOY8xTIdbftG0jzt
- TLSH T19A72E70A97D88A31D6BE06F5B52357159A72F3014E03DB0F6CC860E26D437FCA631AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec0c609caf5082209c7247f74c75b8b88cb27c42323705efb5a8db5b4442ddd6
- MD5 223e81d938f3cd59629321b6718e170a
- SHA1 eb0797697a03b1f20370b32ad7846aaf144848d0
- SHA512 3235da4b8d2ee960e6f277e98966cc8467b5b342b5e5c0e4b7673d5db1e99ecfd3637b29da976ca4abb971ed8a3b777ef5cb76043fe506dd5b9a252567e376a5
- SSDEEP 384:s453kxsrMAI+sgghmZQmb/KDEQjsG95FQa+jVUU:s4BAsV8zhmZb0drojWU
- TLSH T10A72090897E58234E6BA47B994731B4842B1A7058C03CF1F6CCD64D97D13BEE6252AFB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81c975582673cf85d0b742c5212b0ac7ca66e40c5105b68c7ee4abe22cb97db7
- MD5 8b4cc1bb143df4bc9b4ad6207683b5db
- SHA1 41edd68f084735f7350324b809c046d1c995f918
- SHA512 158f48fd193dff8abcbd9e0b4d50643c006f393d0e419164c2d9f1d74891a115a178a50987e677572e7e2cf5151fa287c55d0641a271b058074c960c01f6e57a
- SSDEEP 768:oFIC59B2dNqnoGjZML6t2AnBRbD5lUu+n6jM:kImCeoKn3bDb98B
- TLSH T135E2190567E0C336E1FE0BB998B295088770FD12A933DF5E2D8850F958137D9A9243FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/ReportWindow.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 967b2a798915c8e6aac4e21ff1e6ce324c4522fa05e98efd2199584187ef374b
- MD5 c9f3ed497d3285c54fb00a67a13d7717
- SHA1 b13c5e601cf3d55f8d7be072f31cd13adc00c876
- SHA512 5a6ce89372acad108783b3de7a47f423085f97eb6ac11ab9462e3891c49b3660d17c8780192bd5b07599a6f2379317ae614239ffcebac562d7577b21681cb6a8
- SSDEEP 384:a8HMg7Mgnyih5U37mB4JbAS+DEdeFWUuzmjVmYfpA:a8tMgnl7UrmyJbE+eoOjgQpA
- TLSH T1DD52E70497A88972C6F547BB559397084670E3019C03EF1F3EE881E66D12BBF76127EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cbae8090c84275dac7cbdb835b1bf4dab9221b3f6ccb4c652a85d6ddd50b69d3
- MD5 174b6fa8869f6d4c638a302dfea623f7
- SHA1 9b009aa9e6103eb240d4a801a8a87ca6d815c6ae
- SHA512 2b71fa01d5eadec990d374b03909e9858476874889a77441e97270c31a35b02700d8e055c12e81ca3e2fa7403165f2f1152880433cb38e3cb4eca1a1a42ddbd6
- SSDEEP 384:286A0hS7kwKPO9JRikXx/B8wnpdNNZ6BbRpDEaCF6q26ejVIebC:280hgvi+/3fZ+bv9CIxjqeC
- TLSH T1CF62070493989633CA7D87BA54A393498734E2019803DF4F6CED94F5BC42BB97B113AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/ReverseProxyR.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 961c6abe2feed5226ebc409c54daac4ee6baec2694b4231875d8220bfc5a6c41
- MD5 c01119c983b175acc6f74e77ae8f4df4
- SHA1 221e3a9e59398e4231b97a9b728c4ee5875b6f0a
- SHA512 d91ea85be479fba9e2d401dc726864e2bca248f280db0c4360419e4e0f8a295a3f52b89a21154376eb9915a429df5a705f66e5979db4b0109bf0d98384e6c033
- SSDEEP 384:j8d8aF6L9xX0FggGIlKFybAGBEnzxFsIyjVuMc:j8dqL950Cgyyb2zxe1j7c
- TLSH T11E620941A3F99936E5BE0B71A0E313484774D605A843DF0FACD970E55D13FE9A2123EA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a68889eba96ff60a5d5b77b296b78140e21b5960a9dd797ee3e017bc4c7a4b3e
- MD5 2790da1bd05e29b214f2df5ebfa71d2a
- SHA1 52e817fa61f411cba7b49f3b24f8ab15e04125e5
- SHA512 5e91fde3e441c58d2dd805e3da73af20f1052f2852ae8567c992662e2c1ef0f8cf8f8056caf475f423fdedb286d3d879365f16f7639ce3622dc5be7512c02c3c
- SSDEEP 384:0uoC8Hg2VQBK1B4I/eIi5BnobmF5i/RPVzx/8UhwFc5MZdaCjVnS72K:LorH5QBK1neIi5ybXvFphwvju2K
- TLSH T1A3B21944B7D49970E6FE0BF99DB317454B30E2069913DF4F2CC990E83E977A5A22039A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Service.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 acadd672c83e341185636ef55280a8ab6e0a00b1db3e1f4bb0c4e303a0c47166
- MD5 13379f36b04d160279f0fedf161fa6bf
- SHA1 c29474988aa1f4771c388393d083917c54fda87b
- SHA512 ec142c5b1a5b3432d058b3ef27e3b4055d6c59eb9d68b0d166b9c8230caf4d382898c18833c440283f0a3a93cbcc28378a15f6b63c7047d6ac58527b703cebff
- SSDEEP 384:UYiJKddChLwkmB81bwIzDE93F1BuzmjV+nD+B:UodCJwkmu1bZ63xjsqB
- TLSH T15B62D80857D28A32DABD06B955A3A7098371E3019C03DF1E2DD851F5B943FBDA32139A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e0f5f77dc930a6c34e11438d7d3af55690f02ada099179ce3538fcb80c9d767d
- MD5 5c541913426566545243a36ca836b6d8
- SHA1 eacc08eab6e73190e96886d9338d2a928d7f0f3d
- SHA512 648fb1ebd7143e299ffecf8ef965a42ea1fa56c812d6a3fbfa9c0c2b9cc882090af41ef56a2b7ab2567edcfd35334be5f7b226cc7b492299d1cb53caca066ed5
- SSDEEP 384:dbuHdTnxK4wNXeMBZdmbe1S9QNXstZTFBaCjVw/:d6HdbxK4gXHB+bjgKDji/
- TLSH T1EA62290857E69B21D7FD46BF29A3670082B1E3028D53CF1E6DC991E46C12BE967413EE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b81e23fcbf3d8d66ff1bd2e1d99ebb40444acbdf8843a0bdd86c91d0696597a5
- MD5 da63c7b3125232cfc58c7e0b3425f229
- SHA1 1d26180c7fff6ff20157bf8beede8c9b7a1a4765
- SHA512 097ecb1c31b92e15637f627ea462a5c13813f58f077b365b52ea19132d21eb2f34472dafc344e2c582e4c39b1cb2e7337b931ce4e71b90482841cc5c06890118
- SSDEEP 3072:vUO84N3zbtpZhT4NTUZcL/JJnblH3xP93RPvFQgn3N1VZTtnTX6e8phzQ+dbEiyh:sdXN8pC+dbG
- TLSH T110D32B143BE98D16F3FE4BB4E4B201544632F429A932D71E2DDC64BD1B23B489944BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
140814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
130KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Stealer1.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f839b4130c9eab5d39effbee77ab4c378f4f200a4580222fe0189624d352a5dd
- MD5 a25e394b16985a3ccb89da01d824a6e9
- SHA1 d7c2234cc6c25d9786b7c63c5510275315653278
- SHA512 dbc1617ef0e37da55fe08819e6019c8940ae0e06e0f731a2d2ec4c4f3ca9c9a34fa80e297c8a0cf2e4935e968cbe3fbfaa053623e0748a03bcd7ff9e89679bff
- SSDEEP 3072:Q7uPudyISxDem48NB6sbD4GL0bLPUEKNM9ApepD:4xdxSxDemVB6sbx+L8EK
- TLSH T1B5E32A6837FD4949F3FF0BB6BAB1918C8A74F4366A03D74E2EC520E91A11B45A900777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Dracula aka Samurai Stealer payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
149038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
138KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/StealthSaver.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 70c613bd79765a997bed33bff389427d78236fba1b8161302fb64cd5652f7b32
- MD5 41ab3dba06003e70cfa633db531814c5
- SHA1 a0065d8c58629f3258fec36e3021784ec64ef86d
- SHA512 438aeb2df18f77eb65e1e5601c85b77238dc6d06a6fa704c29793fcf9432427680e46b1849c0fd8194b0fe528dac596ea1c364c88937327b9ef41a51faea1116
- SSDEEP 6144:mIfh3POUUuZYXjxKd01xcmF+SI/F9/ybs:pfhfOUUuZYXj11xcTJ/
- TLSH T1FD246B5573E408F9E5B78239C8524645F6B2B8160760EBCF07A0477AEF236E09D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
232526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
219KB
Virtual Size
219KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
892B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/SysPlug.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 77d772c434e4e30f86c240082dbca1033b2539740f92b711449802dc8dc58ce1
- MD5 d6bce031a4a4493460039b92317660c1
- SHA1 7d7b3a6431e618e8abc9b2cf312ed3ef8f00762b
- SHA512 6889e899c161d13a71593bcc4564b27681820de42c82cd369689f0574b1269b007560fb21c1f3ccd273597b512849e3c1f2f5276b1f98dd677a732f372c5d008
- SSDEEP 384:Y9tJAeAcdGFJnmOmBKbR+D1XGFI6qjVJy:AbAeA5Jfmsb6FG0j3y
- TLSH T19852B54867E5CB31CBBE46766EB3A7044234F2055D03CF0E39CD42E56C56BBD66223A9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/SystemSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fff226d97dd7782f6e7951a08ab988f23ec42e998f37a90ce0661eb12ab854b9
- MD5 5575389093a0da3b24f5b753382da30c
- SHA1 31d1cd83526ae178e87355369daaa5e189933284
- SHA512 e597cf3f19f554317b667054481977cd112bc4fb7a17acd4f70d3775f7de50004f2bd5b63dac8fd4502154a694eed10eeccbdfa67d0031c5861f07e87b60225d
- SSDEEP 6144:XBU54ZigtwJoqTwag6j6gQEuOeBddE0xuWnBWyhje7JfPzGxcFUpLVbZ+abkiMVH:XBK4ZLuYf7I0cu44elaOFozSVT
- TLSH T1ACB45B5137D49A5BE0BF1376F4F1091747F2E046B2A3EB4B269496B81E83781AD00BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
500430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
481KB
Virtual Size
480KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/UAC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf03846a8d69a71001b6fc66ac6d74ad434736b878405f985926b2fafb4314eb
- MD5 051b4966c17b0d668399d4e8b16eabe7
- SHA1 016388589c50b96da2efc0a579f73a4b64375198
- SHA512 9d437d746af4bfa0b0a8e1cfca388912aa38fce2d4efeb9f643f426d5609195bc26b03b12ebcc954393d5e731b148531f78cc9a9992ac2e19279b72a987b2dc7
- SSDEEP 384:jF4T5SO/5HfGKiacSN/nKKbE69bdbaSOq+bDzri3nUAkYGbHFtslaDu5gFGxO66x:jGTdx/Iac4/nKobRdbJ+H3i3nLg4xEj1
- TLSH T163B2F981B3D88521EBBF4B756CF202114730B56B0C23DF0F5DC545A829A5BE8E771BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Volume.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 21f01ce45befbb78a0ce12d7a626df0f45ed4a1cb1b0006ad44d81c8660a3ed8
- MD5 d41d3a2c37ce09560593b786765d3770
- SHA1 2c105c041f0b9ce2145aec99f48c9df9c5cb4fdc
- SHA512 806c7452eb260ad791ad2a0b8ceaac83f8be95e5f6763eab78ae85d454b857f0f0af2c6821ea65cf92b41b986ef381de04a0da11ac31eb7f32840c2d0957f974
- SSDEEP 6144:yXcm9XQsAjYxzAWIt6WKaf/FrvuRhFQ5KvqjPFUprYbY+rbsBCK8CCMTKP+o:yMm9Wj9zKa1rvuRDHMFood/t
- TLSH T1EFA48E5137E4E52BD0BF67B5F4F1091347B1E04A7222EB4F0A9896AD2D83B91AC407B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
496142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
477KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Window.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 526fda22b12b787582da3f38a3f11d7474b74ad7b2a2423ca563c66e72edf3dd
- MD5 38e772ae9ae643ca1a6283884762daee
- SHA1 baaf3e4379c521c80f0d18b9c1f62352c08086c4
- SHA512 499a0d957eabd75bc86846942fcc9f0f8c02083c2b1c7e8aa02fff28e040d4de2ac15705b00466d04e9b000ce543fbe32e44ff6d68cd6536433eff99035b97d5
- SSDEEP 384:sINbIuZPx19uC7etI3a/AENKEOUgjoB6bGArDI9QmJyK/F/uzmjVbBM0M:TPPs4ogbGoav9j1W0M
- TLSH T1AE72F80A53E58A61C2FC06F9A5235B058671E3529843EF1F2CDC92F16D52BBD62027ED
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/Plugins/Worm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ee58ab97c1648c5af3647950297cef9be21745d6a7f3afe82e5594aabc810928
- MD5 da063a8ef1a5cb01dbd2c9ba906037e5
- SHA1 98bb1f3d522ab5312c19f131d389bc20862496fe
- SHA512 8a4c93dfa0d678c6d95592f9161bce5bcedff7f69f57edbab9721cad9a20521b588c34a7015482d3ce870dba99436a745853f19bea8fade43cc9075deb2d565b
- SSDEEP 24576:AOhZOvj5N/pxou6EGrwIaoivP5DkvjK47LJb1LPE4KTv7frWyHN:ABMV1a3P+vjNLPfKL
- TLSH T111E5D3026EB49D3FD33A1AFF90E1433456ACAC0B92DE964A757CFD691C72A401BC4762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3059646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
LibSploit/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 39845b81c509ff9c30c1830f6c03a969268657131e54683381ca6490eced25e0
- MD5 18d231cc32c13fa5aa08440983b68b98
- SHA1 2f2ce04b1ecaab9395c53477ccfc217917ceba70
- SHA512 b4f9bd28d9949e5c600d15227f6434c42985088d9b9900f1279d4507297e179d8f94eaed5987c1cc6b79cf189dffbcfbe0391de3f468a03ee7593e59608386e2
- SSDEEP 24576:2Hlj3heQjg1UU0FN4ziQX3rMgs72c2UXjwVH0zeHEFhA9Iv7f4NGPB:GrmYDXi
- TLSH T19E455B1533FC9777D0AE873AE835052503F1E90AA697EB4B6610EB697C837689C103E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1182062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ