mythicapollo | apollo[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
apollo.exe
Size 1.6MB
Sample260817-lkf2csgr7y
SHA256 6c279db1aa2faad55bc60050cac366a13f5237200b0fa16941a047d2195065e3
MD5 5fee512f1607ce973f0c3bf9021180f8
SHA1 c05fd361ce6346d7c778bc241269cf577915ae82
SHA512 bb49a18629624dfe9596e8333121fa663911e3f71d2a733f6b1627209f64574845ae4345547bf8f6d11fee98aabb158399f4085e4f733f214a902f804a9b7cb1
SSDEEP 49152:4bn+CC2U2LiET3zdr9HRcdL81vgPedyKvU7Z+6AnFRws8PJH:4bnHC2LNzdwxOvgPedyOU7MNTwNx
TLSH
T15885330A6309005DC7BB8FB774797A902F7AEA4EC866E3DD154E396B068BF504742732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura packer backdoor mythicapollo

Malware Config

Signatures

Family: MythicApollo
Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.
backdoor mythicapollo

Detects MythicApollo 2 IoCs

resource	yara_rule
sample	family_mythicapollo
static1/unpack001/apollointerop.dll	family_mythicapollo

Costura .NET executable packer 2 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura
static1/unpack001/tasks.dll	costura

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
apollo.exe
unpack001/apollointerop.dll
unpack001/costura.dll
unpack001/dinvokeresolver.dll
unpack001/encryptedfilestore.dll
unpack001/httpprofile.dll
unpack001/injection.dll
unpack001/kerberostickets.dll
unpack001/plaintextcryptography.dll
unpack001/process.dll
unpack001/pskcryptography.dll
unpack001/simpleresolver.dll
unpack001/tasks.dll

File Explorer

apollo.exe

.exe 1.6MB
apollointerop.dll

.dll 311KB
costura.dll

.dll 4KB
dinvokeresolver.dll

.dll 91KB
encryptedfilestore.dll

.dll 14KB
httpprofile.dll

.dll 19KB
injection.dll

.dll 33KB
kerberostickets.dll

.dll 34KB
plaintextcryptography.dll

.dll 13KB
process.dll

.dll 34KB
pskcryptography.dll

.dll 15KB
simpleresolver.dll

.dll 14KB
system.buffers.dll

.dll 20KB
system.memory.dll

.dll 134KB
system.runtime.compilerservices.unsafe.dll

.dll 16KB
system.runtime.interopservices.runtimeinformation.dll

.dll 32KB
system.valuetuple.dll

.dll 77KB
tasks.dll

.dll 1.2MB

apollo.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6c279db1aa2faad55bc60050cac366a13f5237200b0fa16941a047d2195065e3
MD5 5fee512f1607ce973f0c3bf9021180f8
SHA1 c05fd361ce6346d7c778bc241269cf577915ae82
SHA512 bb49a18629624dfe9596e8333121fa663911e3f71d2a733f6b1627209f64574845ae4345547bf8f6d11fee98aabb158399f4085e4f733f214a902f804a9b7cb1
SSDEEP 49152:4bn+CC2U2LiET3zdr9HRcdL81vgPedyKvU7Z+6AnFRws8PJH:4bnHC2LNzdwxOvgPedyOU7MNTwNx
TLSH
T15885330A6309005DC7BB8FB774797A902F7AEA4EC866E3DD154E396B068BF504742732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1721646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

apollointerop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b0973888076b0399a952e0fa235a6b99f8e56c240c620b576b8ffc325a233a5a
MD5 2f8fba0aa91cffa5b8d961874cb7af03
SHA1 ef8287b9938db4ff296f5bce370933e7faae4f06
SHA512 03146d24e03d8097fb5e2f90afad29b4eda49710172694c0ed57ae40bf4f7e39569c1450ad0dd07b43e3bd80c8cd587c1acc6e9c315ec7dd99c947d03dbe5e9b
SSDEEP 6144:TqMSssJsCZUiJgcmp6ZQCmMlJPij4ghGMmekHcVo4x3ZIgsp89Bn9nt33U6zV:T3sBsCmOmZBsp89nt3k6h
TLSH
T194640813B6280FBBC60D42BB303D040A46A85739614FB77EC99DE89F2DD6F421E556E2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

324798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
TLSH
T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

dinvokeresolver.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 71dccca0f3f22dab4c113f7dec7a85427cb5a0670931b6b22a7f80b5c8029f86
MD5 5603bd718a201355946ab0e7e1ed2ba6
SHA1 3eec8021a7736c1ca648867b4195b0c75c2740c2
SHA512 7c33f3307f52cc84d9f9f05129e0dd1e751e5e1a4f25865c0af0a86b0ad4ff83f24d60187364fe658f4239e57b22a18c024015d4dcac64698a45d01e27a211dc
SSDEEP 1536:B04SE/1qBnpQ3arzt/A8Wvk3bjTqFo4sJoMANCGr6:CA1qpp9Anvk3bjT2osrNh6
TLSH
T19A936C4133D96DA2C6AE437D78B1700156F0F00A677BFB5F688890AA5F96FC546233A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

encryptedfilestore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 81ce3d6adc26e509e50a2d3cf8fe643983b6cd53db263becb379185a453a7ddf
MD5 b7647911715bd34a861fcdc03fa3b709
SHA1 11523c9cc1f763d35ddf9384b4dd274cbbcc4e26
SHA512 941413c7132af921da9cef33f7ea7798511ae1eaf4adf960200203a4a12ed33c8d2dda95a150189e570a7827ef3688a236dfff27f329805db14bb09a66754fb3
SSDEEP 192:M8N+qHJJWyF2sdjFyginyH3SQ3iQq7hCM5w8G1T4EIIrLj2+HA1TPm1kgPjxFbOG:BlJLUs/0nW5tqdO8EIITZ+DmDww
TLSH
T1EE62E53DA39C6377CF5A0638F87EE5540BB693187217DB3B6704A1471E2B78804687B2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

httpprofile.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 28f65a2544276e457137f23682e3348885de165acca2b18ede16004abf114ef5
MD5 f406b9ffbb96bfcd91efa3d19f6becf9
SHA1 287dcfb278973301ccba36b696a00ec14d11d913
SHA512 324b2badcb0a2135863159b787aa2e88a090e9cc97fda0aaa2cd5401d73240eb526369fda1fb30b4a6dfa2b7fe48ad530dfd2cbcfabb936981a3c505dc3f3999
SSDEEP 384:d98ExgwuBe43X13vOxyihIOF22TagIghiRL92htPrdkq+FICq:v8ZtBN3X13vOXhIOGVgh7PiF1q
TLSH
T1A192182263AC5333CFAE0AB4BC7691450F79D38A2403D77B178890CE9D67F8552647A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

injection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c98267cc40f75e1fb4f4550f4bee6c4ade2e46e49da025c9076ba578a8e282ae
MD5 60d473bac66849e7b1ff4bbb1af7531c
SHA1 05b9155d82575223585d64350f8956bece22cf93
SHA512 fa77b44d0a7cd4887bd93850a414ad9c0a8abfcc4da1ad90041ee6b59fcb90699449871ce8bdb232351ab3044e52040b06bb45a3dbff7ed1fc7cf495271cfe0d
SSDEEP 384:fVN97yMKgARKOgYLyo8td4giY43En4tF1cOsRJIy1j7JVgyuvG8tsMR1yS7FAU:9fHExgigtd4gkmK/eJo9YiZ
TLSH
T15FE24B2467EC26A7C9BF0A78FC3641010F75EA593527D7BE6688F066CED679402A0373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kerberostickets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b6f7bd83e713d496b46ac3d25c93c275dd61cd27aee64f3f1feef4290853e06e
MD5 97741e10b36b56bfc76e620966390b83
SHA1 ce33052df66b6b81201db97cd3771d3df8f18148
SHA512 ce5f0cd6dedc5a9e15d740e1e6ba4750c1b3aa5501a3c8cd0fd1905dcc075eedd3e8b31606bc1c22682e162ef6943bd85346d68fe45ecb36174b34825108d609
SSDEEP 384:H1FNwrT9S/jFtn6WYYvZKBZWz0Co4cpjB5T4PXIlrKLECjGfOlrdLd1gmgtVS:VF2Mptn6wrPonxT44wDGCgTtg
TLSH
T1B6F2391923F88766D7FE0E3974B605220BB6A74B2226D72F0EC8A4FB1F5578411687E1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

plaintextcryptography.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1fe8353a7dcaf8253d35998c8466a00fbd2a4581735c55df2a86b1171003c516
MD5 10ae4cb555642f3d02950938c68af12f
SHA1 d0ae0c1b44765fdfce339e29d175707fc47bbc54
SHA512 7e59d306e09b8f8ac60ae1610f160327b9f33f2d6948c4e59954401bbcf5a9fdd9e1371214dbccb133a1c22a27c9b92913db0eb36744d5e3c887ace49fc31412
SSDEEP 192:I8WGaadj5b5vj95mhyaYP6i3IrP0zA1ihYtkTY6xFbOYRmW+iS6qVJo:I/ydTvh5mhyaYiGIfRPo
TLSH
T1B552E635ABAD037BCE6E4638B83AE1550A72DA443523D73FA708D4C70E9B7AC4895371
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

process.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e6a6e59894823a06052f7857f91a62df1f3d537d37dee645fa6f7db77285930e
MD5 13dc6663afe1e21d37a466c227ff25cb
SHA1 bf9d021fecdad81c88214f2461c7997e2dbcf694
SHA512 bc4cf3f4af4b7a2bd259458c14fa3da58fe24b1f7670ff617a392840ade772234b413c1ab8ef513f05da061dd5a5257f98924ce3107da9606cef4dacb47739a4
SSDEEP 384:Yifkz7MUWa5CNWe20gZhcPDDM0Y26Ublnc0tHZ0OuIGul1fN9rMStecCpkjvDAdj:Pxu5GPPDPY26Il3nGGMfBhNuE
TLSH
T1E2F24A0163CD5F7BD9AF0A7DB429A5430BB1F1223A13D72B1DC8E4674E8779886A0363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40962

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pskcryptography.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 52244c9c13e9cb223be1a87a7e358d2fee7ae401b9fe023adcaa4ce31f6a48c3
MD5 aee8042bb9db491a42d7f754e071c544
SHA1 c5f1a786dbeee3c3ef83fa9d99f976eb61df1770
SHA512 b4332029a5d40c2acd73c799d5e28f79f41d65a200320b93ce11914e0b4919d59ce2b689d6859bfe2e0a0c7b8619b38e9fb984a0487876cb9cfa660788290c61
SSDEEP 192:APGal0zjzlg9Hxxll/1IpR9MTZoRePHN37xzIr4JoBA1BX9LhCDwkqxQxFbOYRmj:iizvC5ll/1IpR9OZoOtlzIO7hCe1
TLSH
T10962E53D638C23BBDF9E0674ECAAD6950B75DB0C7523FB3B9604D8425E1AB5A2024371
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

simpleresolver.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 71b67608755a631017660e7950061a828e878cec8b21503d746903957270ff28
MD5 b34d882857dced51a4bcc6cc1992bcab
SHA1 ec113fa50dc64a06e241666388de3d80cb360df7
SHA512 044470dbe2759c3784911e40a79c2ba9be3613293ed4a30a19467f3814ee25decd44f6a78789efab6000e11a3820bd165cb0652d721405a7546afd29f9ee77f4
SSDEEP 384:qc0z9qczccYxauOHvfg6Lp3yImICSz5g11:6z9dzccYxauOHv7JnPz5A
TLSH
T16362083EA39C337BCF9A4638EE7A91111776D34C3A23EB7B4244D8021E1E7A90115339
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 423200010a7684763451473a4fb206dfa074fc8249676621ef9d9a13417d364d
MD5 a48936868abf91274def7231aa52dbb5
SHA1 f02fa5231536c0dd9cef9e84e609646b23d5d33c
SHA512 c8fe3d1314794ae7071a647e328a46a30e6d96e574daa896fcebebf6bb51ce0af14e6cc63a0e1600a0e4adbc7aa18e97ee58581adccac23981c029ea782b5f9d
SSDEEP 384:ay/fjFwUI/KQyVvKdDhG6ISDFWvYW8aIcyHRN7WEg2ly0:auhMaVmzDC6b
TLSH
T16E926B02DBEC0107DE7B1D3117B0DA862E36D3C66612DB6E0984F9562EE37869B1263D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ed:d0:e0:df:c8:a1:f2:86:2e:5e:07:95:e6:59:af:43:a5:5d:5d:54:50:a7:8a:ec:33:2d:4a:60:2b:cc:64:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

17350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netstandard1.1\System.Buffers.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 06ea95f8388a6b031acb2449fd5663d9d26d720ae13df80c800805f896734430
MD5 6e6b7b9faa684d668aef8589f41f368c
SHA1 74373d82e6b9f3236df0e8aa555ecf510b9a6f2b
SHA512 1c656a7dd4a4cff92e671771e43d907a279eb9092735e3812480dad7067a2f94bf0c3346a5d6ff0f2131c21ce9f989b386b9a72ec267e8ab36d3f1909ec1a33e
SSDEEP 3072:s3XFz0qjCIPMAxlUXUKoPfw0kG71AHK7c/X:W0qjCSRE+fw0kG71E
TLSH
T10ED34CA8AB85DB52DF4F8E34F034214597308A279647F76629C878F027E679D38093E9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

7b:79:1d:b7:9b:6c:d6:1e:32:75:f9:5b:0a:9c:4c:10:ea:f2:bd:45:d3:23:4d:72:1d:29:db:6e:49:5a:67:6a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 8, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

131986

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard1.1\System.Memory.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a2d38a330df390cc739689369a36520fe491d3660d73974eb46b51608f50675b
MD5 c4cfe03f75bc01969bc936c9c09baa12
SHA1 cb96ea48ee8aa9fe764d6f1ec30751001a0a646d
SHA512 6db15403523b6c966d7aa6906cfc219a956f6c7a68c60774e9ed9f261df1a4d6731b92c59f3caafaeb345b853cd237fa163155b8b8e7825ba69a634878c929e2
SSDEEP 192:RMyaqO8cxdQWXYWJeaotWsI9A9GaHnhWgN7aJeWwgCWuXqnaju02aU:RTO9dQWXYW8aocyHRN7WEgSly0
TLSH
T1577217054FA80A43EE732F305AA4D942EE38F3965926D32E2D84F1791CDA7D59E21638
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

47:86:03:72:1d:8a:6a:0d:17:19:34:7b:33:4f:5d:c5:df:54:05:0f:20:07:c7:0c:5f:1c:40:e5:db:01:df:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

12798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

system.runtime.interopservices.runtimeinformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237
MD5 82deb78891f430007e871a35ce28fac4
SHA1 4e490d7ec139a6cde53e3932d3122a48aa379904
SHA512 e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a
SSDEEP 768:vn1VM0JrpNWDcIh6leOiDFIFBYp1+ziBEBMf:vnvXYcIh6yFIFBYpczyEBMf
TLSH
T165E2FA5097FD4602F9FA0E317DB6E58B2E3A7FC65C209F6E0154A1980D677889A30F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

05:db:74:2f:88:32:73:ab:f9:54:bf:23:c7:95:38:b8:ec:aa:28:fd:f2:85:57:f2:b9:b4:98:f1:5d:1d:a3:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

56:92:ab:b2:b2:ea:e2:5f:1d:7d:b4:40:b3:91:8f:25:ff:d3:35:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a2:4c:8e:1d:da:a9:21:7c:84:00:00:00:00:00:a2

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

Major OS version

Entry point

22454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net45\System.Runtime.InteropServices.RuntimeInformation.pdb

system.valuetuple.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d6fb0dcfee1490a8168117ed1b55758f11db38475417b3668d19f89dcb55cbdd
MD5 99cec77dbee0ab10b9fc4d52a1d414be
SHA1 c83d024e80c36b663458d478dfdb067336e2d616
SHA512 988b0ff9ede87fe7538b2e0cdd684962965b4fc2a4f0fc92726248f249cacb7c5674f3978d2d7cbed68991c71e0b0339d6edda57384097a4da8efd7d77b43cd9
SSDEEP 1536:h784YWac+abptsy5VyYc/9n1RcGxzeeUVn9KyQgHo0JuresehaA1VUF:h7N1r9KGI04CCAP
TLSH
T1D173E82C23583653C73E843318A699C7AFB8D30BD74657BB7DDAE5E818D2374A302664
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

50:0b:9b:f8:2d:1f:dc:2c:85:5f:8d:44:8e:f0:06:34:42:5d:c4:9a:fc:6f:51:5e:c7:96:0d:06:3c:1b:20:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

e0:5a:d1:da:4b:60:60:fb:28:f2:b5:1c:59:6c:d7:66:96:16:eb:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a5:48:17:72:27:f9:70:be:63:00:00:00:00:00:a5

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

Major OS version

Entry point

68586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdb

tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7ea865e13b043f080f83c006d466b5131379435a442f8837349c87c6450259f0
MD5 5fafce7645b06b01aac04b0f70e43a37
SHA1 b35347aa20d7eafc5c39a93c144a4b0fd74d7c4b
SHA512 9c39bbab90ced51628343c4980a6c7ed58f3380031f32aff76b168112e3fb906384522023cf60d4f3ae9b99df241dee2e64c6f87038527bc6ad739d7aaa6e81a
SSDEEP 24576:uubn+w1C26XHvYLJNRZYxDT6Pod1j9GWaKZN7GN8XzF0Ywo+wdRGmHw6u+t8r0qF:xbn+CC24HvQNRqxv6PodSKfKuiYwfwX+
TLSH
T1A65523118B01915CC6FB87B3B4293B001FF6A54944A5E3BD1E8E39260B9BFD58783B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MythicApollo
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1316558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

apollo.exe

mscoree

dotnet

apollointerop.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

dinvokeresolver.dll

mscoree

dotnet

encryptedfilestore.dll

mscoree

dotnet

httpprofile.dll

mscoree

dotnet

injection.dll

mscoree

dotnet

kerberostickets.dll

mscoree

dotnet

plaintextcryptography.dll

mscoree

dotnet

process.dll

mscoree

dotnet

pskcryptography.dll

mscoree

dotnet

simpleresolver.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet

system.memory.dll

mscoree

dotnet

system.runtime.compilerservices.unsafe.dll

mscoree

dotnet

system.runtime.interopservices.runtimeinformation.dll

PE Signature issue

mscoree

dotnet

system.valuetuple.dll

PE Signature issue

mscoree

dotnet

tasks.dll

mscoree

dotnet