CVE-2020-0796-POC.zip
- SHA256 95fd7245b23299876812a9c0edc495bb77289a5455500250da8c62d186d7925d
Overview
overview
3Static
static
3CVE-2020-0796-POC.exe
windows10-2004-x64
1CVE-2020-0796-POC.exe
windows11-ltsc_2024-x64
1Microsoft....se.dll
windows10-2004-x64
1Microsoft....se.dll
windows11-ltsc_2024-x64
1Microsoft....ss.dll
windows10-2004-x64
1Microsoft....ss.dll
windows11-ltsc_2024-x64
1Microsoft....ce.dll
windows10-2004-x64
1Microsoft....ce.dll
windows11-ltsc_2024-x64
1Microsoft....es.dll
windows10-2004-x64
1Microsoft....es.dll
windows11-ltsc_2024-x64
1Microsoft....ib.dll
windows10-2004-x64
1Microsoft....ib.dll
windows11-ltsc_2024-x64
1Microsoft....mp.dll
windows10-2004-x64
1Microsoft....mp.dll
windows11-ltsc_2024-x64
1Microsoft....pi.dll
windows10-2004-x64
1Microsoft....pi.dll
windows11-ltsc_2024-x64
1Microsoft....rt.dll
windows10-2004-x64
1Microsoft....rt.dll
windows11-ltsc_2024-x64
1Microsoft....dk.dll
windows10-2004-x64
1Microsoft....dk.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CVE-2020-0796-POC.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
CVE-2020-0796-POC.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Microsoft.Protocols.TestTools.StackSdk.Asn1Base.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Microsoft.Protocols.TestTools.StackSdk.Asn1Base.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Microsoft.Protocols.TestTools.StackSdk.Compression.Xpress.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Microsoft.Protocols.TestTools.StackSdk.Compression.Xpress.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Microsoft.Protocols.TestTools.StackSdk.FileAccessService.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Microsoft.Protocols.TestTools.StackSdk.FileAccessService.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Microsoft.Protocols.TestTools.StackSdk.Messages.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Microsoft.Protocols.TestTools.StackSdk.Messages.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Microsoft.Protocols.TestTools.StackSdk.Security.CryptoLib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Microsoft.Protocols.TestTools.StackSdk.Security.CryptoLib.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Microsoft.Protocols.TestTools.StackSdk.Security.Nlmp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Microsoft.Protocols.TestTools.StackSdk.Security.Nlmp.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Microsoft.Protocols.TestTools.StackSdk.Security.Sspi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Microsoft.Protocols.TestTools.StackSdk.Security.Sspi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Microsoft.Protocols.TestTools.StackSdk.Transport.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Microsoft.Protocols.TestTools.StackSdk.Transport.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Microsoft.Protocols.TestTools.StackSdk.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Microsoft.Protocols.TestTools.StackSdk.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target CVE-2020-0796-POC.zip
- Size 409KB
- Sample260715-eylqfabv9l
- SHA256 95fd7245b23299876812a9c0edc495bb77289a5455500250da8c62d186d7925d
- MD5 b919bc31e56f584e11bc6620c912b0bd
- SHA1 503f87e3bd9b0f875182cefd7aaa40910f81443f
- SHA512 94ecf2dbd6370cb8eaa6bf4c0a96406628585f81ee4668677e527039bf569830f184537ad9529bc85da9198da5b6a67493cb6712cf6ac696847e350095a6bd53
- SSDEEP 12288:IYUCdfXnDnI8abM9k72pb0Aa6YUPHEChk+glkGF1:IY7975uM9kJAaOkcqdP
- TLSH T1D1942358D8E2C809DC245F349D96C62F5BF4D0AA06531EBB02A657848AEF4F4075EEFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/CVE-2020-0796-POC.exe unpack001/Microsoft.Protocols.TestTools.StackSdk.Asn1Base.dll unpack001/Microsoft.Protocols.TestTools.StackSdk.Compression.Xpress.dll unpack001/Microsoft.Protocols.TestTools.StackSdk.FileAccessService.dll unpack001/Microsoft.Protocols.TestTools.StackSdk.Messages.dll unpack001/Microsoft.Protocols.TestTools.StackSdk.Security.CryptoLib.dll unpack001/Microsoft.Protocols.TestTools.StackSdk.Security.Nlmp.dll unpack001/Microsoft.Protocols.TestTools.StackSdk.Security.Sspi.dll unpack001/Microsoft.Protocols.TestTools.StackSdk.Transport.dll unpack001/Microsoft.Protocols.TestTools.StackSdk.dll
File Explorer
-
CVE-2020-0796-POC.zip.zip 409KB
-
CVE-2020-0796-POC.exe.exe 181KB
-
Microsoft.Protocols.TestTools.StackSdk.Asn1Base.dll.dll 54KB
-
Microsoft.Protocols.TestTools.StackSdk.Compression.Xpress.dll.dll 25KB
-
Microsoft.Protocols.TestTools.StackSdk.FileAccessService.dll.dll 30KB
-
Microsoft.Protocols.TestTools.StackSdk.Messages.dll.dll 126KB
-
Microsoft.Protocols.TestTools.StackSdk.Security.CryptoLib.dll.dll 75KB
-
Microsoft.Protocols.TestTools.StackSdk.Security.Nlmp.dll.dll 58KB
-
Microsoft.Protocols.TestTools.StackSdk.Security.Sspi.dll.dll 44KB
-
Microsoft.Protocols.TestTools.StackSdk.Transport.dll.dll 103KB
-
Microsoft.Protocols.TestTools.StackSdk.dll.dll 370KB
CVE-2020-0796-POC.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a7581bd9425e8377e98cf3d806d95fc379cc290de36f3a517625bc8d35e763a6
- MD5 eba24f5e2da54c20971db606f0e8c2e2
- SHA1 442cfd8f4282970f87dcd5a5778997a62200e90a
- SHA512 e23da6871c6b34245ccbfa6087663e0c95beed54e6876efa10e943de89b6f7e1456c70c78d5bee1b1a24294bd34ae8d33e97e8541bd15fb0cc847767cd9b6942
- SSDEEP 3072:c6AJTH0JM+bRrEbdX4uR6XcC65dg9Vu1hxbKVLy6xmrOmjI:c6AJAtEbdIhXmf9bKVLy6RK
- TLSH T156046C1315E4AE58E56E1FBBD5F08432033CA1937627F75F0A45A9F52C327428A62BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\MS-SMB2\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.FileAccessService.Smb2.pdb
mscoree
_CorExeMain
Name
.text
Size
178KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.Asn1Base.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3eb5381109f344f04b549f73eacb34e4dc966aaa7b653553956c128b19024799
- MD5 317bf16afdc3c2df606a9742474cf001
- SHA1 b31a6972693c1add1f5dba55c5ae72d3a7730e91
- SHA512 b5d68a1357c2cc83af921650ddcd1a5a6f5594c1a867d44980ba5ae7e301f23e5d166a006fd9eaf3ed6758af553516378943bcd99c7b706e1856539cfa70f00f
- SSDEEP 768:wywnt0Yza8bR1EB9QIZ/WrqtG/HQoRgOJlH56ns1y/vAkPwPZPOu6UkPp:wySrza8bnEB9jZ/XGjgcZ6s1ywkPQBA
- TLSH T1C043F64466F88B19F5FE6B7E54B1071013B8FE523D32E72D5F8464AE1862F408E60B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\Asn1Base\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.Asn1Base.pdb
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.Compression.Xpress.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a6312b93fd9831bf7a1fefeb41ec268b7ff4fa4420d95d819c1e1ff65e1600a7
- MD5 7b92c1c7928c5c800e9333587e784cdb
- SHA1 6af444659048992573dabb1d615ea4b61d5c49ed
- SHA512 7818873e15ce548429c3fb5993a982b9519ee6520e0dda798b7379cf1b42cee7ea351d5b102df691532ff20ddecadb68632da2f42b3d54f63364dc710a255829
- SSDEEP 768:V4vpf4YMDlsmX4+DFGVrQslBn/87+z2KT95IFJq:OvpfSlxX4+5GVFn/87+zd95Ii
- TLSH T1D0C24C1C67D0C236D4BA4D7E917282150BF1ED127621F34E8F59A4AE3E6371088A5F77
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\MS-XCA\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.Compression.Xpress.pdb
mscoree
_CorDllMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.FileAccessService.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 731e5246ccd5386a646af921d874d9aefa28ce5b28a8a4b1e18832c684f5c0d6
- MD5 6015aa122653a227a16a39e07d3c019b
- SHA1 8e4b2bdb1e826e0ab0efcf5fed20dc1aec0f217a
- SHA512 49b44fe7fbecd1b84e8aed6260e7cfc007bfe55fae4efddd07ba9144d52417da8cf611f7f79e108d0ec0dfb1eabf48e684ad2440028c73ae12447249d863b57b
- SSDEEP 384:0U29KnoVGntXKCzxDnxyiklYEoIpmBH3huR8nkqv45edVS3NGmE/e/WV:DxnoZCzxNyjl+xPkcq3Ph6
- TLSH T155D2E749E258A23ED59D877CB8E245211334A1C17B27E72A6FA490B93CB77C4C8627C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36234
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\FileAccessService\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.FileAccessService.pdb
mscoree
_CorDllMain
Name
.text
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.Messages.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d55622365cd17fcc4f7143e377eb330ddd94fdc00b8ed5752e9922c145c4dad5
- MD5 2f2798591bd9b8a609f547bdcb9290c8
- SHA1 bb2d50d7d8ee289b5d846aa331c00be390ea6e57
- SHA512 40d751ce36dd571282e1f397143dfafa7184c623d347bc0affebecfe14676a055f0a3f9464ea8f90b9bed2176fb32ebde801e3a96ed67417c7850c27aaccf0c3
- SSDEEP 3072:K8T7Ej/pQeT/8R9Ti26Q7l1dcwykvc0UgmQRJT6PJUnwNiW:zT7E3zueYlgt
- TLSH T124C3F66857E84A19D2AE6B3DE4F4212047B0F812A863F70E4B86A0FD2D73B54DD507B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
135010
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\Messages\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.Messages.pdb
mscoree
_CorDllMain
Name
.text
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.Security.CryptoLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2d67d6bee8c1deabc54c8f7424b763acc79a6de8495c670921bed4d2c0490024
- MD5 cbe738c6acc9cb34301e483342da7c37
- SHA1 f03bfbfaa9d97e8159341d656f769effac9f1b1d
- SHA512 54581d92ce402f5717d64704102085e000c07e7af548eb4a6519c00252c5948ff9bf6fbb82b8ce6a3b5b9b939f43750120d0032dbaa54d6c439a95cd66505db1
- SSDEEP 1536:HzlEHKORplmu90TSzUmqAK5eEHKB9bGdQ5JdbhH:5X4Wq621K5eEw9bGdQ5JLH
- TLSH T17A73082D6BE40223D5FD9B7E94B10209A378F843B912FF8D11D151A82A737D3998275F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
82174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\CryptoLib\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.Security.CryptoLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.Security.Nlmp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b991b6b559d8d9b73abe7ebc85c86b2418f686cf7db9e5b427064a299f742c21
- MD5 00dbe749abd9e22e69ef480ba4e0971d
- SHA1 d514a38c6afb7b24f9de67860f57582318c3ab0f
- SHA512 a118ea278a1e0371401a7b5b0d0e64d7053c8a245e94ec98af10fccd4a62f4e69c878f4003fea167b5c9d3f4eea4267d8ea383449de0c1dc7c4e4b287a3486d5
- SSDEEP 1536:zsVZ3duEjKLrVreMpAFi1Jw26z1eh/LYwQlq1ydYk1D4KeRMJagSuNW:zsVZCTq2/LYwQlq27JagSuNW
- TLSH T1DC43E9486BF8593BD17F17BC54B2415303B8B602AA23E75D5F4424F918B37E0E921BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
65314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\MS-NLMP\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.Security.Nlmp.pdb
mscoree
_CorDllMain
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.Security.Sspi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 566f265c63627024472da6e4efdae97edeb4117ea85142939ee6dcc8900f198d
- MD5 ba284d422e18edcd28bac0845f1782dc
- SHA1 05d3eacd2f9c8ce2ec1270c515ab5277b4597224
- SHA512 4585f32c9abb99dc2b89e5dea646ba39e2e8c19caa3efe7d00df77d2b2f56fcb451af06ace1c3f005461e38e41c1d7a32ee90328554fe53785bc3454e150ca2f
- SSDEEP 768:X7quHFhAqOH6ze5XMvi1IJsWeKfFPB4RJvBLNyojAw:X7qulhAfNai2JsWeKfJB4RNVNyojAw
- TLSH T1F1135C08ADD90129E97E7B7C71F3848A4778B0D22213F32F17D1245A375A7A5D206BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\Sspi\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.Security.Sspi.pdb
mscoree
_CorDllMain
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.Transport.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d96c477a4dd04b141dc6fa2bdd6ccab89a9fe8402b17ddd6f0df5a9fa40880b6
- MD5 688848330902cd1e5105e0905c8022c4
- SHA1 ffd3b1c1e4818b5da0d7cad2e09529d87e4df909
- SHA512 9724363ccac1bf432b0ab7c8c46142e5c707f2c3b6ee4abad99d0081e62649ba6c707e037e85536d083ea447d355e000bd37176a08c8c19fdadf0e7ccfe784bc
- SSDEEP 1536:M5niECdywy9hPcWafPCaQlWohZbI9imw+3LVtqF3h0HOwNiqB1jI3wyV4u:QniECdywy9aPZg0QpmvIyHVB1jI3Px
- TLSH T1D5A3B30437F48A04D5BE6BFAD8B1120507797AD23A2BE70F4AA464F92C72F518D24F67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
111906
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\TransportStack\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.Transport.pdb
mscoree
_CorDllMain
Name
.text
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Protocols.TestTools.StackSdk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2a224a7fc23fa88206fa3b37ad27730fe30ceb603adb2825d6a8e42a58090c2a
- MD5 de74060cbc5fda3126c2c1ca5d8e3d1b
- SHA1 1d57cab9580805805867a23f718724aae6e75469
- SHA512 ea289e8a6fa2b6db8d13a74c0fc17e707554a309b21d3d582c748beb4bde9d3570c5b32c2d07da77fa06b366f69357eeaee55553f61ebea7e8d110746da4f39b
- SSDEEP 6144:Wpw0kShPKo8WjvRTjz1ZgySWRt2AnFpm2cGUOoKyf3UnXY:iw0Pyo8odjxDRLFpAGUOpyPUn
- TLSH T1EA840505AE252F3BD909C57934323BB616F8520B63AA763CA9BCF66C35E4D421D307D2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
385174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\user\Desktop\CVE-2020-0796-POC\ProtoSDK\Common\obj\Debug\Microsoft.Protocols.TestTools.StackSdk.pdb
mscoree
_CorDllMain
Name
.text
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ