28c7270fd396bdb394328125b6e456cbf87888bec81ddebe4f8f8de35e48ff76.bin
- SHA256 28c7270fd396bdb394328125b6e456cbf87888bec81ddebe4f8f8de35e48ff76
Overview
overview
10Static
static
10SheetRat-m...re.dll
windows10-2004-x64
1SheetRat-m...re.dll
windows11-ltsc_2024-x64
1SheetRat-m...ms.dll
windows10-2004-x64
1SheetRat-m...ms.dll
windows11-ltsc_2024-x64
1SheetRat-m...or.dll
windows10-2004-x64
1SheetRat-m...or.dll
windows11-ltsc_2024-x64
1SheetRat-m...ip.dll
windows10-2004-x64
1SheetRat-m...ip.dll
windows11-ltsc_2024-x64
1SheetRat-m...gn.dll
windows10-2004-x64
1SheetRat-m...gn.dll
windows11-ltsc_2024-x64
1SheetRat-m...ts.dll
windows10-2004-x64
1SheetRat-m...ts.dll
windows11-ltsc_2024-x64
1SheetRat-m...rk.dll
windows10-2004-x64
1SheetRat-m...rk.dll
windows11-ltsc_2024-x64
1SheetRat-m...io.dll
windows10-2004-x64
1SheetRat-m...io.dll
windows11-ltsc_2024-x64
1SheetRat-m...on.dll
windows10-2004-x64
1SheetRat-m...on.dll
windows11-ltsc_2024-x64
1SheetRat-m...un.dll
windows10-2004-x64
1SheetRat-m...un.dll
windows11-ltsc_2024-x64
1SheetRat-m...sk.dll
windows10-2004-x64
1SheetRat-m...sk.dll
windows11-ltsc_2024-x64
1SheetRat-m...at.dll
windows10-2004-x64
1SheetRat-m...at.dll
windows11-ltsc_2024-x64
1SheetRat-m...rd.dll
windows10-2004-x64
1SheetRat-m...rd.dll
windows11-ltsc_2024-x64
1SheetRat-m...os.dll
windows10-2004-x64
1SheetRat-m...os.dll
windows11-ltsc_2024-x64
1SheetRat-m...er.dll
windows10-2004-x64
1SheetRat-m...er.dll
windows11-ltsc_2024-x64
1SheetRat-m...ct.dll
windows10-2004-x64
1SheetRat-m...ct.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
SheetRat-main/SheetRat V2.6/GMap.NET.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SheetRat-main/SheetRat V2.6/GMap.NET.Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SheetRat-main/SheetRat V2.6/GMap.NET.WindowsForms.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
SheetRat-main/SheetRat V2.6/GMap.NET.WindowsForms.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
SheetRat-main/SheetRat V2.6/IconExtractor.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SheetRat-main/SheetRat V2.6/IconExtractor.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SheetRat-main/SheetRat V2.6/Ionic.Zip.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
SheetRat-main/SheetRat V2.6/Ionic.Zip.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
SheetRat-main/SheetRat V2.6/MetroFramework.Design.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
SheetRat-main/SheetRat V2.6/MetroFramework.Design.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
SheetRat-main/SheetRat V2.6/MetroFramework.Fonts.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
SheetRat-main/SheetRat V2.6/MetroFramework.Fonts.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
SheetRat-main/SheetRat V2.6/MetroFramework.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
SheetRat-main/SheetRat V2.6/MetroFramework.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
SheetRat-main/SheetRat V2.6/NAudio.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
SheetRat-main/SheetRat V2.6/NAudio.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
SheetRat-main/SheetRat V2.6/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
SheetRat-main/SheetRat V2.6/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
SheetRat-main/SheetRat V2.6/Plugins/AutoRun.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
SheetRat-main/SheetRat V2.6/Plugins/AutoRun.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
SheetRat-main/SheetRat V2.6/Plugins/AutoTask.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
SheetRat-main/SheetRat V2.6/Plugins/AutoTask.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
SheetRat-main/SheetRat V2.6/Plugins/Chat.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
SheetRat-main/SheetRat V2.6/Plugins/Chat.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
SheetRat-main/SheetRat V2.6/Plugins/Clipboard.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
SheetRat-main/SheetRat V2.6/Plugins/Clipboard.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
SheetRat-main/SheetRat V2.6/Plugins/DDos.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
SheetRat-main/SheetRat V2.6/Plugins/DDos.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
SheetRat-main/SheetRat V2.6/Plugins/FileManager.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
SheetRat-main/SheetRat V2.6/Plugins/FileManager.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
SheetRat-main/SheetRat V2.6/Plugins/FreendConnect.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
SheetRat-main/SheetRat V2.6/Plugins/FreendConnect.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 28c7270fd396bdb394328125b6e456cbf87888bec81ddebe4f8f8de35e48ff76.bin
- Size 8.2MB
- Sample260728-29gl7azzds
- SHA256 28c7270fd396bdb394328125b6e456cbf87888bec81ddebe4f8f8de35e48ff76
- MD5 4fe956cfcce3a65e7d841e3fe2898301
- SHA1 cc4779022b66a993734c62d764a1e0c2bd1e66ab
- SHA512 803d0ceb681748fbdafecbf9a82ec5bcf60daafe248b9c61150b060aacb0b7ff9d81d84d67322efb8f3b7dee9b0ecf42dc6017330d540b5b69f8826a180f0912
- SSDEEP 196608:lDRAMoo20nxkUki2EljCXlDeWexkSIPiNVfhyS307xaXk/JvHJDi9:lDl20nxLL2EljiP0kSPDgSENyk/11a
- TLSH T1B686339E0F878CCAF03574E420B9D733AFA4E6949766E6CA664170D9347A5C488C2FDC
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
tcp.cloudpub.ru:24606
Mutex
-
RFi3owP2zzYAwLY0
Attributes
-
Install_directory
%AppData%
-
install_file
Server.exe
-
telegram
https://api.telegram.org/bot8616726090:AAHLzmwzFhYJjSLs-kDtJdIpHg2fhPxSS0E/sendMessage?chat_id=8696467856
aes.plain
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/SheetRat-main/SheetRat V2.6/Plugins/SystemDisable.dll disable_win_def - Detect Xworm Payload 1 IoCs
resource yara_rule static1/unpack001/SheetRat-main/SheetRat V2.6/Server.exe family_xworm - Detects Sheetrat Payload 1 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule static1/unpack001/SheetRat-main/SheetRat V2.6/Stub/Client.exe family_sheetrat_v1 - Unsigned PE 45 IoCs
Checks for missing Authenticode signature.
resource unpack001/SheetRat-main/SheetRat V2.6/GMap.NET.Core.dll unpack001/SheetRat-main/SheetRat V2.6/GMap.NET.WindowsForms.dll unpack001/SheetRat-main/SheetRat V2.6/IconExtractor.dll unpack001/SheetRat-main/SheetRat V2.6/Ionic.Zip.dll unpack001/SheetRat-main/SheetRat V2.6/MetroFramework.Design.dll unpack001/SheetRat-main/SheetRat V2.6/MetroFramework.Fonts.dll unpack001/SheetRat-main/SheetRat V2.6/MetroFramework.dll unpack001/SheetRat-main/SheetRat V2.6/NAudio.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/AutoRun.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/AutoTask.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Chat.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Clipboard.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/DDos.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/FileManager.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/FreendConnect.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Fun.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Images.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Keylogger.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Map.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Message.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/MicroPhone.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/MinerEtc.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/MinerXmr.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Netstat.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Regedit.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/RemoteCamera.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/RemoteDesktop.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/ReverseProxy.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Scheduler.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/SendFile.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Service.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Shell.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/SpeakBot.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Stealer.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/System.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/SystemDisable.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/TaskMgr.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/Uac.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/WormJoiner.dll unpack001/SheetRat-main/SheetRat V2.6/Plugins/WormSMB.dll unpack001/SheetRat-main/SheetRat V2.6/Server.exe unpack001/SheetRat-main/SheetRat V2.6/Stub/Client.exe unpack001/SheetRat-main/SheetRat V2.6/cGeoIp.dll unpack001/SheetRat-main/SheetRat V2.6/dnlib.dll unpack001/SheetRat-main/SheetRat V2.6/protobuf-net.dll
File Explorer
-
28c7270fd396bdb394328125b6e456cbf87888bec81ddebe4f8f8de35e48ff76.bin.zip 8.2MB
-
SheetRat-main/README.md359B
-
SheetRat-main/SheetRat V2.6/ConfigBulid.json1KB
-
SheetRat-main/SheetRat V2.6/GMap.NET.Core.dll.dll 2.9MB
-
SheetRat-main/SheetRat V2.6/GMap.NET.WindowsForms.dll.dll 147KB
-
SheetRat-main/SheetRat V2.6/IconExtractor.dll.dll 10KB
-
SheetRat-main/SheetRat V2.6/Ionic.Zip.dll.dll 451KB
-
SheetRat-main/SheetRat V2.6/Maps.json2B
-
SheetRat-main/SheetRat V2.6/MetroFramework.Design.dll.dll 16KB
-
SheetRat-main/SheetRat V2.6/MetroFramework.Fonts.dll.dll 656KB
-
SheetRat-main/SheetRat V2.6/MetroFramework.dll.dll 345KB
-
SheetRat-main/SheetRat V2.6/NAudio.dll.dll 464KB
-
SheetRat-main/SheetRat V2.6/Newtonsoft.Json.dll.dll 695KB
-
SheetRat-main/SheetRat V2.6/Plugins/AutoRun.dll.dll 12KB
-
SheetRat-main/SheetRat V2.6/Plugins/AutoTask.dll.dll 95KB
-
SheetRat-main/SheetRat V2.6/Plugins/Chat.dll.dll 14KB
-
SheetRat-main/SheetRat V2.6/Plugins/Clipboard.dll.dll 9KB
-
SheetRat-main/SheetRat V2.6/Plugins/DDos.dll.dll 46KB
-
SheetRat-main/SheetRat V2.6/Plugins/FileManager.dll.dll 495KB
-
SheetRat-main/SheetRat V2.6/Plugins/FreendConnect.dll.dll 23KB
-
SheetRat-main/SheetRat V2.6/Plugins/Fun.dll.dll 45KB
-
SheetRat-main/SheetRat V2.6/Plugins/Images.dll.dll 10KB
-
SheetRat-main/SheetRat V2.6/Plugins/Keylogger.dll.dll 13KB
-
SheetRat-main/SheetRat V2.6/Plugins/Map.dll.dll 10KB
-
SheetRat-main/SheetRat V2.6/Plugins/Message.dll.dll 9KB
-
SheetRat-main/SheetRat V2.6/Plugins/MicroPhone.dll.dll 507KB
-
SheetRat-main/SheetRat V2.6/Plugins/MinerEtc.dll.dll 14KB
-
SheetRat-main/SheetRat V2.6/Plugins/MinerXmr.dll.dll 20KB
-
SheetRat-main/SheetRat V2.6/Plugins/Netstat.dll.dll 12KB
-
SheetRat-main/SheetRat V2.6/Plugins/Regedit.dll.dll 266KB
-
SheetRat-main/SheetRat V2.6/Plugins/RemoteCamera.dll.dll 95KB
-
SheetRat-main/SheetRat V2.6/Plugins/RemoteDesktop.dll.dll 1.2MB
-
SheetRat-main/SheetRat V2.6/Plugins/ReverseProxy.dll.dll 14KB
-
SheetRat-main/SheetRat V2.6/Plugins/Scheduler.dll.dll 353KB
-
SheetRat-main/SheetRat V2.6/Plugins/SendFile.dll.dll 19KB
-
SheetRat-main/SheetRat V2.6/Plugins/Service.dll.dll 10KB
-
SheetRat-main/SheetRat V2.6/Plugins/Shell.dll.dll 11KB
-
SheetRat-main/SheetRat V2.6/Plugins/SpeakBot.dll.dll 9KB
-
SheetRat-main/SheetRat V2.6/Plugins/Stealer.dll.dll 588KB
-
SheetRat-main/SheetRat V2.6/Plugins/System.dll.dll 9KB
-
SheetRat-main/SheetRat V2.6/Plugins/SystemDisable.dll.dll 13KB
-
SheetRat-main/SheetRat V2.6/Plugins/TaskMgr.dll.dll 12KB
-
SheetRat-main/SheetRat V2.6/Plugins/Uac.dll.dll 19KB
-
SheetRat-main/SheetRat V2.6/Plugins/WormJoiner.dll.dll 1.4MB
-
SheetRat-main/SheetRat V2.6/Plugins/WormSMB.dll.dll 458KB
-
SheetRat-main/SheetRat V2.6/Server.exe.exe 45KB
-
SheetRat-main/SheetRat V2.6/Server.exe.config.xml 161B
-
SheetRat-main/SheetRat V2.6/Server.exe.mdb163KB
-
SheetRat-main/SheetRat V2.6/Server.pdb1013KB
-
SheetRat-main/SheetRat V2.6/Stub/Client.exe.exe 47KB
-
SheetRat-main/SheetRat V2.6/cGeoIp.dll.dll 2.3MB
-
SheetRat-main/SheetRat V2.6/dnlib.dll.dll 1.1MB
-
SheetRat-main/SheetRat V2.6/protobuf-net.dll.dll 278KB
SheetRat-main/README.md
- SHA256 a7bf5d61faec390deb5fc770899121d7e16d8fce48a4bc9af3d6283e53ea045b
- MD5 181cfdc474bffc54a7e2ebce169f3f4f
- SHA1 9f31dad30abd645dc0bf1d78dbd01ac6cac800dd
- SHA512 33552e843d0b99b3a7450e12486b910134b8175eaaac94e38146d4024d323887c9f89b2a402e0489fb3df3a5dcd167efdee545fadad64fabb4939ea593c4a216
- TLSH T1BDE020B5229E5C0B2445E91BCD44794DB8AA52BDDA6D851B6528403DB4C44C4457D18E
- MD5 SHA1 SHA512 TLSH
SheetRat-main/SheetRat V2.6/ConfigBulid.json
- SHA256 6b87cafb9701ec8bd7c3c7919281dba170c26a480de5cc3601156fa58b96eaca
- MD5 2cb845fab73e6903153510ee6443db5f
- SHA1 f35031d6b6c095888aa9149f78ae491b9b8fd1bb
- SHA512 f03606aa2973427fef5ffc30d8ae2fb8fbecfbbd4a9b00890f712f8090f41d66028147baaa741eb0c734c82e4a6d75313db623b0eff81e127fad7b6975973bbb
- TLSH T1D32133A2D88416BFB63582ACC414A109BBA94F6E31340C2FF5FBDD24B5A76353590FC4
- MD5 SHA1 SHA512 TLSH
SheetRat-main/SheetRat V2.6/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Ionic.Zip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3b3e541682e48f3fd2872f85a06278da2f3e7877ee956da89b90d732a1eaa0bd
- MD5 6ded8fcbf5f1d9e422b327ca51625e24
- SHA1 8a1140cebc39f6994eef7e8de4627fb7b72a2dd9
- SHA512 bda3a65133b7b1e2765c7d07c7da5103292b3c4c2f0673640428b3e7e8637b11539f06c330ab5d0ba6e2274bd2dcd2c50312be6579e75c4008ff5ae7dae34ce4
- SSDEEP 6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
- TLSH T155A4BE0023DC4A6AE2FE5775D4B782A5C3F2B815793ECB8F9D8464EF191A780D6107A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
467790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\DotNetZip\Zip\obj\Release\Ionic.Zip.pdb
mscoree
_CorDllMain
Name
.text
Size
449KB
Virtual Size
448KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Maps.json
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
SheetRat-main/SheetRat V2.6/MetroFramework.Design.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0a4a96082e25767e4697033649b16c76a652e120757a2cecab8092ad0d716b65
- MD5 ab4c3529694fc8d2427434825f71b2b8
- SHA1 7be378e382e43eae84f1567b3570bca9a67e7697
- SHA512 02d7935f68c30457da79ad7b039b22caed11d8aedfec7c96619ac6da59ceb7c5e7a758dced64ec02d31c37a2befccdc8eb59be9e2dc849aa2bc22fabb5fa00a5
- SSDEEP 384:HYAB8KPALBamLG3gckiBTVU6sgFf5L7WTOYKpKG4rw:HyLBamS3gckiBTVkgiVXr
- TLSH T114723205B2FC423AE7EFC5336BA945503D74A90DA872CA1C1CE80AF959F67424AD1F53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
e:\Development\Desktop\Github\winforms-modernui\MetroFramework.Design\obj\Release\MetroFramework.Design.pdb
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/MetroFramework.Fonts.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c843869aaca5135c2d47296985f35c71ca8af4431288d04d481c4e46cc93ee26
- MD5 65ef4b23060128743cef937a43b82aa3
- SHA1 cc72536b84384ec8479b9734b947dce885ef5d31
- SHA512 d06690f9aac0c6500aed387f692b3305dfc0708b08fc2f27eaa44b108908ccd8267b07f8fb8608eef5c803039caeabf8f88a18b7e5b1d850f32bbb72bcd3b0b7
- SSDEEP 12288:O+/9JcJlYqCNktA+SXfGpq2fHowSqCNktA+SXfvJR9FrIJJaqCNktA+SXfUC:O+/3qlrCNoh+UqgIwhCNoh+JR9FrIJJw
- TLSH T1D2E429B5760139E6EF11C4B7C260FD80192BB863A77B402A68E3077A88575CDFE53E46
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
677726
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
e:\Development\Desktop\Github\winforms-modernui\MetroFramework.Fonts\obj\Release\MetroFramework.Fonts.pdb
mscoree
_CorDllMain
Name
.text
Size
654KB
Virtual Size
653KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
- MD5 34ea7f7d66563f724318e322ff08f4db
- SHA1 d0aa8038a92eb43def2fffbbf4114b02636117c5
- SHA512 dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
- SSDEEP 6144:M4S7k5hdCpU4YqfkUGz6KpQQZQHDXjNCdOZgLdL5DXBK:M4S7k5hdCEQHP1Zgj
- TLSH T1C8745C111399452AE1FF423AB457084187F7AE12F6BEEBAD69CCE0EC5F937414A42363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
358670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
342KB
Virtual Size
342KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8e347abc9301d67dd7493a0fbbe5cc1f912900c204a84220cc8cdf0e0b8df0de
- MD5 2e68aeb46e26a29ffe74cf97b94cbaf0
- SHA1 9384fa2946f744be3b47e131df14cbc0632052d2
- SHA512 39e56b0dd316e9a927ffeff486969f2a472f9b262b6a131afa60c34baa01784cde9cc6944f1a46ee73f3cc7135cb0049cc5a4bdfa419fab37667829522f6e7c9
- SSDEEP 6144:igY2UEI+85kQDHzER++2a4cSuEsHTyRwl0AYTA7qkpRMUwbX/1rFXF:TY/HXQl40HHdS4qYWN1F
- TLSH T175A47D2233E4582BE4AF5776E8F40D2B47B2F5463976EBCF65446A6D1C837424E00BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
477866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
462KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/AutoRun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f8c4e2f96fe1030a276cd7fb6c5e5a0a675f953f2b33db08fdff3d472658d098
- MD5 2d1298818aa582a1f1dd51dedf879cbf
- SHA1 429d01cabab977bcade38754ed28d8793ce1592d
- SHA512 0f482a322df5ee24c99348ea084bb358e37c7a8137afa46132aa7c06f1119c12b5ac711344263eb9556ce179738bebe58af6fd72c57933d8ae2a7d60dfba71fd
- SSDEEP 192:MIoRKIwOQJOsOTtiavNAf9/HFd8BPCP2a2uPzNcg8wFlxUSod:aRKDOaOsOTtiaVk9/lYPCP2a2uxZISM
- TLSH T14942CA09EBE0466AD97D5E3A187243958332AE47B503DF9F0DC830DA6B263C58611FD1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18626
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\AutoRun\obj\Release\AutoRun.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/AutoTask.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 15af12989304a01758c21b2fa884d54c4fda89c57b4baea1ee155ec912d2a019
- MD5 9b1c988ccc0ccff1dbdbef692d68f98b
- SHA1 90a7898daba862987dc793855516c1e06504c2ce
- SHA512 143d3fa458910496ed5af32dc5ad56c7142292aca847b4a189ff650fa3623b93657274bd704b1d5ce246b6c58442b41baba8a9540bcdf635cd8a6bf7df763de9
- SSDEEP 1536:SpLLddrrRW8yyQQSScDB33ZZXXVK5vc7IrZdbWDNv6piPUiR+IpQpB+rmT715/wL:SpLLddrrRW8yyQQSScDB33ZZXXVKpc7r
- TLSH T11D935A5177B8C567D1AE92F1A1B647548B70C202B217F3DA5EF814FC2C637804AA27DB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
102954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\AutoTask.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 68c12c72a722fbf333352aad3308d297642e81d3298a9db7a10fbaf9042aea52
- MD5 61f46a6a9dd8464648fc70402aad5fa7
- SHA1 6f527ab6fc489df4c3882ab32f9cbcf3abc2f17f
- SHA512 44263c4bad2d2c17a1e87d682dada5855c31c8018ea8f28aaec5746a87643c29aa1554bc8a8da774f2bd43dc9009f4e721191c9fbe3a12b60c85ce028e556256
- SSDEEP 192:fclXwW7eCEW0aGMuisfC5GsTT9gsn9Tu5IPa9iiAKxfjd:Ulg2eBH7isK5Gs+09Tu5IPpiA4fjd
- TLSH T10C622A2577B4867BCA7D2AF654E31384037657222403DFDB9DD520CEAF9ABC446107C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Chat\obj\Release\Chat.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 343c783191ce6fa824d6b64cb870b1f7fd41fe4cbdf0e17600d3615c444faa41
- MD5 d923f938fa89c84fe23cc827e4d71724
- SHA1 9c9a4d7a8b15b2e4a192f6d961c1241cb4d5326e
- SHA512 bc6766b5ba446034933a7031435056bbc93ce3f1ec2bbc8a6a98e4b0fa7bc708732b6c7bb4abf3dc7aba277b6f76100540fdb9ba85d8672d0cc778a4c3efd9ec
- SSDEEP 96:YCM73NjKIwOQcOsOC2708r4l+RnMqPM2cwRM92tTHoMbqLO:1iJKIwOQcOsOz7Jrh1WAC4tTIMbqq
- TLSH T10C121A15A774C67BDDAA063214BB83C04770D356751BDF9F0C98A4932F163C50321BE4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Clipboard\obj\Release\Clipboard.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/DDos.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2d2a9c2fb00dc750c42a4a95e3d3c0ae7e8cb88e6d552b4f6f4036574e44e6f7
- MD5 fbbc4990bd0e1ca66ac73c485031e248
- SHA1 0d60c79a871cb742d1cfecda82274e0ef672dad4
- SHA512 67374f52b35f897e90a5f6f064d2c3a5b3fa9d62ce42b258b1cbc13d3614ca5d1086a660a0362ce2824414247655a809f64842c795e8c39f545f6603917af31f
- SSDEEP 768:RIgSs5YPhaEDOVrqEkhshVh5hnh3hJhvh4nBlTOrktdzdxGqObI9DjWROrZk:RIu8JOgEkWj/RxfZwQOre
- TLSH T15B231F14B3F01311F1FB627DA8F62506A93E7606FD32CBCE15B6620A0D627858885F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\DDos\obj\Release\DDos.pdb
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d810c06b22ca39684f331324ef2fb0bba844b6226b5914eb2ad53d60400d9c34
- MD5 669839e8aa78dc5112750da95cf90ce2
- SHA1 e4d164308c6af1bca6115c64160e923e81546c6e
- SHA512 4139209c70c2505dda1d8a000013b882ddbbe414544e10035809b9de67629512b74bd5fbbc1481498833918ce9603dc03ebd59924cf162d2c5574227a7932afe
- SSDEEP 6144:TI10mIHHP5HyGtSV41QJDsTDDtUMle6ZjxLV/u9HnAdKgy:W0mEZpS4YsVUCe65fu9aKg
- TLSH T1C8B48D006BD4C65BF1BE27B5D0F292A1C771F462FA6EEB8F5D4024EE1C12344A9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
513202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\FileManager.pdb
mscoree
_CorDllMain
Name
.text
Size
493KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/FreendConnect.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0e6791e5b6d85042ede3350ad7ca6ac0dd745c33ee3cc5c9524a772b0b5a84d7
- MD5 013f33041e38febf4a3775aa5db0fa53
- SHA1 b7adb51c9323e038f38e4dde23d0c78be8022d86
- SHA512 4c7307778662b437b6f6a642c4c218f46147bf981db7e1cb65241778cb09d509434afea56da6e29290566fbc5f9e9cf2393966522d3334a3f142fb049d99757e
- SSDEEP 384:4nIgTys1UIC05qWP6EhfoGe1t5qbvw8TA9h/yKqS5RZR5ExDYcm:ulTyi7CaeXUbvuLqpYcm
- TLSH T1A9B23A0473D4C22DD1EE87792CB2971546B2E68B9903EF5E5CCC64FA193B7D08A10BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\FreendConnect\obj\Release\FreendConnect.pdb
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Fun.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0fcb98533f6857132bd43168d31379475e4463c9069597bb553acdecd04482b2
- MD5 0e149283390d3272a652661627a0dddd
- SHA1 673b608a1485d5a2282e3862b617dc8992ff7954
- SHA512 6f9f6ac379394bd58ad9bc0cab77152c196dc4b11452b3ee1c960f14cee68d459fc2d9ad3706595b6964530e44138875cf5e36dd741d7c41a48ceb0485cb3e85
- SSDEEP 768:vhzTf/SqfaQdc6qBdwCFTyWp+UErybV1KfGGPzbGaUys/K8Fb6EN3tEmtJqu3XH7:lff8BdwCFTyWp+UErybV1KflPzC/K8FT
- TLSH T1A6234A1377E88518E2BD0BB594E3334A8231B6972416DB9F1DD920FE09B53D69710FCA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Fun\obj\Release\Fun.pdb
mscoree
_CorDllMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Images.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 af002a64edb80fb4c2704d433c6914181c2f4e2897c9552bc8fb27c15ca7b032
- MD5 1b6911796f17f08c84b51bf830d137ee
- SHA1 bd53ffb0177ce3003a41ef462cf36b91bd27cb5b
- SHA512 d31ae80eec94c76b9214f5daf90ecce9e74ec2c2e53156f52b392b236c5740d2004230a77a921713ddb48107bce53ac63bdf593653ddbbbe4038150da79f72e9
- SSDEEP 192:2XRmwOQJOsOekkWhl5Rg34XtLhNx7pOS+OjMbTP:oRFOaOsOeKhl5OyRhNx7pYOjMHP
- TLSH T115220811A7B4C27BC9BD0B361AB3934043359B426907DF6B4D98608A9E1B3CCA3227DD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16754
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Images\obj\Release\Images.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c234be82ce510981279a3d1e7f19b121cf63d066463a9da53b96d3d20573c0bf
- MD5 eb59ed6b40756e38d4d8484309a2132f
- SHA1 371b54789f857460c51370c600b47db98eedd405
- SHA512 cfb84003c82208e18ccc0f15b5cc1f971a5849961b513f5442aef13783ccf7ac2bbd6b41d97e9cdbdf5c4187c1623cb55b7d58e6d0e712896068cf84213abb56
- SSDEEP 192:XRKKIwOQmOsOX7poh4L1ncwRO4MprN/vMP0sXuDaVnux7V:hKKDO1OsOVIaA40N/UPVuDax07V
- TLSH T1815217097BE5823EDABE463B567353804BB0D6026957CF9B4DE9205E0F2A7C203127E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Keylogger\obj\Release\Keylogger.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Map.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a43c0dfa281a5011fc24bdcb377afcc6bfe6f0280a5452e993f8eccba695601d
- MD5 9a855fef0fcbf9e52fc947dd50cc8c76
- SHA1 dc2b23e32322d4353f7a674c147ea4f8afb76fed
- SHA512 33a5a4d664fcbd79663f3b83038e303efb763720821f0310cc25ec8a6b07b776f44c5367239ec59ef9ae5ae86b83a2f30e22879ac7ddd3dd2e5f7a3d5ae98842
- SSDEEP 192:GQDKIwOQ+OsOeuQzVw06ZTbXj6vMwoQyNZ73sj4b/b:DDKDOdOsOeupzjoMvf3sjc/b
- TLSH T19D222B1AAB74C67AE7BE4176586357440772D3836603DB9F8D98A0C61E0F3C90B25BF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15970
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\ClassLibrary1\obj\Release\Map.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Message.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 92e9ce567622ea1f71981e237dcfd2064b6d4d249e7d714e9bce946968538528
- MD5 da2c19714d375aa2e4a6068778de4475
- SHA1 57b9f2c656edf6c168eb1678905f99eddcb90d94
- SHA512 d58a780e1930549816bd5a1c755ba2d95f63c9a6098372dbee504392eaa3b7678e2a7c335a91adaca710b41c2e00701b0c848fea94e3e19413b4111024bc5ba7
- SSDEEP 192:dQBKIwOQb7OsO5omvu2eG9UU1j9d+sm5:+BKDOkOsO1u2l9Usjpm5
- TLSH T1AC12D901ABB0C27BF9BE0A36A5B397D44775E7425906DB6F485C70830E173C68225BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15434
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\MesssageBox\obj\Release\Message.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/MicroPhone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 330169869ee9bc196fb7b30675a1df8b74a7f29a6413ebcc09a561017600e528
- MD5 0e1934fa764c9b76e6034e698dddc0f3
- SHA1 a4239ad6dcf3871b301945f916a214a3c3c29427
- SHA512 f8eac6a35bda30a15756e16635477fa42c316bfd81e5314f44948954bed20c6286eefbcb05b7c14b5d94e025eebd3a8165f1d860191945f17a2c0697ba423417
- SSDEEP 12288:d7aFnooD9e9FRj05u/WX9avbdN5UwMeWmB8:tu/D9qx05GiaBN5XB8
- TLSH T141B45B117BE4DD2BC06F37B6F4E20E2747F4E58AB266EB8B55801BA52D83B455C007A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
524686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\MicroPhone.pdb
mscoree
_CorDllMain
Name
.text
Size
505KB
Virtual Size
504KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/MinerEtc.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ad2970fc3b56fa9c9db1dd1d2a309398b216cce3dd750b6b562e13a7c198311
- MD5 9810d96bfd7236070008baf843c9e3f9
- SHA1 e2f306d064f82193b7fe1b2fe8f4c83b3a6db6e3
- SHA512 81f94596a9b3fac9945632ba04e08386c259aab7f60300a5352305d1808408bf6e21e8e087c963f39831be84e0d9600f6007f1704643c44b5b1e129f987cc9f4
- SSDEEP 384:+HgIeyB9nyO0NOTmFHHV8A/r8ZGcgM5rQtoCW:+HFB9MxT8rn
- TLSH T16762195277D48B3AEABD463B58B347584731F6876A13CB8F5CE820991B367CD1A10BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\MinerEtc\obj\Release\MinerEtc.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/MinerXmr.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5c1d6717a5adede293ca0cfbaeffc805add2eb1086d50c9b3465eea35391a395
- MD5 99fa25800b9fae285578f10f94028664
- SHA1 51e08fd7c41e857776efdb1562178bd7126f4b6b
- SHA512 e64eb8ed8183c0d78c25f7bb67b267792bf34cb8a7d72deac457cda8a69f16b737e8972f588ce58566c10fda6f57fa389c59ee5637f8e91ea7f51724dad9a3dc
- SSDEEP 384:LvgteruwfCeOZ2FcUbpg7gF1rTcUEj28A/fsoi1PD1OMI4C3CiC6CjCU4YztvXW:Lv1Cfr7gj0CMomC3CiC6CjC3YJ
- TLSH T14292F80577F48626F1FE8B7964B282184676BE83AD02CF4E4DF9604D0A75BC85A20FD9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26262
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\MinerXmr\obj\Release\MinerXmr.pdb
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Netstat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c5fda1aa90d4bbc8762e488f8bfcf98d90993a4cccac1a866a9701a76cdb237f
- MD5 89a00c87c006c3a62058c0e748d2bd2e
- SHA1 902af277b4216bedac469ef06eabceaacbf6c1c1
- SHA512 d8d1fbb7bec76feaa48fd28f2c541c824d759a2fa3b9a244a17859452309eb901f73d864151a8808991eee7ebbd8542a8152a78409b44d398f032e5b2239e1b2
- SSDEEP 192:fCoKIwOQwOsOrgKpHIvlYKdeUXswRbXArvgwyz5lTTJd2oaRZx1C0FD:6oKDO7OsOPHq6KdeUXs2bX+ny9Jf2oab
- TLSH T155421A45AB60877ACB7D897210F343894778A7436A02DF9F09E850AD2E2F7CC0720BD9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Netstat\obj\Release\Netstat.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 545cfbeda56f5ec6b81aca09c8223eeb70b21bf3b0289bf79b357748a6c76668
- MD5 96aceb766c4167a1a0b73c54e6870692
- SHA1 6a258c0ba2e7caad0e86aa47660fb7b7f6810c9f
- SHA512 2e712f0dd7aba4348d162688ae9c68b77db79c39b71a2cc2eac80b5289ba251ffd2c215096b4d7a39f5957a244286eb9307aa3c03f5947f5fdc5d545083d8ea8
- SSDEEP 3072:dHmRQfn0eqpQn7FDS+NkI0wgMz7loHShEblIEm4Tl:dHmGMu7FG/KzgShy/m4T
- TLSH T1F2440824ABE8CA1BF1BF77F984B8062C4BF5F41AE65AE74A049410F90D1374469193BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
278394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\Regedit.pdb
mscoree
_CorDllMain
Name
.text
Size
264KB
Virtual Size
264KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ec88f225bf1fff7549ba31b05226f0016ab98626932ea84ecd865fde71d4c159
- MD5 74a4bc3ed25d524e6a1768bd6ea6e229
- SHA1 5283cfb3c7bfadbf47d6c7546ad699a19a5cfcbc
- SHA512 ae8ab2e380455a0ab0d7c5100213c6d1ee25acd567ca03ac48e91c272aa2e4633a622bc68fd0827f7394795f774c1d7e43785a2ffa01b19c413d36a9896fd8b4
- SSDEEP 1536:7TCCYYiikT7ddjj99nVquu00OOYmb7e9EAmkGXdiPUM8+IpQai+QWS9hM0OLlunx:7TCCYYiikT7ddjj99nVquu00OOYmbSyY
- TLSH T129934BA26BA9C56BD2AF27F5A4A34B048B70C2126117F3CB1EB414FC6C537814E617E7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\RemoteCamera.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 00ef2b35b123bde84809dc64e06f37481942687d293bc7d0dc1951be251cf07b
- MD5 d46706e1258899d78b68729805aeaaa9
- SHA1 a7ae2a37dc06c81a5f6223ce6970d39d9e661fae
- SHA512 8cc0706f4b9b81a25b1917ef5a320cef77ccb49bec182fa5c5f0940f2688b5422852d7c8f253c23d0c5876603aabeaa7385e52845173c4174f556166d7cf226a
- SSDEEP 24576:i2vONVAx+95vf8ROmqdWHI8s3FFFFFFFFGTt+xt:ilNVAxU5vf8Rnqd7FFFFFFFFy
- TLSH T14E555B51FFE06EA6C08F36BEF4A159130AB0B0411276E78B4B46216D9FC73849D1ABD7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1311238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\RemoteDesktop.pdb
mscoree
_CorDllMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 99997873b952b44998d9c28a25d26c97046c6152f517deb9c06f738733df7415
- MD5 da656fe7d882ae6f8c78101acf4e0a2a
- SHA1 99a183d8fcbab8b8e594627989b260ff1494558c
- SHA512 3b666d5c1e5a21facab580ad6837bab267c64c902f25af9fdf185e60e3c4d73a64681c987471803e3c48182e9b526cd35173ed3cb28d101e402638c7b9c344d4
- SSDEEP 192:OrkovhiP3SiKixEgeFdTzTbBSQEbho52J1XBCyCmmYLUnCP0w4:OrkovhhZikF9zBSQahogUyCmDYCP4
- TLSH T11262D6229FE88A7BE37C473454B253119332A84A3B83DB8F8D5834D76D2F7C192117A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20554
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\ReverseProxy\obj\Release\ReverseProxy.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Scheduler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b51f402c92ee111b1fba7998e6481070a68c9f2342a33c5252bc319e48889c85
- MD5 a7a60058cde00b981f30b878bad81305
- SHA1 979fe9709a694654d099e5b52abc39be6be60a62
- SHA512 0c000a9f7e3a35c90a49279b9e4635752bbe374c2f6927d13e64e6252d7a09b48018a201e196e38fd01e6c426d937436a3586d7e125cc1919220c8819c1d16f9
- SSDEEP 3072:ykNXpEpNdgFR6+/7fbRwUqQK8vOQqny8EeWycJ5Dfwr9g0Sh5043gxeM72R6lCrD:9pEpDgP/7f1Jarv43by2nIDM65+lc
- TLSH T1D4744C10EFE8C22BE5BF17B6E4B302104BB5F586D566DB4F148864DC1C63349AE523AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
367326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\Scheduler.pdb
mscoree
_CorDllMain
Name
.text
Size
351KB
Virtual Size
350KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d396f3c20883a3b71244c87c537595108010239e4e17e6c09bca83ea5a475677
- MD5 75ef0d23e82fe64a3ac7980a57149aa2
- SHA1 2e1505803f415c2f2c033a2b8996df0ed916f8a6
- SHA512 9b99b78cc3a94e68d72d2a5aadf07a12c6b18c0e076a25e17533323b7d8cfb86d05ce7e0b46aaf8821070bb369e277f28bc9d3c957904a6de66257e3502734e5
- SSDEEP 384:YJFOHOsOdVOB4jRKkACgdRngHPkHiMjWR+bSh0XSW9Ot575MZ919pCBmvec:Yi49g3FHiM1biF5wrMX
- TLSH T19F922B0DABE886A6D5EE4D762CB2861047B0FB175E03CB4F5CE990DD1E633C192507DA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25570
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\SendFile\obj\Release\SendFile.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Service.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2a8c6e202547543b3230641976d83f6f73552b511dff7e4d3d67331a568fc27
- MD5 5784f50a914a811660b9f52dd06582cc
- SHA1 7657546e28dff1d6aefef1e686fbc0d94fd49fa3
- SHA512 d9bc3053733e085eb0b7dd69d99abce60822dd19ee2cba390448509de4365b56fe38f8d4f7837a4c5432f851cbc4f0ea070ce2046dc58518e86208f11393d339
- SSDEEP 192:d/3KIwOQwOsONbvnTyk44gopk6rBX2PVTriUR4IOY:R3KDO7OsO1vnTB4OVtX2PV/lRzOY
- TLSH T17A222906ABD486BAE9AE4A7348B343044375B786A947CB5F4DD8709B2E563CD1B327C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Service\obj\Release\Service.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 814ff32263b24e91ad6a8d00e6a9fce3e79bee939d76824d8727b04d772b4fa3
- MD5 3d2ba275ab2effe84b2133e454369d8d
- SHA1 459409c58abb1a9a3dfa982e4936b5cc0113f701
- SHA512 46fb7675a51df8b15c0460ba2d774d83b9630caa1fbc7cbab417ab4a966cbf30e9e64f3ee6e2e65cb1650d1cf431a2682b4f680256d8c3598b845cbeaf062977
- SSDEEP 192:oh87KIwOQSOsO/BC7hY1VxyZZTXoJc8aDPf/1BdTjtZD/ym:N7KDOROsO/BC7EVxpEPftBJjtZD/h
- TLSH T118320911ABF4C67FC9BD453618B3871042B4A3866907CF8F5CD460DA6F2ABC997227C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Shell\obj\Release\Shell.pdb
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/SpeakBot.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f5cf80fdd20004e3a9613cb4bdfcfc388f84c8f94db88698da68ba450ff2b2c7
- MD5 8ecf481177682ecb8902dd85f7dcc607
- SHA1 0575c5068aabab48ab3b5895128cd95743dbd5da
- SHA512 472d0a67fea7411deb9ebb486495d92a7aa1c45fbc3fe05e7ac65b6d8f2839e2b34eb02ab55135726f3d0ae1942ba77f2e0bd9264b7bee0e3610d122aafe4d9a
- SSDEEP 192:aiSrKIwOQTOsOXLhLYN9NPMUsCdeCeCkoE7g9yrR:a9rKDO4OsOXLhLejRscePCkoEU9qR
- TLSH T1CB12E71ABBA1C33BEEBD4A3648B247A14771D786660BEF5F0C54A09A1E163C907217D3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\SpeakBot\obj\Release\SpeakBot.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Stealer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9479ee803135a808277ed15b942348e6345630ddaa289db36fe326094235872a
- MD5 e2a97afddfa6e8a3524e56f5b4cd6652
- SHA1 b3654a8f7bbe948c4d2a5f859b7d02c9b3340ae0
- SHA512 a5157a889005fe52ef242fbe0157db16f60d4c2da4e0bbc9818832467e4adf18af474b3e10387c1620aa8d2ceba4f70556e2e11a3148127b272350ba0f5880ba
- SSDEEP 6144:thrAVz1OnnEZMnqLP4LXZbaKD7jyGtSV41QJDsTDDtUMle6ZjxLV/q93tGuqeJXB:th0Vz0nE2pS4YsVUCe65fq9IiX/
- TLSH T12BD48D002FD5CA5BF1FF27B2C0F342949775F826B93AD74E198820ED2A1274499167BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
607598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\Stealer.pdb
mscoree
_CorDllMain
Name
.text
Size
586KB
Virtual Size
585KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/System.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b16a3300b9e6fc91952aabdaae1e23988af9d11d47a219c943b24f9c34a96c5e
- MD5 c2385c1f53830a5460c1860a45d87d80
- SHA1 f17bfa6627fc74a25f3d1f820487e4186fe58d6a
- SHA512 4345833f6976f5e8c0a60e436e0a31c5a2778a7987eabf4da0d7319758c0ea3e258306573207b8101edd8f6c5a02b9104fe5d81bc6a101d161f8f3ec9000af15
- SSDEEP 192:4z1pmwOQ1OsOP5409hCZJYQvlwbGG9JAwZ29PL+:4JpFOmOsOP5p9hC/YQlwbN9JAGIPi
- TLSH T1E2120801AB74C2B7ED7D073658B7834147B1E342A907DB5B1DA8509B1E2B3CA5732BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15490
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\System\obj\Release\System.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/SystemDisable.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5166d3458c98962a5c49786185d26600563b6ca3afef2c9e35079c7dd4b865c3
- MD5 416fb9285fe6e40959e3e2a9f4d87919
- SHA1 3ac1683244a009d8ccd43c5d136a7acd64203bc3
- SHA512 cf325b560d55c396cfaf25b005eb481db3acef4fed53729795c094faf238234474c2fd9bd9e45978b504bd1c881fb346781a606e90a2e102014b79adf8815010
- SSDEEP 384:XBFOkOsOsrNcwfu+nnROzb/92/n9euEFdj:XLTfuonRsbFYYDPj
- TLSH T1DD52D801BBF8866AF1BB4F31BEB66724CA37BD0AAD12CD1F0855104D49327C48921FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\SystemDisable\obj\Release\SystemDisable.pdb
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/TaskMgr.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 79c00793de5d62302c16d60f00dd21f864748de4ae17b2cb6cd4eeaab87fe9a4
- MD5 c49afe7c8af97fce442ef4e0dd796b7e
- SHA1 18234fb90c4676fc1a493fdef87168bce8775cc4
- SHA512 b36307eb3c2615cda99fdd594fb1c119df2ab59a87a2f4c34878ed640c47118439d02ccd0f43e9051dd188cd2fb9c3dc4952a13a9832ee129ea0fb2e6f880274
- SSDEEP 384:g1S/gg9WsoROf37h6JZ3mx2RJtGox/xyx7DwLo1jDl:g1YWvRODwbbRDfo1jDl
- TLSH T17A423B0AA3A4067BD8BE497B74B3C3A403B5A7426A17DF6F4DC860D60F163D61B107D9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18674
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\TaskMgr\obj\Release\TaskMgr.pdb
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/Uac.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fec5ce9214e638a7b337177d4c9ac927734872e5198a7e7201a0ce6273cfa77b
- MD5 53bd2ce77bfb21d22bc831285d64a1ee
- SHA1 573b8beb4766374531eb373dd48ddde45f14e0d0
- SHA512 09bcb81d6a72d9ecb392f3fcbadddbdea8966e14cd6c64fa6011020dc48a84bbd8ee69a593dabf12e9711e09908edfde09581210a4501317bd107951eaa929ba
- SSDEEP 384:MzfirHbjkh0X8xNbGXO6+uqMi38wAAkYGbHFtslaDu1qQpX:cfqHG0kNbw+ei38+qSX
- TLSH T15C92F786BBDC5971E6BF4F796CF212010272BA160C27DB4F098540D91E7AAC497B0FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Plugins\Uac\obj\Release\Uac.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/WormJoiner.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dc07f76e606347920748b72b3b42eedb9875f510e571992622c5e7faf1b36175
- MD5 80ed0618c0c34cf34f2011bae6690322
- SHA1 8ee882088bf7525ac5e3e4f7f37f7a0df6e3f331
- SHA512 26aeb0e4eb40e6f015dbfbcd4ca3fd37b35d55a788314c5ddede119ae152afd28a232c8b1b165b080e296097482b74970f8c16060938e318e389658faaad5569
- SSDEEP 24576:iWLnVIj2bA+2Utr402pr7tdSWlKfOkAQcyNkP1Q:iUVIj2Ftr
- TLSH T1DA655C01FFE4C62BE29F9777E57202641BF1D406A353F74B462896BA5C433406E863AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1432638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\WormJoiner.pdb
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Plugins/WormSMB.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 486f6eec4eb441864bbf56243114b7fcd4d674d20ee204d18c15298fac270253
- MD5 bb825283d203ea069445a19d0c86cf56
- SHA1 18754e842a5c2855065e562ac2aca2dc88df30e5
- SHA512 efffbc4844aa2ab5d9be33ef9f1b69084cf2a8870c8751ba04bbe29d579037d466cc27ff9eec277ab0b22e8e086a8670c3482278add3f6461e4972e8dfb617b8
- SSDEEP 3072:r6m1g0sbmkuNoLXyh9KfocUh15BHrbdfOXu4yQ0SUTGTTrhqfldNeh6x3RMuSCgl:rv/dGESUTGTTr4fldNNhtJKLXBavrWm
- TLSH T1FAA42BF46BEB2966F1BECF76AD7315808C2D7C366F06C16C40B103590835BDA996E623
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
474910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\SheetRat\bin\Release\Plugins\WormSMB.pdb
mscoree
_CorDllMain
Name
.text
Size
456KB
Virtual Size
455KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Server.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d1c43c0273b7720b073f648eb13676c1b89a631d1696388ff25fbabfdda71755
- MD5 b86e6d3cc39c69025d75dd4ce5aedfac
- SHA1 3f143c6b28412aadef6b4dadedd0adc517a40040
- SHA512 8248feb77872155ac56d51265773645f00c725191eba0b29f78b868f089b31bb7458db36d2762ea585926da81700d1ba1f5e582ec8cb888f83e0ae759f8aa78c
- SSDEEP 768:0EojXLbNG78cB6z4xgFEPx9OYs6SO5hVzbb:0vj7bSsFq9Vs6SO53X
- TLSH T151234B487BD44515DAFFABF91AB2B6020631F9175A13E78D0CD4CA9B2B2B7C08A407D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect Xworm Payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
51966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/Server.exe.config
- SHA256 d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad
- MD5 c16b0746faa39818049fe38709a82c62
- SHA1 3fa322fe6ed724b1bc4fd52795428a36b7b8c131
- SHA512 cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c
- TLSH T1C9C08C5940247C2BDC224F239260C925FBF83262A424000CE06BAB6A0A2015E8206356
- MD5 SHA1 SHA512 TLSH
SheetRat-main/SheetRat V2.6/Server.exe.mdb
- SHA256 3e55c8eb0cdeb9e010992df3f608b32b1043c8cee09ddd729444ea2d9c9b8967
- MD5 4910cd3c3dc3b121a984738fb3f5586b
- SHA1 1eb5b73e9af0eea064937bdef42e218c227e8c1b
- SHA512 cc50fb510706f7841697d73239c0b37a7c8db8e3a8b02f64dcb8cc0746d48daf16451e2ccc69df8382f0320c3878fe9f7fb735c36e6b76ec9c1549a69aa3fe40
- SSDEEP 1536:+WLE1kXYh5fF4v0Z0HCS01HuloyhECYGA6rbpenvwaf/DSftacVZKeujXgkAX3+w:4LZ/mtPpIvF/DSlaWEbjXgkEEbpMBB
- TLSH T12EF30807BB45AB8FA0573D3588FB48C2F27E903D56A3271DAD0A3EAD84F21560F1DA11
- MD5 SHA1 SHA512 SSDEEP TLSH
SheetRat-main/SheetRat V2.6/Server.pdb
- SHA256 7370331bdf2e6cc801e56d2fa83b51fc42228424bfcc5efaece48207ee904159
- MD5 d8da9db4022e50d1f1673c18ab854e3e
- SHA1 64e5c5bedb941523189fcbccf673a4a65219106a
- SHA512 e877b72330846c8879aba66f8de36d0b8cc21f159dd42fe237682eb36a0894ed27f8575701dcd9c3b06e9a44c0389b34d95cdf5a00d20304afd80529a2559cd3
- SSDEEP 6144:3pRaEOIWdLxuDLjnQC/nPY4VOaPos+56eFKrf/fsy3usgPE3MllOZ/AxNEHggaGb:3pRdWqZ0KlzPquGjwxXB2atj
- TLSH T1EB25B527FB84DB32C466863856BB8F1C433CD5858F429B4F2799706D7D923922F86398
- MD5 SHA1 SHA512 SSDEEP TLSH
SheetRat-main/SheetRat V2.6/Stub/Client.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 71824238c3baec179911bd6e4655ebff234e15d0f14248077e2c388ef4337009
- MD5 a0e04bf9b43f0b442bd3193f06dc52b5
- SHA1 30bb0c17640c414d948ed3e2fdf571b98f125efb
- SHA512 d7015f5c8223ba0f4e3b478185fa3e4de0831aee949302185fdc8b3afe59105fe096a3e5ee23219a1c16dfcbc77d169a82774ecd727ef98bdb94a878583a2ae2
- SSDEEP 768:+nqRz+Q9CF6abcLPbUG9bOplP7ZXdEEyb:B9g6asD79bOHLDu
- TLSH T151232904F3E84519D2FE56B858A291C8827DF5DFA612C7DE0CCA90E91E1E7D48A01FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Sheetrat Payload
Sheetrat aka NonEuclid RAT is a trojan written in C#.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Malware\Desktop\hack tool\Backdoor\Sheet rat v 2.2\Src\Client\obj\Release\Client.pdb
mscoree
_CorExeMain
Name
.text
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/cGeoIp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- TLSH T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
- MD5 508ccde8bc7003696f32af7054ca3d97
- SHA1 1f6a0303c5ae5dc95853ec92fd8b979683c3f356
- SHA512 92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
- SSDEEP 24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
- TLSH T1EB356B0177E9AB3BC49E837AD432091943F2D40677A3EB0F1654EBB92C837959C217A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1167430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SheetRat-main/SheetRat V2.6/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9f01d9f2ed07e630ec078efa5d760762c3c8ad3b06e9e8a9062a37d63d57b026
- MD5 9fbb8cec55b2115c00c0ba386c37ce62
- SHA1 e2378a1c22c35e40fd1c3e19066de4e33b50f24a
- SHA512 da0211d1c9ba0a59616bc15de80a1fed62b0405cad3b11ae4220ef1488c7837634aad67cbc8b484621a2a6288ef5e424cd816a2523bdb6167abcab76f3ac1a04
- SSDEEP 6144:1kWu4n53u8Q5w+8yxIxM2NUpwMTRHslVz:G4n5e8kXOMkUp9GlV
- TLSH T12A546D2423FD5B1AE6FE97B8A478140C47F6F90B751BEB5E499094F90C22BC089117BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
276KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ