LEGIT INJECTOR V3[.]exe

resource
LEGIT INJECTOR V3.exe
unpack001/bittuui.dll
unpack001/costura.dll
unpack001/memory-x64.dll

resource
unpack001/guna.ui2.dll

LEGIT INJECTOR V3.exe

SHA256 1eaa3c436d8a19df6baffe145e606f4754154c6ce647e753c6b1d1a7bc36b171
MD5 39b9bb1efe9a2ba6fe78deec50b8c3c3
SHA1 56e92a851c5d7a341f170066738c7072e301159c
SHA512 29fc8a38242d7a4bdcc1840131fbb24bba06344b75d2d011edfa61f2115052a36c698548fce6c6bfeef15c746a5b4303112f5cf41af78a94c1b6bacd266501e3
SSDEEP 24576:7CN0e4r7YFz75ELy9vS9/aOHR+Sf4xYcxMN8j:ONna7anKy1S9/aOHRnSBxM2
TLSH
T1E045228875A94A6BC1FE04F92866D4D187FB6423A551C3C78CE632DF1AD2354C28F78B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Bittu\Desktop\LEGIT INJECTOR V3\LEGIT INJECTOR V3\obj\Debug\LEGIT INJECTOR V3.pdb

bittuui.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 50a0bea06bdc204275521adbdc51cea1fabfdde50e0fb2821a394d8e60799a9b
MD5 f5bf453dc82aec0ffaed9c6f64ed8e9d
SHA1 d8cb6bb3322c7ea69b2a5fd7cf68c3cc95fb8243
SHA512 aa92bc7763a4aa749278de051083f8c9b5e38accfe90ec5ac213615211ef37fcf23efb4f87df54ed1810c409f0d852f3f6243b80a1085fef8706da387539203a
SSDEEP 3072:Yt8QviFPfacRbvyMdYBGiIqzNAqGbVIc9Xu5U5+swI:YiQCPfbr+gi1zNAZbV85Uos
TLSH
T1DA243A40A3D8863FE29F5B7CE0791051C732E71A701ED759ADD894FC29A376C848E2A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

230278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Bittu\Desktop\asd\BittuUI\BittuUI\obj\Release\net48\BittuUI.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 669478d9ba0c65f634896bef2598d0e4daebcf322dfdb80c8bcb566197aa407b
MD5 eac8d8c1d89a9df0c2cdeaad81b52330
SHA1 94c545ed2a1b2485cec9102b7a75954f4aeb768d
SHA512 ca1abea53ac90af310b1f130926ef6ba66f1bf465a8ebc2c9d20d7f4be59ad0ccaf439c50b8beda301d6275d32a8c32754a936c2b415c1c74871645eb59ae377
SSDEEP 48:6bc82nhx3BTjtRiaAVLE04iZ6iMtTg704Ela7TJFu+6SV2H7nAWk1qyFVh2Ibt:GiHtRYVLELYvEmTru+6w2cWK2
TLSH
T108B1FC2467B82737EF7B8B7659A353814774BE50C92BAF1F098562066C363908D31B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\300961\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 5365d3084158503be4c4ca39f0c6336bbdfbae204cd9d26734114e65a48c8def
MD5 d48daee983649297de5dd71402177dce
SHA1 333d3f968665e249db702bdac57c8d5405c26a05
SHA512 52c382f8b29c0556f4a40ab26dcb949cb66af42d34502e2b981985e6fe21c2c171fd45d59a1b4590269ede344eefe4c6bcd29ed0f5bb6e4eac2d69950d2cd87b
SSDEEP 192:61zyMDX2XDninPI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu0T:61WFzePI6jMai+NLy5nj4SCm5Mz6QkOg
TLSH
T1C4F1B33F6748C463C85A5A724521C49CB67343202674ED78F3CB2A08EDAF699C7B5B72
MD5 SHA1 SHA512 SSDEEP TLSH

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
MD5 b464fc896b14bfa34f608da53856e999
SHA1 55568eecc97895cad49a42bffe757e3588c5313c
SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
TLSH
T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:ea:da:1b:68:34:55:c7:9d:54:32:02:aa:3a:3b:97:1e:fa:ea:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Feb 18, 2025

CN=Sobatdata Software

Minor OS version

0

Major OS version

4

Entry point

2188926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

memory-x64.dll

SHA256 30153941919af67cdeabfbd58f8eb578038dd484a92b0b387d56a6fce3bfb066
MD5 b4e67e9340feef5a39d7a8305e18749b
SHA1 c75bdc79f273772b7c3a15ea22b48d5f78021a39
SHA512 4a96b59ed7a80151473747ce4aa0a8b71d7400ef176c584de5ce23d56bddc59855ea5d9f253c568aa73bc18024fc54386bc9e0a774d6454a1cfe7096f4f090e5
SSDEEP 768:2uUsMqB/PZGxolQi9T9nvmCAaNZ7XzVTYDu96O0yqtYcFwVc6K:2zchy0QAHNZ7D5YDw0yGwVcl
TLSH
T1E7036D486BA89350E5AECBB8A07141C043B1906F2123DB59BCCCA4F6EF763D586536D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\memory.dll\memory.dll\memory\obj\Release\netstandard2.0\win-x64\Memory.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

08:39:56:e4:21:43:4f:90:03:ee:08:ba:76:09:c5:58:d4:a5:2a:73:28:78:a1:5f:f6:46:d6:59:61:a9:2a:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 16, 2025

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2024 - Nov 3, 2027

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 26, 2024 - Nov 19, 2025

Minor OS version

0

Major OS version

4

Entry point

713798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb