NeptuneRAT 5.0 (2).zip
- SHA256 813627329ddd21cfa3419470318fbb490734c5682cff073770d13e1cd681a0c6
Overview
overview
7Static
static
3NeptuneRAT...2).zip
windows10-2004-x64
1NeptuneRAT...2).zip
windows10-ltsc_2021-x64
1NeptuneRAT....0.exe
windows10-2004-x64
7NeptuneRAT....0.exe
windows10-ltsc_2021-x64
7NeptuneRAT...ws.dll
windows10-2004-x64
1NeptuneRAT...ws.dll
windows10-ltsc_2021-x64
1NeptuneRAT...ll.dll
windows10-2004-x64
1NeptuneRAT...ll.dll
windows10-ltsc_2021-x64
1NeptuneRAT...PU.dll
windows10-2004-x64
1NeptuneRAT...PU.dll
windows10-ltsc_2021-x64
1NeptuneRAT...ss.dll
windows10-2004-x64
1NeptuneRAT...ss.dll
windows10-ltsc_2021-x64
1NeptuneRAT...ns.dll
windows10-2004-x64
1NeptuneRAT...ns.dll
windows10-ltsc_2021-x64
1NeptuneRAT...ps.dll
windows10-2004-x64
1NeptuneRAT...ps.dll
windows10-ltsc_2021-x64
1NeptuneRAT...ne.dll
windows10-2004-x64
1NeptuneRAT...ne.dll
windows10-ltsc_2021-x64
1NeptuneRAT...io.dll
windows10-2004-x64
1NeptuneRAT...io.dll
windows10-ltsc_2021-x64
1NeptuneRAT...or.dll
windows10-2004-x64
1NeptuneRAT...or.dll
windows10-ltsc_2021-x64
1NeptuneRAT...ol.dll
windows10-2004-x64
1NeptuneRAT...ol.dll
windows10-ltsc_2021-x64
1NeptuneRAT...ws.dll
windows10-2004-x64
1NeptuneRAT...ws.dll
windows10-ltsc_2021-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NeptuneRAT 5.0 (2).zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
NeptuneRAT 5.0 (2).zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
NeptuneRAT 5.0/NeptuneRAT.5.0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral4
Sample
NeptuneRAT 5.0/NeptuneRAT.5.0.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
900 seconds
Behavioral task
behavioral5
Sample
NeptuneRAT 5.0/Plugins/ACTWindows.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
NeptuneRAT 5.0/Plugins/ACTWindows.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
NeptuneRAT 5.0/Plugins/Install.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
NeptuneRAT 5.0/Plugins/Install.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
NeptuneRAT 5.0/Plugins/KillCPU.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
NeptuneRAT 5.0/Plugins/KillCPU.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
NeptuneRAT 5.0/Plugins/KillProcess.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
NeptuneRAT 5.0/Plugins/KillProcess.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
NeptuneRAT 5.0/Plugins/LockApplications.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
NeptuneRAT 5.0/Plugins/LockApplications.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
NeptuneRAT 5.0/Plugins/Maps.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
NeptuneRAT 5.0/Plugins/Maps.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
NeptuneRAT 5.0/Plugins/Microphone.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral18
Sample
NeptuneRAT 5.0/Plugins/Microphone.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral19
Sample
NeptuneRAT 5.0/Plugins/NAudio.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral20
Sample
NeptuneRAT 5.0/Plugins/NAudio.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral21
Sample
NeptuneRAT 5.0/SimpleObfuscator.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
NeptuneRAT 5.0/SimpleObfuscator.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
NeptuneRAT 5.0/System.Security.AccessControl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral24
Sample
NeptuneRAT 5.0/System.Security.AccessControl.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral25
Sample
NeptuneRAT 5.0/System.Security.Principal.Windows.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
NeptuneRAT 5.0/System.Security.Principal.Windows.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
General
- Target NeptuneRAT 5.0 (2).zip
- Size 1.2MB
- Sample260717-ramdaagw8v
- SHA256 813627329ddd21cfa3419470318fbb490734c5682cff073770d13e1cd681a0c6
- MD5 1c0e7d293e0a14834a605c5dc5799ce8
- SHA1 747dc63498f1082fef894d0a37a21ee702b48ac4
- SHA512 32b08cda37609aede059739736aab31134e45fe3f008831744d35016024bd2d1079294136cbef8de6631acdc512e967fc2d13c7d22cdaf5f6844f756d272e248
- SSDEEP 24576:UE1zoqL5K/8DiFCPr/XnCKUituyj5j0XXaLEDOqZm1Xeyl:vMqM/8DiFQrNfjaXqLEDDw9eyl
- TLSH T1A6453363BB8E5DB0ED773175108E368C7CFED15568035C0E960B7A242179DB3A2BB642
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/NeptuneRAT 5.0/NeptuneRAT.5.0.exe unpack001/NeptuneRAT 5.0/Plugins/ACTWindows.dll unpack001/NeptuneRAT 5.0/Plugins/Install.dll unpack001/NeptuneRAT 5.0/Plugins/KillCPU.dll unpack001/NeptuneRAT 5.0/Plugins/KillProcess.dll unpack001/NeptuneRAT 5.0/Plugins/LockApplications.dll unpack001/NeptuneRAT 5.0/Plugins/Maps.dll unpack001/NeptuneRAT 5.0/Plugins/Microphone.dll unpack001/NeptuneRAT 5.0/SimpleObfuscator.dll
File Explorer
-
NeptuneRAT 5.0 (2).zip.zip 1.2MB
-
NeptuneRAT 5.0/NeptuneRAT.5.0.exe.exe 304KB
-
NeptuneRAT 5.0/Plugins/ACTWindows.dll.dll 10KB
-
NeptuneRAT 5.0/Plugins/Install.dll.dll 10KB
-
NeptuneRAT 5.0/Plugins/KillCPU.dll.dll 11KB
-
NeptuneRAT 5.0/Plugins/KillProcess.dll.dll 14KB
-
NeptuneRAT 5.0/Plugins/LockApplications.dll.dll 10KB
-
NeptuneRAT 5.0/Plugins/Maps.dll.dll 15KB
-
NeptuneRAT 5.0/Plugins/Microphone.dll.dll 539KB
-
NeptuneRAT 5.0/Plugins/NAudio.dll.dll 502KB
-
NeptuneRAT 5.0/SimpleObfuscator.dll.dll 1.3MB
-
NeptuneRAT 5.0/System.Security.AccessControl.dll.dll 30KB
-
NeptuneRAT 5.0/System.Security.Principal.Windows.dll.dll 14KB
NeptuneRAT 5.0/NeptuneRAT.5.0.exe
- IMPHASH 2b94e23e7baa034d7decb21d46cbf770
- SHA256 f13bd5b1b415ea7c3ab97c18d4f509a7af2122727fc64a61b3b7bd661eb1bdc9
- MD5 0be424b78ff76c24c9d63956f74c041d
- SHA1 df61ef338d82e45cb63229b952bd6df5ce0d1d51
- SHA512 6fcda4e02ca23c9e97bb049cc620f2fb85ef0d46a7f81cf1032a7764a19a5d076234c99f9eb292e68c8ed5ce908350a0e83112583542750bd949f55f830625dc
- SSDEEP 6144:R1WYcygEBwZYI0V84nbJ3oGQ4QsBcqcxYbcPGbUPI:Rh0EoYI6/nF3jcs+qzIew
- TLSH T10E64D0217AD0C5B1D4B7043148F4EAB94A7DF8750B119DEF2388277E4A243D19A36AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
37070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SizeofResource
InitializeCriticalSectionEx
WaitForSingleObject
FreeResource
MultiByteToWideChar
GetLastError
LoadLibraryA
LockResource
GlobalAlloc
GlobalFree
CloseHandle
CreateThread
LoadResource
FindResourceW
DecodePointer
GetProcAddress
GlobalLock
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
GlobalUnlock
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
WriteConsoleW
FlushFileBuffers
GetStringTypeW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
HeapSize
WideCharToMultiByte
LCMapStringW
CompareStringW
HeapAlloc
TlsSetValue
SetLastError
RtlUnwind
LocalFree
LeaveCriticalSection
EnterCriticalSection
RaiseException
HeapFree
SetStdHandle
GetConsoleOutputCP
GetConsoleMode
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
GetFileType
CreateFileW
SetFilePointerEx
LoadLibraryExW
OutputDebugStringW
FreeLibrary
TlsFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
user32
UnhookWinEvent
SetWinEventHook
SystemParametersInfoW
PostQuitMessage
KillTimer
DrawTextW
GetClientRect
LoadCursorW
TranslateMessage
EnumWindows
SetTimer
DispatchMessageW
IsWindow
ShowWindow
RegisterClassExW
CreateWindowExW
SetWindowPos
DefWindowProcW
EndPaint
BeginPaint
GetAncestor
IsWindowVisible
GetWindowLongW
GetWindowThreadProcessId
GetMessageW
DestroyWindow
PostMessageW
InvalidateRect
ole32
OleInitialize
CreateStreamOnHGlobal
oleaut32
SafeArrayDestroy
VariantInit
SysFreeString
SysAllocString
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayCreateVector
SafeArrayAccessData
VariantClear
gdiplus
GdipCreatePen1
GdipDeletePen
GdipGetImageWidth
GdipDeleteGraphics
GdipCreateFromHDC
GdipFree
GdipLoadImageFromStreamICM
GdipSetPixelOffsetMode
GdipDrawLine
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipCloneImage
GdipGetImageHeight
GdiplusStartup
GdiplusShutdown
Name
.text
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=259, version=30795,
count=149, id=261, version=30795,
count=21, id=260, version=30795,
count=4, id=253, version=34321,
count=20, id=259, version=34321,
count=18, id=260, version=34321,
count=48, id=261, version=34321,
count=11, id=257, version=30795,
count=159, id=1, productName=Unmarked objects,
count=16, id=264, version=34436,
count=1, id=258, version=34436,
NeptuneRAT 5.0/Plugins/ACTWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2eb4052edbb4ab611e3ba9d8bca13c16ecf2f15735c067f6166b72405941aa27
- MD5 e868c10d267e8f5daa0b22e6976f072f
- SHA1 e9b542466b950132e53f43db1a451d19e43e4cb5
- SHA512 4e4d35beb5cbdcda55072e22c7784d47f19e97be24c022e2d1802d4b2117f033b4f133cd0ee1bb8cb00519e5e60bec4f97afb4705c04285b95a7f7e0c58ebc3c
- SSDEEP 192:V29alCi98OgSwNxyPlaMrp5O+Rx71tvTkIW1PnZLFzSTSQMLuOF:V/lCi987HyNHrpw+5tvTunZxzMSQOF
- TLSH T10222096957E08335CDFB0AB3585397510774CA08D913FB6F18D8B046EDA326987E2729
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/Plugins/Install.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6cb5a6c1e0fda7f764de99f62cf58d26b514523a339d1b26ca7fbead7eb0435f
- MD5 207b83beb3e1fa8579ebac63dace1731
- SHA1 83ad53b7f24f1aa55ea66e559e20c985ba5416ec
- SHA512 3651dbd8e948ffbdccd3e3d54c0f4fc2fdd207769ca4823d441bd36ba0f1dbd742edbd53f8666a9aa6806b306d42ca147d6459cc629283688409752780e4f415
- SSDEEP 192:mJklM7hSMO340nynmQbKGOibaz1hbBIW1UM/uUOa9nxJwLWM:mJsMhOLnyZ3XbOhbYM/19nxJM
- TLSH T144222B15ABD042B5C8BE0F769C63160147B2E705CD23FB3E69E4A2194CA33658BB1AB1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/Plugins/KillCPU.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e3e6d4e0b7e0590737c1c807903810dd352951543a91e3cc4c2942b8c1b9d2d
- MD5 9b1164bd19a288b3cab77469a8978703
- SHA1 cebfa54ea39d0589f622ff171e8f047ea7e33182
- SHA512 b2106a1e3aeb686b580f8b5692c3bf1ccec62f450cf7ffd3b5758a2111eee35e286070848d9c30a33b6ab29f712883c5941d3f70164639176421eeaf9a2e7ef1
- SSDEEP 192:OX82FapXzhMh1NmEgAEGNwfOjLKJ1iqSIW1Un/KxT+ubdjTlHLW2N:OsN9Mh1LgpUw48iq7n/GquZjY2N
- TLSH T12C321A26A3D44379C8ED0AF64C3373434731D7088913FB7E68D4A9251EBB25856E2FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
896B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/Plugins/KillProcess.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bfefe85ead82555fd68a53eaba9d1604810212b2a4435a8dc309038e7e3a692e
- MD5 0eb00d04c332e45c6952470362c80d1a
- SHA1 8b0325077d13535344637acfbb0791184cc941fd
- SHA512 be554ef76382967907ca075a6d0c24f546f4b648be4bbfbbec64b3fe1aedf74ff1f42c5a306d6a164328d2672cdcbbf4e74e76bc1cedf06800d5d87e44803149
- SSDEEP 384:91ksD8g86Fx5XYydeLojb8kWMGdpAxs5ezuyWkt:5zLPXYsGPezug
- TLSH T11762F99853E04535E27E6FB51972A20047B3FE069C52FA5D4980F18E5EB3358CBE1A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/Plugins/LockApplications.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 20a28a50e694f840461a2b7a089114d6356af61a097fefc36727a9c2d395ba4b
- MD5 8183c705b0b6161270cbf9156be74d73
- SHA1 1332b8b5c54d2ba20cd2dc713f6abd4b9562bdac
- SHA512 725530e11a33a7503826d7660cbb258ca429f06c6684b4f7abe7b96cfedef93b38fd946fd1e6f1aead9e0133506fecca14df8509638e67f297a0eace4ff55905
- SSDEEP 192:R7QHqDQqpMrGO5ib1EiTxIW1Pn/+kMpC0ewL2H:RWqH+qqwFTbn/+kMpC0iH
- TLSH T1AA22E925E7E44275DDFB1B726CA362410775FD088D23B72F1DC4B0661CA36958BA2B31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 06a1d45ff28850115c36fbc110d361bbb0ac224958de86c09cbb0c4826d4f045
- MD5 db403de3e2cd0cfe89112684e34b278e
- SHA1 c9cd8326a6fed612a9143e296b951a86021ad8b5
- SHA512 4a28f6c4873ddf2ec35dfa8e45a4157a0a37b7d8aca953690cffeecddc53e84cb3affef72dab14c48047ce0b7ea5744ca32c492380f801020d21495ef9ecdf9c
- SSDEEP 192:O4/n3oEIh6xL40Xhzpa0hZWB1jxjX7kNN56gGte31HCKM6IW14X/b8YIF3tAJLur:VngcV40X/l4jcPyteFiKsX/bSt9o2
- TLSH T1A6621955B7E4C272C6FE1FB64C72A20047B6E605CD07FF2EA5C860694A63792CE60727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4492aecda17cd5a31be59a3fba0ccd06c63f0a0b7773a8a83e6831c2ebe06001
- MD5 b7134dfd9e5dbe9e36740c9114f66c79
- SHA1 bd0fefadd74aff707db640638d66cae2f26ca03c
- SHA512 80aa15f717e915082dfefc3dcb02c1bcb400bc60a9cee991172b5ff5415da27b861ce9b1da113e172492b0bd7bb7ad13a8bf46eac2795913a4ee0b16bd419fe2
- SSDEEP 12288:ocHij8LgXvwMZEvBFbgBqDvoNvfv3FSu:jHipXvF2vDbgBSvoK
- TLSH T155C46C15BBD49527E06F3772E0E20F2E57B4E48AB316EB8F449097E85E937464C40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/Plugins/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7caa6b9ff04aac89bcd324f73d96be3153a7456a0aad282d19f225e6473f5790
- MD5 a6314905fef88e334b24951c87d5fa64
- SHA1 8ec7aaf6a8e350099b62a8d2510b81f1e0882e2c
- SHA512 ea4b7ee050a218ed4fc411c2147eac9d219a9f274676ceb59868bc6d74f26a60f1c92cee8ba415dc24792c5261526750dd821ffc470035432363255c998589ed
- SSDEEP 24576:OB4F9bgtOr7iZVrnLuKYT9g+16hRrfh/v7fYm:OB4F9bIVZVrnLuKYT9g+0lT
- TLSH T1A2554A50B7ECDE37D16E0B75A4B005241BF5D406B323EB8F1A68A6F86D53B016C492BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1377294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/System.Security.AccessControl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
- MD5 2d3e0b4ddf8628b41057b2aceef296eb
- SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
- SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
- SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
- TLSH T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4f:c3:ec:31:89:27:00:92:43:e3:5e:92:97:46:45:aa:bf:13:7d:68:b8:13:75:e9:a9:9d:47:54:0a:3f:8b:59
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:fe:01:f0:b5:1e:ff:e9:f9:ad:00:00:00:00:00:fe
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 6, 2019 - Dec 4, 2020
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
26694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.AccessControl/net461-Windows_NT-Release/System.Security.AccessControl.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NeptuneRAT 5.0/System.Security.Principal.Windows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
- MD5 b40bda63658a012d46f930c243b77056
- SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
- SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
- SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
- TLSH T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
66:14:6a:1c:ea:9c:3d:ac:d8:5a:fb:65:4e:52:79:df:9d:05:29:ea:6b:fd:f3:7b:a3:29:c0:13:11:0a:76:da
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 15, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:51:9e:8d:8f:40:71:a3:0e:41:00:00:00:00:01:51
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=WA,C=US
Serial Number
33:00:00:01:07:7e:37:68:98:87:5a:37:d6:00:00:00:00:01:07
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 8, 2019 - Jan 3, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
11394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ