net48.zip
- SHA256 8e1b318f9ab1af8d142dd78235cc04f8b0980663235eef2cc477a0aff85cef06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
net48/GenesisBuilder.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
net48/GenesisBuilder.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
net48/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
net48/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target net48.zip
- Size 280KB
- Sample260815-vb2fdaek3s
- SHA256 8e1b318f9ab1af8d142dd78235cc04f8b0980663235eef2cc477a0aff85cef06
- MD5 ebcbb1426d53db8ddcc7070275619980
- SHA1 8898224df9614a8d68947b89fbd0375a5b9b887d
- SHA512 49faaaca20df95abca378195e8daaf9eb3dcd51caf87cbb14fb0cfaa853417385707aada35cec1e47f6a39a4bce6598162f1b5d2783a27daa92dad1db9ae31da
- SSDEEP 6144:y8Aj6khvrBWE5bKGHcEewdu4p+MpAT6TeoCr2ANPQJQyY:59kx0E5OGHmwdu4KTB2AlQK
- TLSH T1AA5423D1A37D192BE5307AAEAA926928DF13CC2400B1D3159FC0C39EF22D055DDB6E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/net48/GenesisBuilder.exe
File Explorer
-
net48.zip.zip 280KB
-
net48/GenesisBuilder.exe.exe 31KB
-
net48/GenesisBuilder.exe.config.xml 174B
-
net48/GenesisBuilder.pdb6KB
-
net48/Newtonsoft.Json.dll.dll 695KB
net48/GenesisBuilder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6b38ebe8ca9c8bc9553bfd4dd44ed8d5d5e9dec6476dad4cbe4e6985f84d254c
- MD5 c7ecf0c6307d5deba757d06dd1bef2fa
- SHA1 e575518589736658b5618a3c8309044fdb601bf2
- SHA512 c9de069c410e6a9244cb908052fa9fd47feb7155142bc95cba3ccb2fe5a6bccb4c326d974cec13d1eb5690267408af4fcc9eb16dfca2eecf6e5648f13276f138
- SSDEEP 384:kpdL0Xr6C26A9haFpTrYd57nAY8b58v95dKjX3Xrbrt70uEgJDNl4w4UmeVO6zFv:hFe7n7uqv95daHp7RJRr/VvF2
- TLSH T141E2600073F9461DE2FB8F359676424509B3B95E6C32C25D9E4C988E0B73B869862F73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
37830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\frede\Desktop\Random\GenesisBuilder\GenesisBuilder\obj\Release\net48\GenesisBuilder.pdb
mscoree
_CorExeMain
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net48/GenesisBuilder.exe.config
- SHA256 051099983b896673909e01a1f631b6652abb88da95c9f06f3efef4be033091fa
- MD5 2a2df45a07478a1c77d5834c21f3d7fd
- SHA1 f949e331f0d75ba38d33a072f74e2327c870d916
- SHA512 1a6dd48f92ea6b68ee23b86ba297cd1559f795946ecda17ade68aea3dda188869bba380e3ea3472e08993f4ae574c528b34c3e25503ee6119fd4f998835e09d7
- TLSH T101C08C1940E8BD278D328F27A352C926EBB0B2A6A064080CF02FA9670B3108D8247326
- MD5 SHA1 SHA512 TLSH
net48/GenesisBuilder.pdb
- SHA256 bdbdfe7d763832d2c45d4531791aa2b4e1d13b5dcce11965dc2d473712c45376
- MD5 1df3383bc92e2032395482520b0af40c
- SHA1 e648a19cc70f864545c5aa3179f13cb7dff9d6d3
- SHA512 2340fd16253c939bf3cf107b288cc4c2d8c825473edfcd47619d142ad8c9c24268d12a72de39622618260d01178900242fa763b0b2223a3e334cb5dcbf5062ac
- SSDEEP 192:zbkAFRmdzzMzXl2fDTK2Np9vPu6EqWDPbGG:zRmd6Hcp9vPeqWTbGG
- TLSH T187D18589EA488B3EC1D765BEB523432F5334C111AB41AB64529C7768EDC234E4EB21BC
- MD5 SHA1 SHA512 SSDEEP TLSH
net48/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ