XiDRF.rar
- SHA256 1cb4b244745973a9860dd395f760d53cfd8eacb3fda18283f4d39771a69d4ebe
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XiDRF.rar
Resource
win11ltsc2024-20260709-fr
windows11-ltsc_2024-x64
10 signatures
900 seconds
General
- Target XiDRF.rar
- Size 63.4MB
- Sample260722-a2wmlawfnf
- SHA256 1cb4b244745973a9860dd395f760d53cfd8eacb3fda18283f4d39771a69d4ebe
- MD5 882c5f8cf62400acd29f9bf2b3696a80
- SHA1 4eff78d809087aae874ff151888d9bc4539c6df1
- SHA512 77aadcfda8eb73100e8b271a613a180cf15328a4d7f75c2e1151aedb89bde9b2e6dbdd8fb6825e3612982c9489f3af08c8ee85b3ab44d4e125b96ee07961a766
- SSDEEP 1572864:XzysEmlX5DK0SvCYBnqUaXfK3t0N1FIL7qJAavY4VdPY0n3c:XzmcXo0SvCYBnq1XfK3t0N1eaqaA47PE
- TLSH T1B5E733596AFEE47315CA88B0BF9096300576E673DBE0CC8061B7095D0FA278CADF616D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/XiDRF/BTCPay/BTCPay.exe unpack001/XiDRF/BTCPay/QRCoder.dll
File Explorer
-
XiDRF.rar.rar 63.4MB
-
XiDRF/BTCPay/BTCPay.exe.exe 2.1MB
-
XiDRF/BTCPay/Newtonsoft.Json.dll.dll 695KB
-
XiDRF/BTCPay/QRCoder.dll.dll 141KB
-
XiDRF/info.txt2KB
-
XiDRF/movie XiDRF.mp4221.3MB
XiDRF/BTCPay/BTCPay.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 504abfba8e240f39a8d7e7376e4c9abf124acb53d3c0e15b4bb8c9840f76ea9a
- MD5 9c5f9af10ab759194498e4e730f8a3c4
- SHA1 e2f6a174d28544a6dff60f8ea5945e6272d0dccf
- SHA512 92efd83b017d447a3fba467b8d2e46cd4482da1e0649479086a1c0452cd95fca66be8520aaefd6f54cbe799c87f02c78d3d796b95952932479a6ac1c036319fd
- SSDEEP 24576:xkSpqbog4zRYnzXbuhIzsEG0LzINyFAz9w2ql3Yxi4N1f/5/C7Ti3D3fjJeo1hJ+:xCohERK2AzHM4fx0KjJZby4M
- TLSH T1E9A5233917948E14CE3D22FCB49925490F66DCD0AA53FF25FBC076689B322D88475AE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2167414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\elix\source\repos\2\test\test\obj\Debug\test.pdb
mscoree
_CorExeMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XiDRF/BTCPay/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XiDRF/BTCPay/QRCoder.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 561acfe4b1a14c837b189fb9fc5c6d3e82440184bbde61912de723d62d6368b3
- MD5 7e189090d52fec41c0c87657bdfc18c3
- SHA1 8ef2b8f984216a04769bb4f99f936961c46196a5
- SHA512 aecfa2819e8bd308549e83b54749b2fe3034238c34512cd87f584fb2b8779891a143e2b0fee450b174a77f441b5f935fc8473a526ce3d0b4520537aa4f3f29dc
- SSDEEP 3072:E4wM6OoRu7qywKsqxhDuPr5xJMnOfMAw3TkHjt0QQNOWIkHUsz72ot:E4wZywKn/U5xEwKIk0W
- TLSH T1C1E37D2567E88A17E1BF3B75E87000609B72F85679B7DB4E0D8CA4ED1572BC08851BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
140854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\QRCoder\QRCoder\QRCoder\obj\Release\net40\QRCoder.pdb
mscoree
_CorDllMain
Name
.text
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XiDRF/info.txt
- SHA256 b27870907d678ba9347d49e197277a1ac18fd99fbb096fab87afdc971a85ce7f
- MD5 dee781decfc1d2906f2838f0986a9186
- SHA1 fe9667417c35cc89bd6e4ff2299c71b0e9e4f101
- SHA512 e3c576a47e915b319d74a5827f4e97280b7079774054af88b5fb523bffed661cbd18dd56c27dd2ac85f9e5429873f4d16a9146b3e849756376960d02beee996a
- TLSH T18951A87FBE98658318C6C2927B465F22EE3D8704E0B2D3A6D99F015B0155C482E1E09C
- MD5 SHA1 SHA512 TLSH
XiDRF/movie XiDRF.mp4
- SHA256 5852d6797c99604ba2df5d825714fb5243200bfed77d543b9e58d2e785f83726
- MD5 b78975305107656895772217c42c7697
- SHA1 48f06b452c1598ebfc76c2a7bb8d357230343c5f
- SHA512 99540cfa25768b42d92901dc88e702568681fc2b037fd1ecc54acc148f72a44bd29324b02b510c96db2b9654b7f1c77653fecde92f88d5c0bfc07a601016a0d8
- SSDEEP 3145728:X602hViP0pj7nFC33j9ISqGcRxUorXlTjEGHw0ZIiNUauktBPuMNij9Z7S2ZtV1b:X602hViWO6nOX
- TLSH T11BB823AAB37416A7C1B14E3C9C4F032872D1E1F1D25E1659D21B9C331C3ABAA7C1A7D9
- MD5 SHA1 SHA512 SSDEEP TLSH