RAZX FREE CHAMES[.]exe

General

Target
RAZX FREE CHAMES.exe
Size 1.6MB
Sample260722-pxwjcsvfqg
SHA256 965c615a44453581294d3157f714074b2499559b7454a7380551a2c8149d9740
MD5 a5057b6f838abcaf58cc76a84cc9301f
SHA1 d3a5e0fd6f1597cb3a489fa0ea22bbb3b13ad21b
SHA512 c79427ddce541275e0f743393459067ec6903bbc3c209e9bb5bca778165c853501179f4b11bb2c67e0ee635716002d2c39949a87ec9e49abdd8ac5be4be741eb
SSDEEP 49152:WAjys7tNQJ/W2nWVTpxH2T9TpM4iWbsadXZ:BjysHjtTpkT9TC4+ad
TLSH
T11075CF66A25E00EAE9276035415BBF4BD437781A234167DFB3D605042FEE3D076BE38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
RAZX FREE CHAMES.exe
unpack001/costura.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/guna.ui2.dll

File Explorer

RAZX FREE CHAMES.exe

.exe 1.6MB
costura.dll

.dll 5KB
costura.pdb

7KB
guna.ui2.dll

.dll 2.1MB

RAZX FREE CHAMES.exe

SHA256 965c615a44453581294d3157f714074b2499559b7454a7380551a2c8149d9740
MD5 a5057b6f838abcaf58cc76a84cc9301f
SHA1 d3a5e0fd6f1597cb3a489fa0ea22bbb3b13ad21b
SHA512 c79427ddce541275e0f743393459067ec6903bbc3c209e9bb5bca778165c853501179f4b11bb2c67e0ee635716002d2c39949a87ec9e49abdd8ac5be4be741eb
SSDEEP 49152:WAjys7tNQJ/W2nWVTpxH2T9TpM4iWbsadXZ:BjysHjtTpkT9TC4+ad
TLSH
T11075CF66A25E00EAE9276035415BBF4BD437781A234167DFB3D605042FEE3D076BE38A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\RAZX FREE CHAMES\RAZX FREE CHAMES\obj\Debug\RAZX FREE CHAMES.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6771700a3bbd39251648d73bae181c3a4fa978ac40cccf4d5e2ac7815f18b406
MD5 27180a8ccb9c7d93bc5e1a95d67d3dbe
SHA1 31531eea4711cf48d5e834ff92738769389ee1cd
SHA512 f7ef2014320f82ff98c825b90a7229d74fe39b0e33fa7826b35f214dd5c51918c61e63acae8c19c42d817bd6ad571c9983766516c791b304db697df9dc5cf564
SSDEEP 48:6vP2nhx3BTjtRiaAVLEF4iZ6iMtTg706YElaWTJFu2FY+cYH6AWk1qyFVw2Ib8:JHtRYVLE4YjYELTru2FZFWv2
TLSH
T1A6B1FB28A7B8533BEF7BCB72585353804374BD10D92B5B1F1AC562172C323948931722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\303409\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ad0ba156fcd20c5c06b173e5af8b16aeaffbae06fce9771b35974e4700c7952
MD5 f1d04f21d43efa8b2819ef86a48c1811
SHA1 f2deac990818bb151966950a665f49e681498533
SHA512 2987b7be6be37f3ab02225c284d2e0140550793a3943002a42e53ae4cb547e78cdc2fc588145b1d871b619cbb96b3047eb8b76a014385e141608a40c7ca9b55f
SSDEEP 24576:YtmmRH02jXmJyezxrqwEZLBhMVMQW/R5IZoTqVumG8WIsodFldtYzJMDnZoFF9H5:YEvKiV7rk1FFz
TLSH
T19EA509183DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66E3576C18427857C867AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

89:6f:ae:23:a2:b3:09:9e:91:db:05:6f:49:2c:6c:50:19:d6:cb:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

2196462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

RAZX FREE CHAMES.exe

generic

costura.dll

mscoree

dotnet

costura.pdb

guna.ui2.dll

PE Signature issue

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

RAZX FREE CHAMES.exe

generic

costura.dll

mscoree

dotnet

costura.pdb

guna.ui2.dll

PE Signature issue

mscoree

dotnet