Deceive[.]exe | Triage™

resource	yara_rule
sample	costura

resource
Deceive.exe
unpack001/costura.dll
unpack001/embedio.dll
unpack001/swan.lite.dll

Deceive.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 59b644c44b4462f80446cd7c9534a6ae6f1628f13b1897c8b648c34abd49e42a
MD5 85887b9bff58852449c7b1b30a486c04
SHA1 13da373d02520f102a555080eb51ed525d14e698
SHA512 9411899e9ee8c2929175458cb8a8df576e9dab0424d7befcdb7851f648cb0a83cfefed4ae44f088c83d6453b4ad99544cf12c2b1884d15ab009fdb27a2b796bc
SSDEEP 49152:rj2j+i3s7ydjvjCvewr28llAIOUJ5NWCpAD3qDVjeSt:rKjFCW7F228llyUjH1Z
TLSH
T1878512151FE84706E7BA2E381AB0D111487BBD13BC3AC75D94A8315C8B73E84ADB5B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1799118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\thijs\Documents\Projects\League\deceive-github\Deceive\obj\Release\net472\Deceive.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
TLSH
T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

costura.pdb

SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
MD5 34b42a5776a3ad022b429124d55e576d
SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
TLSH
T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cs.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a9b024b31cb1f0edefc9bf0af1075585110b7107920ab5161ccbfba13840d3b2
MD5 e481d99b41c9301d1c9a92e948f00323
SHA1 22270e825f8c646d8ef28a65f328809a8c79b711
SHA512 032fa9c03f088417e7ca0c66ac706bb207707f70c1fcc0abd1b151fbcaa482abff76d492a955adf2017de134841830dae95df910201107d9866af96c863015fc
SSDEEP 384:rLZiySNAFfNmL5ohfWSZ4yHRN7WUbCVOY/wR9zKw2GQTO:r4AFfNzl4uWUC/M9zNxQK
TLSH
T1D492E846A7FC5106F8F76E7066B9D5026D3ABF972D20952E1194A20D0EB2B80DA3173A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

51:9b:02:c0:57:f2:0e:b1:bd:eb:e4:0c:c8:8f:71:44:16:16:2a:75:ca:ca:0d:3d:dc:37:81:e8:97:c8:b2:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

de.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 54a2268b955daedb22d154d4ffe3aec57a7066e8a3f80eca3fec2841b0e862f4
MD5 6b7deba237f8a38e396a58efaa673037
SHA1 afc266d8945cafcc18a83bfb8c08e0b5999b667b
SHA512 bd3d8c7c0fc84c8b78e16a2638e0adca634d7905ddd8cb3f3a32fc03c13a90c6ce196b4ff65dcd9ac9bead7ae5575e180980b36198fae54be4aa236cb78a1f8a
SSDEEP 384:oeZvcSNAFfNmL5oIAfWSZw9yHRN7rfNLLMB+6R9zQbbqbR:oOAFfNJlkurfdos29zB1
TLSH
T17492E756A7FC0106F8F36E706BB9D5126D3EBF971D20D51E1594A10D1EB2B80CA3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

5d:4a:87:30:b4:8a:88:e2:00:c8:0c:58:02:90:36:1f:49:43:97:35:79:cb:0e:21:c3:51:a5:3f:15:db:df:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

embedio.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21392a5fa8d00f4fed9450f7fabd2c8e5dd30cba73525c35f37584e17c639e2b
MD5 e9346fb322505743ae312aaab73e25ae
SHA1 e1fd67ed0a72cf6cc013bc7a6b5a73f135c7a828
SHA512 79f480d92f2510586231284df713c0b8a066c4ebc8b479aeb39be940c868105c1244eb50da1d395adc571dbabd5b012940fd91663552f8d60768bdab5f1f9840
SSDEEP 6144:4EZFV9g/UR+spYMtsikR964FmxJtXdRsc6CR/1jQVW3V45ZfMRqXNeFq3O:r+VMtCbFitNip6NjQVW3V4xeU3O
TLSH
T115741A0133FD4625F1FF6FB9B47616448FBAF80AA529D79E5D0894AD0CA274A9C40B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

356294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Unosquare\embedio\src\EmbedIO\obj\Release\netstandard2.0\EmbedIO.pdb

es.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 89dfe3599500173e7cd5792ab4b97c0c3fb927b718773743dd16e183acf1a979
MD5 30293ed3b8dea0e51e7aa4d9cfbde13e
SHA1 71de360bc939496ccb5a767658e442daf18d5718
SHA512 05ba5aa41d712c1bd02b162ea54d95c98fffec7f0bd979e9f5a331d9cec658138ad72f1904d60dbb0ddfa2b89fcec1036afd1755090475a197b3f627153e8950
SSDEEP 384:MOZitSNAFfNmL5oBfWSZCjyHRN72uIaVOY/wR9zKw2T:M+AFfNLlku2U/M9zN4
TLSH
T10192F746A7FC1106F8F76E706AB5D5026D3EBF972D20D52F0595A21D0DA3B80CA3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e5:72:58:59:be:a6:68:98:10:68:58:59:29:ad:f0:cc:0a:94:8c:2c:52:2e:00:ed:36:82:45:07:7f:2c:65:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

fr.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fd1f25a6b884a9ad8744473ec0c1bc62bb1c04a861eb29846d06a2aefa67abe8
MD5 71debc50a43a8613fcc0fd57c3a58a02
SHA1 0b56013f89522d39dbd43d71bfbb6da68769b195
SHA512 ea8de7a8b0232ec2d79d9fb9051755675a05484c6b3373d32d09f8fc6a535d6866bf7c0369829e748e41498efc1dd6fef172f2b9e9e7d5cbd8b884e7c9be9bfa
SSDEEP 384:3VtiGSNAFfNmL5oxfWSZvryHRN7lDzvpNR9z/OSnsK:3AAFfNLlDuln19zqK
TLSH
T16892E846A7FC5206F9F72FB067B5D9026D3EBF971D20D51E1585A20C0DA2B80CA3173A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

09:c9:61:14:4c:83:6b:ce:5a:36:fb:32:11:43:1f:b8:aa:ff:a1:b6:46:4d:f8:fe:bc:09:8e:03:06:13:18:a0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

it.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 17a28558ab6283830a9e26c453686ed54c3d3b3af79b23de134d69a2838c89f1
MD5 34bfb4f60ed8fda620203e34d1de1fc8
SHA1 f384c978b04fafd88fa271a06d4970878491a8f4
SHA512 645a96a44321d503c21dae6a9084e195a89600940abddf8fde8a955d84cf76b8e2396638dded11fe1e863247110518092158cf9771525b1581f21a88b2537b63
SSDEEP 384:a3ZiuSNAFfNmL5oHfWSZVyHRN7ZzLMB+6R9zQbbgbq:aQAFfNZlVupos29zbm
TLSH
T17692E656A7FC0106F8F36EB066B9D502AD3EBE972D20D51F1595A10D0DB3B80CA3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

41:e4:77:26:71:38:ca:9f:a9:8f:7c:90:bb:4c:8a:fc:43:24:d9:85:ef:d9:89:86:04:11:f7:34:36:16:9b:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ja.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22858a9cbfdab52f41679f520c1ef94e16b6b25a239f69a81f3031302e1b206e
MD5 fc0c4b5de2ca2c7fc27669b173874fdf
SHA1 02ab9c32eea64196a88336f07d1a99c1ea89e552
SHA512 338c1e917b40d5e2531334a5553e33473bd8cbe6ac84bc8a2aabe4f2b7d5b59b8c92cef05be949bec636e8030132dc3e8d3fbd98eab52388f2c8967761056978
SSDEEP 384:1jZdVSNAFfNmL5oskfWSZ4yHRN7GghvpNR9z/OSG5ZE:1WAFfNll4uGa19zsE
TLSH
T12792D646A7FC5246F9F72F706BB9D9026D3EBF971D20D51E1184A20D09A2B80CA3177A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3b:14:73:e5:28:d1:e0:1d:4e:bb:17:c6:47:9c:bd:a5:9f:19:7b:27:ff:8d:b8:9b:bb:16:73:23:cf:67:f6:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ko.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0b80723d22e9dab974f772a73a3387f5a74a6fb5fe9fb78110c0c7ce1d22d028
MD5 4d9089af80145eb35cdd423539f76e8c
SHA1 1710c88cb674c68b9e919cbd01493dc80d4325db
SHA512 316c4b336f9f544c80671299da4ec9129b8b44335f2ab6c11f9d902524e08a6c6faab070fe373e1328f8992323d8d3fb0c6e206cb40c5359619327fef6776f9d
SSDEEP 384:BVnioSNAFfNmL5o3fWSZkyHRN7YNvpNR9z/OSu4N:BsAFfNtlku619zrN
TLSH
T15392E756A7FC5106F9F72F706BB5D9026D3ABF971D20D55E1584E20C0EA2B80CA3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d6:ff:ed:55:e0:6a:19:b1:b3:82:05:3f:33:fc:ee:1e:7a:57:09:1b:5c:b1:8a:23:34:27:19:27:2f:30:69:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

microsoft.bcl.asyncinterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
MD5 48efe61d6ca3054309907b532d576d2a
SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3
SSDEEP 384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
TLSH
T189A26B11D7AC4317EEAB3FB19679D1062E34E7D6A821E32E108CE2652CD73859731739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

82:11:ea:7c:5c:6c:f6:d8:98:91:57:78:8d:42:43:17:c8:8e:9d:92:b0:d0:16:ba:2e:c7:fd:02:5e:79:f7:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdb

microsoft.bcl.hashcode.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3a4e851ee5fc0f6182aa5a3d65dc56fcd6979b65334b5c3b92fbdc791457c0ab
MD5 64f530f8ddbc93262732071b4db864c5
SHA1 7c2f349da43199522756e3c8a1d9ec94780888ca
SHA512 f7f3375ed6325bfaad82ff1817ad434c0ffd113b1175fbc4bdb1507e745f3a9fdec12cff9b2100c7ae96350c91e6e0b0ec24a1c569eb9bfc6b6774d7460fa223
SSDEEP 384:B0/kajL92ajiAOeRqwDpPIwcAakgj22WVr4WNYA6VFHRN7WszxIPaR9zeN:B0792ajnFRqwpPI4DFClWszxOW9zO
TLSH
T192C24A1E829886C3EFAB0D7025F5EB5B3D3853B59C1293B612CAE9181C437C5D621F7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

96:8d:eb:c5:6f:28:64:c8:37:be:12:b7:3d:e5:43:c8:84:89:f0:e0:a2:2e:fe:a0:62:ee:47:2a:0a:e9:2c:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

21818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Bcl.HashCode/Release/net462/Microsoft.Bcl.HashCode.pdb

pl.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1a186cd8f98f99754f0c196b40bd008e51a8d64ad6a0bdf927306d9a60842f39
MD5 37fa21f1bc6537d2d1537bef721794a3
SHA1 31d2f852d4e9c1f291a27da76589742069a89e29
SHA512 cb147a503c45074bdd073cd67b2f21f67568249a77c02bc54a1f34c368e605a4003f76a06db7324edfbd91a7b74185c01a000c87c383084d44ba3066639a1aa5
SSDEEP 384:7sRiaSNAFfNmL5oRWfWSZeryHRN7EkLMB+6R9zQbbtbu3:7LAFfNil+uTos29z+a3
TLSH
T19B92F856A7FC5106F8F76EB067B9D5126D3ABF971D20D51F0185A20D0DB3B80CA2273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

4b:83:7c:1e:3b:31:3d:25:3d:58:bd:60:ef:29:b3:f4:92:3f:0d:1a:1b:c8:94:60:45:a6:5a:77:17:c7:07:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pt-br.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c43030502ec9b373ac41b2eff24f6efc121b5c058f2687451110407c28c2933b
MD5 9db30b8b21987c1b71d14b0dbed83cea
SHA1 0d8c6832e92cf7f659eb8f35a0a5e5dc96180c5f
SHA512 97b7edc1652b4782b1971f4fdc5627762782b4228a9361b6c852b2f97c378179c2d47985b1aa9bd237e47d7acb11a39229e903d3ba524a5d15d15eac331c5859
SSDEEP 384:8Zh+SNAFfNmL5oRfWSZ/yHRN7oX6iVjLMB+6R9zQbb/bEH:yAFfNXl/uoXvos29zwe
TLSH
T16D92E656A7FC0246F8F76E7067B9D512AD3EBE971D20D51E0185A10D0EB3B80CA3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

85:17:ce:c9:8a:c6:17:d1:54:36:af:a9:f0:ff:bf:34:c4:90:83:27:90:2f:c7:f8:2c:cf:03:5d:77:c6:ff:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ru.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d51ea384d55b2aef30b58339263f7c3e5b7b5b147f27f3c8636af67e467d2330
MD5 2aee5ce0dcc987e60d01c5eb9039de96
SHA1 d94aabe9d6abf84485310da04663a738203501bb
SHA512 8c471cc5ff4f8e5b9745e256bdb1b8b65c3113372adbd9e77a73137285a18b162a25cac418cc62e1746dd74cdf046d4849b1b1fc4d3bb401f6c70c482dea86b0
SSDEEP 384:53ZiNSNAFfNmL5ovfWSZryHRN7B77wLMB+6R9zQbbXbUz:5VAFfNtlruSos29zQAz
TLSH
T14392E656A7FC4106F8F36E7067B9D5126D3EBE972D20D51E0585A10D09B3B80DE3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

fe:a8:25:ec:ca:34:c1:cc:fc:8c:49:ae:81:4d:76:57:4e:57:6a:9e:8e:bf:d5:df:73:35:2b:1e:1f:37:63:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

swan.lite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 309f02bfe8aa4076794e74e95f0610dd03f14c612fce0855df3fe2391e2e990b
MD5 85466b2eb74934c4f574c2323ce55135
SHA1 08ec54ef6809d8cf178e3fb9da9548a1dd54a713
SHA512 260aa5f6257fa1ec4abd2fd52531507a18354e7722e8974b85d535081181e55e64c8fe93a80169c870e5cc62fc5ba1d76a4f71e682d4735429be72519740ce05
SSDEEP 3072:wIOHDsDvlALVIA8SW3bmB8ZWJTDUflWayjVdfEzSA8H64ejyo/:whHyNAa3Wxw4pTH67B
TLSH
T112146D1523EC8727C3EF9B76A060316AC7F1E95ED496EF8B5D8CA8E5091238499013E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

197102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Unosquare\swan\src\Swan.Lite\obj\Release\net461\Swan.Lite.pdb

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
MD5 902760412abffbd10be14842e83f0c09
SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
TLSH
T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

be:68:48:ae:8e:63:d0:cc:97:89:10:b1:45:84:7f:68:66:d0:47:4a:08:eb:2a:b6:89:66:c1:09:09:16:a3:9e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

18706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Buffers/Release/net462/System.Buffers.pdb

system.collections.immutable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 92c3c5f9d31218fe8ad9991250aebfcd0fde0b07550af76d01c3b2a445470c74
MD5 cca02fe965f0ead049e9e204d1c59089
SHA1 79bc40bfd906dc64307a57bbf30feb0435242f6b
SHA512 517d2389b9f51548a53ef61c923c5f4d318f8d93b5c29f5fc35d4494f84fbf62d240ae7cb8121e3fc2b9327a7db175dacedfc39f6534b68492f07d29a4ae440b
SSDEEP 3072:uqWFCj166bM6aJAwnDtDbmTX+/iFE1DN6n7vEuKy/aTxOhaUhg8VE7YBJsqibH5N:uqqY66/s6VEUEudqK1Vls1nQW
TLSH
T12B444A11BB9C9B33EEBF4C72B9B094A94A31C513919EB39A65DEF7F018E33149C58064
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d0:90:bc:97:62:61:24:e1:9f:e2:ed:ed:f9:33:15:12:9c:00:58:db:0b:8c:b3:cd:8e:27:e3:7e:b7:65:99:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 1, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

246570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/System.Collections.Immutable/Release/net462/System.Collections.Immutable.pdb

system.commandline.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e024ad3ab396b63ae6a52f2b968a1b84cac356077a7919a9bc7a09d7e8db1cc3
MD5 4510ef7664c419c82e01449765364eaf
SHA1 16c608d5ea4be0169a849dc31709d4af7ee2f9dd
SHA512 1842095166a3cd4f0a69572bf0635c41b055af3c3b2f64ba70a8f9c0dbb2c2317132959c5d008dfbc8898473a02b72e9384cde38005bbbb606e3a98ae76116d7
SSDEEP 3072:Ea9tHSxKajlSheqHLxSThiOzvMRw1EO7GmysQvyV385dgNNJl5wqGbjCa:1nHSxKajl40hi8w+CmlQvJXg/BG
TLSH
T134243A2402FC4A16C79FCB39E0A84510C7F9EA47A816EB5F4C4CE8E51F13B919D72A67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

27:f7:7b:8e:82:cb:a6:e4:e9:33:36:aa:4e:ec:e4:e0:1c:f5:6c:d1:46:c5:60:b4:c8:79:77:21:bc:ba:53:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

218278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.CommandLine/Release/netstandard2.0/System.CommandLine.pdb

system.commandline.dragonfruit.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5f4bcca2d61b96513cfac695c57a1403ba22e3684aa1087f2faa5b3e1b1723e
MD5 45fea6f8ab2527b390bb20e6645da00b
SHA1 7af7c1b64e659a60020097752c905b0ce08c7995
SHA512 c8b4dd850b0c6eed33a4b74c98e6ea8184b761680cc174fdb23e663083e2e92084c936034b697a380a50fc267aa996c464e759ad1b8dc0b3382d987d616ce9b4
SSDEEP 768:IOF/2TV/qLOO4WIoRqhhtxEguv/M9zNCI:r2TV/qr9qXtxEguXEz4I
TLSH
T1D0E25B42A7ECC307D9EF6EB46870D6161A39A7476811DE9E1ECCB1890D63784973133E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c0:b5:26:df:6e:ea:af:57:4a:44:ff:97:1b:48:6e:92:9f:07:5d:3a:cf:92:b2:35:44:05:a8:ae:af:71:58:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

27338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.CommandLine.DragonFruit/Release/netstandard2.0/System.CommandLine.DragonFruit.pdb

system.commandline.dragonfruit.pdb

SHA256 86ea82fd196bcbb88056b9c2a68edc8b01ba6c919ed8dee17946a4194c0ca911
MD5 8aaec23e44ff8d9a2967f1941e8eaee9
SHA1 3c79e594de0bcab19078a1ef3ae595bf8592e295
SHA512 a6f50307b1307a82fe388f368156dcd11d2cc0e5f875f27e8621983571c1e00c03429df924322d3e38bf1084b0ccc5151fbf84fafdc41189cf42ac7da4dc68c2
SSDEEP 384:Ubwg+a+usrA5zXlJ6jMaimGt+NLy5nj4SCm5Mzh0kOAHOuXch8NdcdOA7rceDACs:UpSFrS7lsxoOwuhT7ss
TLSH
T1E6426E3F6388C667C49505B25521C2DCB3734310276AEE74F3DA2A88DEAF6988776371
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.commandline.namingconventionbinder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f01e600d17916a9c4039497b3cc383d85439cbc8d3e8f5e0b543475a7e0432fb
MD5 ae970477a074bbee5cd38802c84f86d4
SHA1 1777c59967f6beada3b6e6d51174fc4c2d58aef8
SHA512 bae76ee04f1e25a0e096b40f91a264ff7f0083a6a4e0c7ae1f6d8b47868eb4fec35f0dbac3b4efed1b67c306c14ec6553e5e81277aab6b31ccf6be08406c7890
SSDEEP 768:XZCNWiyIuJmHDoB8qRingkEejbLUGXB4apu7/M9zN3:sMmHJqR8hEALUuB4apujEzl
TLSH
T1DF33190AEE6CD72BCFED027258B988129636E7C9B011D7472D5CD0E41F537846A683AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

61:b5:79:b3:3b:39:fb:ff:04:e9:5a:cc:89:a6:20:21:ec:17:cc:71:99:e9:83:2b:c5:d6:a0:96:d1:e7:77:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

46018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.CommandLine.NamingConventionBinder/Release/netstandard2.0/System.CommandLine.NamingConventionBinder.pdb

system.commandline.namingconventionbinder.pdb

SHA256 66ec9d3384db9b6ce871d67074135ec8ec525bd0a0ff990d84a225c42c92560f
MD5 2bedba4eab89af1df988099fae3b696e
SHA1 8e777c8be6ddf00c3144b0cb61d37d14b37c19b5
SHA512 43b9d15d4bf51747e27b7b913854a33448d5b042bb76bf201acff03983739c0d5c35744bc4aa74ccf6cbfdd367efd6f305ec919b3cfe0ee2bc58dcdd5f0046e9
SSDEEP 384:EJDV477JGqP8Nl9Q4eQr7HnUbJ6jMaim+NLy5nj4SCm5Mzh0kOAHOuXch81ayFbD:E0mb9Q4rYbs8oOwuhT71lUvB8
TLSH
T1B292832F67849237C442467305B2C398A37682016BA2DF78F2863664FDDF26D8776339
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.commandline.pdb

SHA256 9d0bdc4d77a425f4be0cfb0928cd48f510b99fb2f6ad4b14062be47511a9110f
MD5 d59099190d8eb660fff5221a8a9db6f9
SHA1 4b9544d12fff6f600271a4a6ca9e294792dc5d1c
SHA512 44d7426c7c7f969ac253826c35ce7e87a4b5949521396e7739c48d112e1a62760c5b9e4b24a9ab31997ab8c553b630ee78640c39d9d157049a0961c31221a0b5
SSDEEP 1536:+n/Gzp0ejcYi/MvvvvsaDMh9AZm9P7fSbo/eehnYK0dMo:TWAmM8aDMh9sGeiqMo
TLSH
T14A83081B9F45CB3BC8500077416387445375E204EA8B9F13B69A72A2AC9A7DD4F7B3B8
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.commandline.rendering.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 71ed4a8fb8c81c6e09263f0bd0814c51c32c6a5c9677e594bf5748a2a427c083
MD5 4e390da0db229d6c2eeacaa392ca07bd
SHA1 fe72add8ea057eb3079909cd8348d004c4f63dc6
SHA512 433971d7ef5d1bbe45f935e5aadb3c0436c830892c7d34f719abc542004c7ea91093b0b3735788f8ba4c59f006de79e7cb747452817d98588cfd4011da207615
SSDEEP 1536:VpGBkvsCgDPMytIsmjdHkYwcLrmNBZq+j312FmR8gaubEzYE:Vw7CAMv1jRpEZh31MmnlEv
TLSH
T1D3834A298BFC4B57C7ED0979B0704511C376A7BB2512E79F5DE8B8990E533842A203FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

66:56:b9:fd:e1:2d:df:fc:75:43:63:04:82:bc:0b:fe:c3:b1:c4:27:f8:20:6e:78:ec:6a:60:0f:f2:10:d3:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

78422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.CommandLine.Rendering/Release/netstandard2.0/System.CommandLine.Rendering.pdb

system.commandline.rendering.pdb

SHA256 e3e638ca206e863f3c00e56674c4256e819704b786734b1e7196f267e7ea0bfc
MD5 c245adc39aa795af061a4c8035a23448
SHA1 4f5833c025ab605dd880fd594ee838d52bc69630
SHA512 9cb79a5ccaed96ba6e2f1d6533f1e314e751f606d38c317a603ad348065029a83c00c93abd62bb51ad8a549329497745bec78c34513cd1478853c17548803daf
SSDEEP 768:WxEYXfPf4Q5NrnCzBs8oOwuhT7H+uczjpT+QKDoGbF6qg:ALXfX5tnC5P7uGU1
TLSH
T105F2C42F97249227CD4154BA4163C354A731C300AA959F2BB3CA76A6EDCE70D8F76738
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.formats.nrbf.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 761d7c34bbc816181258e079e028d9f1868a0d9e9e8b41a3776c9b7677611a30
MD5 0d5ab7623c7d27b18aaedbac3f80e667
SHA1 2507772822466e0127c9dbe63c7768fe2e2cd69d
SHA512 d534f94b8377a119157450cdb4ccc07a88dc6103eb9c1f46ef66e5cd1b8e4fef50685c6404e8ed0d4ef9a0f9e716f9b550387270a5799bcfa2b11f48f7370227
SSDEEP 1536:bfefdoRvZ2oYo2iuQO6hMfEPc7ijPUTNPN2XlBQzrdc:bfefiRAQIQ19Pcuwl2VGy
TLSH
T1C4639D1D23EC476BDFBE0E39B4B8E1190736D54A2002F39D1DC5B9DA095BBC85A2077A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

5d:af:a0:9a:7f:69:d9:34:38:44:92:bb:a9:e2:a6:c7:93:cc:28:b3:29:7c:03:d6:28:45:fb:46:25:36:12:58

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 1, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

66494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/System.Formats.Nrbf/Release/net462/System.Formats.Nrbf.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ae:a3:86:d1:9b:06:39:d7:1c:ad:68:32:06:75:f7:af:5a:40:e4:f5:66:01:12:56:75:99:3b:c7:18:c3:38:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

138594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Memory/Release/net462/System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

0f:80:90:1b:17:38:ec:61:65:dd:0a:c6:a3:dc:d4:0b:33:38:e1:79:30:66:08:69:e4:67:38:b9:b5:4b:38:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

105250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Numerics.Vectors/Release/net462/System.Numerics.Vectors.pdb

system.reflection.metadata.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e5b62fe983c6e9b8bd08e41a2d802de7ea0a8b7450661fcda1e52c345d0e2495
MD5 608185e3fd4bc6a5cfde550802f5f2c7
SHA1 5ff6c637b8b62ac2c737bb4de20b49c1d63ec612
SHA512 5539384044ca182ad87c53f4c2ceb51cbf8a98e87a4f94fd60e97730d1236684a46f8d710cd68d8d5742d2aa64b7d8401adb428f199076c08c49aa0a5a064cbe
SSDEEP 6144:YjyrbeSP7DOQnA0OV6xB/uXknBDctMGE4lhOz/S3EsQX:YjyWkVdLnxGE4PQS3By
TLSH
T1D5B46A5433BC673BD6AF4B74F0B1082A4771E845BB17F75E8948A2690CA3B59CC10BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e8:eb:4c:f2:18:e1:e4:7b:43:ef:d7:58:ef:c1:26:6d:0c:9f:b9:53:3d:45:ca:e5:eb:ff:27:a7:68:ea:28:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 1, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

508346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/System.Reflection.Metadata/Release/net462/System.Reflection.Metadata.pdb

system.resources.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6008cac7c8e23ace0c71903d770229d9e972c7bff4aca34eb0039f3b819a4da9
MD5 a7e8ff7ef17fa5db88ce75eef0c2f9ba
SHA1 782d3ac463864760b838d7cc598e1af8d2d50d32
SHA512 b4923c0af08c28ffcd182bd0953e0763f9802d548e1368799cb3a517fa25bdc90bd05dfdafa9cb274f1db7dad8d00ede974af92eb0dc12a6c6df8f8a46e7a66b
SSDEEP 1536:xFlEGrd+4Ckkst1GlBMViHRpCSVIW91TbUcU6gFeF9QcGczXNcf:xFlNx+Nkk0sDMip78619QzcZE
TLSH
T1C0B3070273FC565AF6FB1F75A9B450104F36BEA6A936D75D488010EE09F2B80CA70B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

81:3e:e6:aa:c0:0a:d5:09:40:f8:b6:d3:ac:8e:76:a7:fe:59:48:ee:34:37:93:11:13:fb:43:83:98:39:fd:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 1, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

110294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/System.Resources.Extensions/Release/net462/System.Resources.Extensions.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

system.text.encodings.web.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 78eb5b4fee580e163d1bea1fdb7d371fdfcfd30acd8708ff62c4372aaa219f7c
MD5 ba1af3bbff4d457b6d3f730234c3c701
SHA1 1b75bc14daa093502c7c5814852928e28ab6659a
SHA512 51895c9b0ede088b034c581ab4574a36f80e41f2b04186b3c066b6d72da85680e00ea5e07dc9c89db7d997c1ad3d9686accdc827859eaab2918376c4c9e469b2
SSDEEP 1536:HOOuOOOoODVoXY9BnEf8uOxvW8hYEWroNFMRwkTuMd:VDGXmnEUuOx+8KEWrobMRzuq
TLSH
T12E736C1167889A3FC76E06382C748135A7B4AFDB5233F3831896394A17733C8E6197A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

cb:49:cb:da:8f:63:0e:cc:18:af:f8:e9:44:77:15:b8:c2:d0:57:13:36:02:d1:a0:09:c4:cb:58:89:8c:d9:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

63862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdb

system.text.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bde4850d39245f9758d1346bd67ac890eec25473b7a7171ad6e631a4c5fd4734
MD5 35b0623746e769d4122a4d7dea5b2b68
SHA1 e7eec604fabd309a1e5e69cc51d553dd65e97a7a
SHA512 4a11ef391bb1d2e186d20d45a3dc5ab03a8f740bf6cb2f519860dff7db113757b3b377feebb710c4ef80f1931b43072edd415e25dcb0d2d72ada1114ac90afbe
SSDEEP 12288:8RIKchfMjooqRACgBhAjKJgHAk6E8zzsceI8irwEwtWK7P:8RtchfMjooqRACgBhAjKJgHAk6E8zzsV
TLSH
T1AFB45B1063E86A2BD2EF5732E47490519B7AE85773E7DB5F2408A8FE58C27518C037A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

27:af:b4:71:fc:3e:95:11:39:5b:ac:06:c6:f4:f4:8c:51:ed:18:1e:f9:0e:69:ad:a1:fc:37:e3:cc:71:b0:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 20, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

508158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

tr.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5f7bcf0674b3bef3fd487e8b4b79f48f322f6497066e0297a990af8fd189f29e
MD5 5c371caf4d1d6184195ac9ea00ade39b
SHA1 aaa46bf0991a37d19a4590d5504fc26b27a669d4
SHA512 82b87ecd7be4c617b6d177a95f7524a60b5235c5d087fc85d293f9e329be93336ebcad9b28f532ccc5bbf4d2495909840fdcd0e5eb08b945aaf4c8f29aee929f
SSDEEP 384:XDLiUSNAFfNmL5oZfWSZxyHRN7pfCVOY/wR9zKw2j:X6AFfNvlxuE/M9zNU
TLSH
T17692F846A7FC0106F8F76E7066B5D5026D3EBF976D20D52E1594A20D0EB3B80DA3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

84:61:ca:9e:39:f8:16:e5:a5:86:0e:07:c0:cf:f7:9f:fc:c3:04:7a:4e:10:ec:5d:d3:7c:f6:c4:1f:72:74:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zh-hans.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 250ff26f266a401ace67985ab3e411fca5ba4b34a0e0c45a307373eaac2ef831
MD5 2968923b9f4a77c01b9c62b16c982187
SHA1 9826dade9110940ddabd02eddd8d91d47fa170a1
SHA512 33cf1e2e2f40336eed73f7fab89929c3edcfcb860835829dc2613458cba36510a06c077a54fe605fcfd6c2a5ca5487b1e7794dd10e36d4eb484dd55069c8a8bf
SSDEEP 384:nZiZqSNAFfNmL5oKfWSZ6yHRN7eJLMB+6R9zQbbGbM:iAFfNIl6uGos29zp4
TLSH
T19A92F652A7FC1206F8F35FB06AB9D5526D3EBF972D20D51F0595A10D0DA2B80CA3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ed:a8:56:13:6c:ea:ab:e0:3a:0e:f5:82:b6:ac:d4:7a:7d:6d:2c:60:f4:be:ba:4b:61:f5:cc:cb:7c:ba:61:d9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zh-hant.system.commandline.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfb57c0b551a9cb64ed2e554d4970b76293af2c026ea657b57c2876a41819d1b
MD5 fdc17ef6cdf254b3a25e6bda40ba96fc
SHA1 8ecda13826ae488155623d780de487a6733a0b21
SHA512 8a222c57cfd17d4415ae5378ba18f3e8669bf1776cde520be65d2042d8b2dd7a6dfeb336e8555eacaafeceb7b27cbd5ddbc0ecc45277ee8dbe14b712c996de42
SSDEEP 384:SZi7SNAFfNmL5oCfWSZ8yHRN7RSx/oLMB+6R9zQbbhbf7wk:0AFfNEl8uExgos29zGr7wk
TLSH
T1B192E856A7FC4206F8F76E7066B9D512AD3ABF971D20D51E0195A10D0EB3B80CA3273A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

75:fa:7e:f2:8a:9e:2d:87:0f:5a:80:4e:11:ad:59:f2:4f:30:f3:29:fc:a1:73:5d:e5:17:c0:d8:78:9e:a5:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 14, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

Deceive.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

cs.system.commandline.resources.dll

mscoree

dotnet

de.system.commandline.resources.dll

mscoree

dotnet

embedio.dll

mscoree

dotnet

es.system.commandline.resources.dll

mscoree

dotnet

fr.system.commandline.resources.dll

mscoree

dotnet

it.system.commandline.resources.dll

mscoree

dotnet

ja.system.commandline.resources.dll

mscoree

dotnet

ko.system.commandline.resources.dll

mscoree

dotnet

microsoft.bcl.asyncinterfaces.dll

mscoree

dotnet

microsoft.bcl.hashcode.dll

mscoree

dotnet

pl.system.commandline.resources.dll

mscoree

dotnet

pt-br.system.commandline.resources.dll

mscoree

dotnet

ru.system.commandline.resources.dll

mscoree

dotnet

swan.lite.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet

system.collections.immutable.dll

mscoree

dotnet

system.commandline.dll

mscoree

dotnet

system.commandline.dragonfruit.dll

mscoree

dotnet

system.commandline.dragonfruit.pdb

system.commandline.namingconventionbinder.dll

mscoree

dotnet

system.commandline.namingconventionbinder.pdb

system.commandline.pdb

system.commandline.rendering.dll

mscoree

dotnet

system.commandline.rendering.pdb

system.formats.nrbf.dll

mscoree

dotnet

system.memory.dll