GammaOrderBookV6.zip
- SHA256 a76aef87667521f06bca5d5ad35e201833c89d7fe024ad361d2dd1dd1ce23d00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
GammaOrderBookV6.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
GammaOrderBookV6.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target GammaOrderBookV6.zip
- Size 972KB
- Sample260804-y2mlpayfqf
- SHA256 a76aef87667521f06bca5d5ad35e201833c89d7fe024ad361d2dd1dd1ce23d00
- MD5 637d0a098e12c28be7da2763eec924ea
- SHA1 916d95d6dd1933161c211d6423eaf0dacd2fa5a4
- SHA512 579870ce3582bfe11171dc3b022d76c4b916b2c93195243a1663f751d9e0bfc5d9331809edb850230c648ec92941eeac5f9f756950e4b0b424f081a9328f899d
- SSDEEP 24576:Zz6eEO3o/kD24ebgWrrcY1+03ztIRn1faj:Zz/EO332BlrcYPCmj
- TLSH T1C12533C306A0F4B6DF5960B7EB9BDB4D70718500293BCDD43AED4A50B104A632E6E63B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/GammaOrderBookV6.dll ConfuserEx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/GammaOrderBookV6.dll
File Explorer
-
GammaOrderBookV6.zip.zip 972KB
-
AdditionalReferences.txt60B
-
GammaOrderBookV6.dll.dll 1.3MB
-
Info.xml154B
-
Newtonsoft.Json.dll.dll 683KB
AdditionalReferences.txt
- SHA256 23a4b54a7f53def95c8ce1b26626b687375c086c15f1e32578ff6dad4aa67b63
- MD5 bbceb8371510d5161ad0ce884ccdf388
- SHA1 541a6bc7efb34dfde47cc6588b3bba41075e99d8
- SHA512 8e76686829a02998e839b540fa8cff7ba906e8efb405b7441a9c52908e9862f1c8737cc841048526b7dc6b58b068d4e8d20e4ef7fbc6d4090012b08949fcc547
- TLSH T1A6A002895961E464BC045C68995C9E25255B64C026616285310E408805D962745D197B
- MD5 SHA1 SHA512 TLSH
GammaOrderBookV6.dll
- SHA256 0ab22465e3afeb281a481461e9e14259e8aa12818d3e8c67b5e811905ae371f1
- MD5 9ac2d24fc10d9fded5122d24b7c372fe
- SHA1 fa3c527b075e4f613f7f787fee37dfe25cc64c81
- SHA512 96d19d19f1e7a8506c06449ea5fc3c595ca9cbcfcb28ec04268f957e74ee2539b71a414825596f4179603d23d3e62098d3552e0cb4ada9a8258483c86fccb82f
- SSDEEP 12288:tfZ+CZtXUqx7gfz9kkWKvIhSnbO3IHtfllQizwilL1XY3AJ7Owom3NJgZK6WcoVC:tx+ykqxgf+lw2Sna4prcme3+7Owom
- TLSH T11855959C765072EFC8A7C062DEBC1DA8EA6178B7431B8207942715ADDE0C98BCF541F6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
8 j0O)
Size
467KB
Virtual Size
466KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
819KB
Virtual Size
818KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
generic
Info.xml
- SHA256 6c4370ad8a7de33f09b061d3b71fc044b38286d516f495275320fef800d451ca
- MD5 e37d8f4422a26f7fb39c991893aeb3ff
- SHA1 a8064729e4aa12971ffa53f0738643a82ad4343c
- SHA512 70e8bd8b46a2073861054575b67afe40a9e469f4b894f45a34477b028b9a8453122dafcf118bb9c745470d5830a19c198c7278e065238fe3d1668f7d72e72ebd
- TLSH T13CC08C8A13C0322A6C329A73470CBC18AB79B2AB24218CC8F406059B0BF402C8963479
- MD5 SHA1 SHA512 TLSH
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Nov 9, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
696798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ