Davetrap-4.0.1-win-x64.zip
- SHA256 24638e3f3dab369c9a6f872e3e963815d6fe8f8a0b5d70902eb146060fdb2544
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Davetrap-4.0.1-win-x64/Davetrap.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
600 seconds
Behavioral task
behavioral2
Sample
Davetrap-4.0.1-win-x64/Davetrap.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
General
- Target Davetrap-4.0.1-win-x64.zip
- Size 87.8MB
- Sample260804-cw4gcsbe77
- SHA256 24638e3f3dab369c9a6f872e3e963815d6fe8f8a0b5d70902eb146060fdb2544
- MD5 a85a1898b1b70ac488ba5b5a33595b5c
- SHA1 06718fa2a79ac46a708dc51454aa130082663198
- SHA512 c3b584e096e889b570f931bc135333834206edbf732ffab2e8c14763becd1763249892ffa52989ac49d3c00e817ea3016392ce9ddde3bfc3f20fea797605c28e
- SSDEEP 1572864:AVsytu0ODDVzIhxw+9icutSPKN3pwsPYH87sqXQ+VIQXJlquYN7vRPJ4:AVsyU0uD+Hbj7CVpwa7x7VXXJlq7N7vc
- TLSH T1521833FCFF9F54AD6DE541CB3A5920A42A10B801B49610B06359663CB0BBA176EFBC07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Davetrap-4.0.1-win-x64/Davetrap.exe
File Explorer
-
Davetrap-4.0.1-win-x64.zip.zip 87.8MB
-
Davetrap-4.0.1-win-x64/Davetrap.exe.exe 96.5MB
-
Davetrap-4.0.1-win-x64/Davetrap.pdb252KB
-
Davetrap-4.0.1-win-x64/License - Fira Code.txt4KB
-
Davetrap-4.0.1-win-x64/License - Fluent System Icons.txt1KB
-
Davetrap-4.0.1-win-x64/License - Segoe Fluent Icons.txt612B
-
Davetrap-4.0.1-win-x64/License - VirtualizingWrapPanel.txt1KB
-
Davetrap-4.0.1-win-x64/Wpf.Ui.pdb97KB
Davetrap-4.0.1-win-x64/Davetrap.exe
- IMPHASH de665e653fb1de074ec7c2f2365fba8c
- SHA256 80e0db32bbcaefebcc9a7d51aa0fd659c53758a2bcedb2e63f714d6273395c30
- MD5 000939dc66756fdb819fcc14ff52a8ba
- SHA1 947400fbe51bf74512f18d459b23c1b098975191
- SHA512 4751a1c755ae94da64206ce0c7a7bc0fc8958e13e783a539d56db05d9fbef32782ae5823691f9134b094f3e177ee309d29f67c3ed104838e21358ee0cfb2ab8b
- SSDEEP 1572864:PMIQN5qMkwQSy4PlGLW3OWjTSQ6AUNsNNlwPTLcIFvBKQjuKWRhbW2rXc:PMIGXlLXSfAUC6PX9vRjuKWRhbWGs
- TLSH T154282292A2EC20B8D67AC1788566D11FEB713C1D53246AEB23E0BE193F377D119B9311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
6053408
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb
kernel32
ActivateActCtx
FindResourceW
GetWindowsDirectoryW
GetModuleHandleW
LoadLibraryExW
LoadLibraryExA
RtlCaptureContext
WideCharToMultiByte
GetConsoleOutputCP
MapViewOfFileEx
SetLastError
SetThreadErrorMode
RaiseException
SetConsoleCtrlHandler
DebugBreak
FlsAlloc
FlsSetValue
FlsGetValue
GetLocaleInfoEx
GetUserDefaultLocaleName
FlushProcessWriteBuffers
ReadFile
CreateNamedPipeA
GetCurrentProcess
WriteFile
WaitForMultipleObjects
WaitForSingleObject
DuplicateHandle
DisconnectNamedPipe
CreateEventW
CreateFileA
CancelIoEx
GetOverlappedResult
ConnectNamedPipe
FlushFileBuffers
SetEvent
ResetEvent
WaitForSingleObjectEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
SleepEx
SwitchToThread
MultiByteToWideChar
SuspendThread
ResumeThread
LCMapStringEx
FormatMessageW
LocalFree
GetModuleFileNameW
GetEnvironmentVariableW
CreateFileW
GetFullPathNameW
HeapAlloc
HeapFree
CreateFileMappingW
HeapCreate
GetProcessHeap
HeapDestroy
VerSetConditionMask
VerifyVersionInfoW
QueueUserAPC
SetThreadPriority
GetThreadPriority
TlsSetValue
TlsAlloc
WaitForMultipleObjectsEx
SignalObjectAndWait
RtlLookupFunctionEntry
SetThreadStackGuarantee
LocateXStateFeature
SetErrorMode
RaiseFailFastException
GetExitCodeProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
GetThreadContext
SetThreadContext
GetEnabledXStateFeatures
InitializeContext
RtlRestoreContext
SetXStateFeaturesMask
CopyContext
GetModuleHandleExW
GetCommandLineW
CreateProcessW
GetCPInfo
ExitProcess
OutputDebugStringW
RtlInstallFunctionTableCallback
GetLogicalProcessorInformationEx
SetThreadGroupAffinity
UnmapViewOfFile
GetProcessGroupAffinity
GetProcessAffinityMask
QueryInformationJobObject
FlushInstructionCache
RtlDeleteFunctionTable
CreateMemoryResourceNotification
WerRegisterRuntimeExceptionModule
RtlUnwind
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
OpenEventW
ExitThread
HeapReAlloc
TlsGetValue
GetFileSize
RtlAddFunctionTable
CreateSemaphoreExW
ReleaseSemaphore
GetSystemDefaultLCID
GetUserDefaultLCID
OutputDebugStringA
QueryThreadCycleTime
SetFilePointer
MapViewOfFile
FindClose
Sleep
RemoveDirectoryW
CreateDirectoryW
GetEnvironmentStringsW
GetSystemTime
GetSystemTimeAsFileTime
FreeLibrary
GetCurrentProcessId
GetProcAddress
CreateThread
GetSystemInfo
CloseHandle
GetActiveProcessorGroupCount
GetCurrentThread
GetLastError
FreeEnvironmentStringsW
GetCurrentThreadId
CreateActCtxW
GetTempPathW
InitializeCriticalSection
LeaveCriticalSection
GetStdHandle
FindNextFileW
EnterCriticalSection
FindFirstFileExW
GetFileSizeEx
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
GetCurrentDirectoryW
WriteConsoleW
DeleteCriticalSection
CreateFileMappingA
GetTickCount64
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
GetNumaHighestNodeNumber
SetThreadAffinityMask
GetFileAttributesW
SetThreadIdealProcessorEx
GetThreadIdealProcessorEx
VirtualAllocExNuma
GetNumaProcessorNodeEx
VirtualUnlock
GetLargePageMinimum
IsProcessInJob
K32GetProcessMemoryInfo
GetLogicalProcessorInformation
GlobalMemoryStatusEx
RtlVirtualUnwind
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
TryAcquireSRWLockExclusive
GetExitCodeThread
GetStringTypeW
InitializeCriticalSectionEx
DecodePointer
SetEnvironmentVariableW
GetThreadGroupAffinity
GetCurrentProcessorNumberEx
advapi32
LookupPrivilegeValueW
RegGetValueW
SetKernelObjectSecurity
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
RegCloseKey
SetThreadToken
RevertToSelf
OpenThreadToken
EventWrite
EventRegister
EventWriteTransfer
DeregisterEventSource
RegisterEventSourceW
ReportEventW
AdjustTokenPrivileges
ole32
CLSIDFromProgID
CoCreateGuid
CoTaskMemAlloc
CoUnmarshalInterface
CoMarshalInterface
CoGetMarshalSizeMax
CoCreateFreeThreadedMarshaler
CoGetClassObject
CoGetContextToken
CoGetObjectContext
CoReleaseMarshalData
CoInitializeEx
CoRegisterInitializeSpy
CoWaitForMultipleHandles
CoUninitialize
CoRevokeInitializeSpy
CoTaskMemFree
oleaut32
SetErrorInfo
GetErrorInfo
SysFreeString
SysStringLen
CreateErrorInfo
QueryPathOfRegTypeLi
SafeArrayGetVartype
VariantChangeType
SysAllocString
LoadRegTypeLi
SysAllocStringLen
VariantClear
VariantInit
VarCyFromDec
SafeArrayDestroy
SafeArrayAllocDescriptorEx
GetRecordInfoFromTypeInfo
SafeArraySetRecordInfo
SafeArrayAllocData
SafeArrayGetElemsize
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayGetDim
SafeArrayGetLBound
LoadTypeLibEx
user32
LoadStringW
MessageBoxW
shell32
ShellExecuteW
api-ms-win-crt-string-l1-1-0
iswspace
strncpy
iswascii
iswupper
wcsncpy_s
isalpha
strncmp
strncpy_s
towlower
wcscat_s
_wcsdup
wcscpy_s
isdigit
strnlen
wcsnlen
strncat_s
towupper
strcmp
strcpy_s
_stricmp
strcat_s
isspace
tolower
wcsncmp
_strdup
strtok_s
wcsncat_s
strlen
_wcsnicmp
_wcsicmp
_strnicmp
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
malloc
_callnewh
realloc
free
_set_new_mode
_aligned_free
calloc
api-ms-win-crt-convert-l1-1-0
atoi
_wcstoui64
_wtoi
strtoull
strtol
wcstoul
_ltow_s
_atoi64
atol
strtoul
api-ms-win-crt-stdio-l1-1-0
fputwc
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__stdio_common_vsprintf
ftell
fseek
_wfsopen
__stdio_common_vfwprintf
fclose
setvbuf
_setmode
_dup
_fileno
fwrite
__p__commode
_flushall
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
fopen
_write
_wfopen
__stdio_common_vsscanf
fgets
fflush
fputs
__stdio_common_vsnwprintf_s
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
_invalid_parameter_noinfo
_beginthreadex
terminate
_wcserror_s
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
abort
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
_controlfp_s
api-ms-win-crt-filesystem-l1-1-0
_wrename
_wremove
api-ms-win-crt-math-l1-1-0
truncf
atanf
trunc
ilogbf
ceil
atan2
copysign
ceilf
round
fmodf
asinh
cbrt
acosh
atanh
modf
acoshf
cbrtf
atanhf
tanhf
modff
asinhf
fmod
__setusermatherr
_fdopen
fmaf
fma
floorf
floor
acos
acosf
asin
asinf
log10
expf
exp
log10f
log
log2
coshf
cosh
log2f
cosf
logf
pow
cos
powf
roundf
atan2f
sin
sinf
sinh
sinhf
sqrt
sqrtf
tan
tanf
tanh
copysignf
atan
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
__pctype_func
___lc_locale_name_func
___lc_codepage_func
_lock_locales
_free_locale
_configthreadlocale
_unlock_locales
___mb_cur_max_func
_create_locale
BrotliDecoderAttachDictionary
BrotliDecoderCreateInstance
BrotliDecoderDecompress
BrotliDecoderDecompressStream
BrotliDecoderDestroyInstance
BrotliDecoderErrorString
BrotliDecoderGetErrorCode
BrotliDecoderHasMoreOutput
BrotliDecoderIsFinished
BrotliDecoderIsUsed
BrotliDecoderSetMetadataCallbacks
BrotliDecoderSetParameter
BrotliDecoderTakeOutput
BrotliDecoderVersion
BrotliDefaultAllocFunc
BrotliDefaultFreeFunc
BrotliEncoderAttachPreparedDictionary
BrotliEncoderCompress
BrotliEncoderCompressStream
BrotliEncoderCreateInstance
BrotliEncoderDestroyInstance
BrotliEncoderDestroyPreparedDictionary
BrotliEncoderHasMoreOutput
BrotliEncoderIsFinished
BrotliEncoderMaxCompressedSize
BrotliEncoderPrepareDictionary
BrotliEncoderSetParameter
BrotliEncoderTakeOutput
BrotliEncoderVersion
BrotliGetDictionary
BrotliGetTransforms
BrotliSetDictionaryData
BrotliSharedDictionaryAttach
BrotliSharedDictionaryCreateInstance
BrotliSharedDictionaryDestroyInstance
BrotliTransformDictionaryWord
CLRJitAttachState
DotNetRuntimeContractDescriptor
DotNetRuntimeInfo
MetaDataGetDispenser
_kBrotliContextLookupTable
_kBrotliPrefixCodeRanges
g_CLREngineMetrics
g_dacTable
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.CLR_UEF
Size
512B
Virtual Size
215B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
228KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Section
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=259, version=35207,
count=19, id=260, version=35207,
count=68, id=260, version=35220,
count=101, id=261, version=35207,
count=8, id=260, version=33145,
count=13, id=257, version=33145,
count=505, id=1, productName=Unmarked objects,
count=22, id=259, version=35220,
count=571, id=265, version=35220,
count=1, id=256, version=35220,
count=1, id=255, version=35220,
count=1, id=258, version=35220,
Davetrap-4.0.1-win-x64/Davetrap.pdb
- SHA256 a9d55d94ec8b1566d6fed3795baa73f86f0687c5458e755ad1611fb46fa37c75
- MD5 78c0d182a5a7aa6c9b7602db2a83236c
- SHA1 6b247bf8362b81ae493185bb52aeb07f1114a25f
- SHA512 2db479c57e4a54dd59588297259f1a06b4af482d83bb0b80c8a73e3ffeeea9c34a384878006b9993c2951f2be9b5b622ad8a56eb86150883cb7a6cea6c950df6
- SSDEEP 3072:3twyveh8CaqKrQE7qRusVsORJ+cc6GRk2AMAJi+v8696Nlt8Oh:36yveBYrJmusVnJ+sZU+0Q6NHlh
- TLSH T1A044194AE78D8739CD9F5B72826B19642B35D143EA028B1BE09F72747F53308366762C
- MD5 SHA1 SHA512 SSDEEP TLSH
Davetrap-4.0.1-win-x64/License - Fira Code.txt
- SHA256 1d41e10031ab125302780a05ec4c91d218e47db0c7e37cf315cce5e608cdc25c
- MD5 1f319ca1887afc3591b1dccdd8530c58
- SHA1 294a74901696575e05a46845ff4fe325dff0322e
- SHA512 bee6615aa2c8771ea9685a6de630eceb554c22920fd56379be460f461b27081de2d12e04298e4aecc76b733465730f3f3b602867abbc2df53105eb8ccf5475d2
- SSDEEP 96:InPUibMxxUzfGkKnjfRU88f+BktjVKvR1wyQeQHDZoN:PsMPzW88f+XvR9QHtE
- TLSH T1B791C92A3F4423B109C0D242F777E9DEE61A513D37AB69C9506AC16C23A6D2803FE690
- MD5 SHA1 SHA512 SSDEEP TLSH
Davetrap-4.0.1-win-x64/License - Fluent System Icons.txt
- SHA256 69bc45dc42b9acb96a69823adbc6ae538374e3c0bde169b855b32c48eaaef52f
- MD5 01dfec1b701ef4bb4884468c1a9c5693
- SHA1 6c5a28c572e38adadf8d9819a2ceeb0eb82a6bc3
- SHA512 827fd0cc25522ff9f880a0399ab3ddb984cc71f3141b643a0907becbd4013cc9647445e70ac9e8ec5a2dd8e075fc2e7b384626802ef132927deccf1036ff2827
- TLSH T1AB11461E72554763189B13A055756CD5B13FB25B7A5F2A84146DF345232A06CC6FB840
- MD5 SHA1 SHA512 TLSH
Davetrap-4.0.1-win-x64/License - Segoe Fluent Icons.txt
- SHA256 9e90ba20d2288ce1625e6126a9bca3e1fc26b38f85620d1f92201a165001813f
- MD5 9ed1459e7ab3a73649f91cafc7179b07
- SHA1 1e3dc60c0d47d539f0e2b08fac2d14c637113351
- SHA512 26d35910274515e2eb51d4dbeb12c414b0cc1f3f1298f66b3feb159eaea1048b951f5f07cf3f3ee71ff2948573b399931cf488cbbcab4d963b9b51db9a81b1aa
- TLSH T12AF0D34CF35F432106810131D89288F9A20F52FCA765D7D196288107237BEF8427585C
- MD5 SHA1 SHA512 TLSH
Davetrap-4.0.1-win-x64/License - VirtualizingWrapPanel.txt
- SHA256 849e6087d42bf504bcefe4c6fe01d7481123a8aff14eed030b12528c4e6ae0b1
- MD5 c1d204614d2cb57914bb8583e4153ec5
- SHA1 7bbf82ef0e588a86503093d857548f75dad6e99f
- SHA512 c7bc1b64f9fe34c0bf2bc9b8b25ef36af15c2674c54c994c18977430c4d2a8b4c2b92c01712a4a316d964df1ca7b72d407cff6dbb3a8977275160427bb249e0f
- TLSH T1CB11B91E73500776189B13A055746CC5F13BB15F7A5F2A84146DF345233A06CC5FF840
- MD5 SHA1 SHA512 TLSH
Davetrap-4.0.1-win-x64/Wpf.Ui.pdb
- SHA256 093023849b28f2867fa31fa18b2ecb56a1fc5f841284406fdcaac1f43abb86ed
- MD5 97e546395448d4f090e5755ab9162358
- SHA1 05f03a6d6f1a9f850854951622f675bbdec4d364
- SHA512 6d81031aa91102d09c316ef7003449b9d3cb1fd601758253f24c4db2b3bb824f65ba93116ba27926ff93e8c6cfcdc8476e23c25a7bd9eb1552b53bbdc5ad36dd
- SSDEEP 1536:c/aAOKr63EEPhp5VRreXovZtWJ0vJu7A5pjBo2C/Pa6XJ3Rq7yqulI0+:l3hp5jCo3Jxu85p8/PagvNa0+
- TLSH T1A0A3081B5BC7C525C55E247A402783102B389514BE06AF36A2EBB775ECEA3DC09F3B19
- MD5 SHA1 SHA512 SSDEEP TLSH