XerinObf.rar
- SHA256 2e7fabde41b3d7fe1cf5ee447b3eb2d76a3d02d4701e14263d5a33087251201c
Password
Unix
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
XerinObf.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
XerinObf.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
General
- Target XerinObf.rar
- Size 2.2MB
- Sample260820-kwfpaswvhs
- SHA256 2e7fabde41b3d7fe1cf5ee447b3eb2d76a3d02d4701e14263d5a33087251201c
- MD5 0ac949b82b277b50c00e8d82588771e1
- SHA1 65bb3047c9dbb9dd3a9347e330c9d30e0a9ed9db
- SHA512 c84281a87b546c3c9f73fc67256d31ba84a1a880ef3576031c85cf617631bb950b979977db5f96b36ff322c30f692fba4d2cf93287ed0373257320c00398e272
- SSDEEP 49152:wMi57MFf+Jr8Kq7tDKU/UrTy5bONLYy0VXPd9J:t+JrnqhDj/1bxXFP
- TLSH T178A533D9F485FA81DD7E22EA4F2311C859828F324B6E273439C50467287DC7ACDDB986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/Xerin/Confuser.Core.dll unpack001/Xerin/Guna.UI2.dll unpack001/Xerin/Renamer/Confuser.CLI.exe unpack001/Xerin/Renamer/Confuser.Core.dll unpack001/Xerin/Renamer/Confuser.Renamer.dll unpack001/Xerin/Renamer/dnlib.dll unpack001/Xerin/XVM.Core.dll unpack001/Xerin/XVM.Runtime.dll unpack001/Xerin/Xerin.Core.dll unpack001/Xerin/Xerin.Protections.dll unpack001/Xerin/Xerin.Runtime.dll unpack001/Xerin/XerinFuscator G3.exe unpack001/Xerin/dnlib.dll
File Explorer
-
XerinObf.rar.rar 2.2MB
-
Xerin/Confuser.Core.dll.dll 171KB
-
Xerin/Guna.UI2.dll.dll 2.1MB
-
Xerin/Renamer/Confuser.CLI.exe.exe 28KB
-
Xerin/Renamer/Confuser.Core.dll.dll 171KB
-
Xerin/Renamer/Confuser.Renamer.dll.dll 298KB
-
Xerin/Renamer/dnlib.dll.dll 966KB
-
Xerin/XVM.Core.dll.dll 495KB
-
Xerin/XVM.Runtime.dll.dll 74KB
-
Xerin/Xerin.Core.dll.dll 143KB
-
Xerin/Xerin.Protections.dll.dll 95KB
-
Xerin/Xerin.Runtime.dll.dll 38KB
-
Xerin/XerinFuscator G3.exe.exe 2.5MB
-
Xerin/dnlib.dll.dll 1.1MB
Xerin/Confuser.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 145bfb825a224bd09d3eeb2f5bbebbda0b0a627ac35e6bc5adfef9537d46210c
- MD5 924c09ad9f409b6fd5068c5f62e9be9f
- SHA1 eec8ade5b4d4b6a5109f25d40d017dc93e397497
- SHA512 a8d91f61dc9f42af4091ccd2f3b6ad2f605ddccbd1f0c44640fb2e04a4ba38dbbc01f448e9e69c527d7bcbd642cc9417ccfee680816a37b93db29ccb4b2d0aab
- SSDEEP 3072:lA3MWa01NyoZOM5WyEdTqaCJ0b4AK3wQBjWlWz1A3fC:23T31NyooM53ENqaCJnAj
- TLSH T155044B152BEC8727DAAF57B8F474150447F2E523A5BAE78D9CC874EB1903380D6213A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Unix
Minor OS version
0
Major OS version
4
Entry point
180826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
J:\CEX\Finix Obfuscator V2\Confuser.Core\obj\Release\Confuser.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
169KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 538e6ca6001d609e251f88243409a2cbc9bc0517751843e76485a2c335e7829b
- MD5 278752062981db6fe27ba55f5099b8ae
- SHA1 8446637986cf4a24e9135ee5c54f3170600e1e83
- SHA512 142ff82ca90ca63a6a854e866615d742b585c102e8c4de5c773edeb1ac30c2cc2f6bcb190da394e4aadb4ef9518d194d99904463d6e952170d2924b16fcb00a5
- SSDEEP 49152:PQNztBO2+VN7N3HtnPhx70ZO4+CPXOn5PThDH2TBeHjvjiBckFjvkoEFB:PAhck1
- TLSH T196A5F9153DD4EE27C16ECE3796E35011E2F1A4933AB2EB0E62D35768184274978873BE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Unix
Minor OS version
0
Major OS version
4
Entry point
2158494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/Renamer/Confuser.CLI.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 668a0d6086e26b3cfecc9077c472daf3e417d2c73273c3059606867f524dfa73
- MD5 e2798c4db2834e114b7a4c532e8ac535
- SHA1 a9472ad70a34c49c3016acd142993c194111e150
- SHA512 085defa6dc9a8d8273374ea34d6c60965a6f3ddf1ce977468021b3cf501ed77a533221f3b4db1474684c57f0d1f4d997b13bcb4494c7d416c2b1dad52315f510
- SSDEEP 384:xBam0H3olYyfAJ9tmB7UmzAGNTXhZe8oEe98b0xeoSy/MwWjnj8VtDVth7WAl9Mg:xgmfzfAJeB7UmXNTRvoQ0jwvPVogQyy
- TLSH T1EBD21A01BBE89325D6FF2B3628F1415402B3FA976532DB4E0C89B09B5C237855963BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Unix
Minor OS version
0
Major OS version
4
Entry point
33762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
J:\CEX\Finix Obfuscator V2\Confuser.CLI\obj\Release\Confuser.CLI.pdb
mscoree
_CorExeMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/Renamer/Confuser.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 145bfb825a224bd09d3eeb2f5bbebbda0b0a627ac35e6bc5adfef9537d46210c
- MD5 924c09ad9f409b6fd5068c5f62e9be9f
- SHA1 eec8ade5b4d4b6a5109f25d40d017dc93e397497
- SHA512 a8d91f61dc9f42af4091ccd2f3b6ad2f605ddccbd1f0c44640fb2e04a4ba38dbbc01f448e9e69c527d7bcbd642cc9417ccfee680816a37b93db29ccb4b2d0aab
- SSDEEP 3072:lA3MWa01NyoZOM5WyEdTqaCJ0b4AK3wQBjWlWz1A3fC:23T31NyooM53ENqaCJnAj
- TLSH T155044B152BEC8727DAAF57B8F474150447F2E523A5BAE78D9CC874EB1903380D6213A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Unix
Minor OS version
0
Major OS version
4
Entry point
180826
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
J:\CEX\Finix Obfuscator V2\Confuser.Core\obj\Release\Confuser.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
169KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/Renamer/Confuser.Renamer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 57625b7f136b683cbc343040935581f774d2a0fecda85da942603ab1285ca0b6
- MD5 ae45442bffbe39f3f894d49dc6ab3078
- SHA1 b773697582ec45bd2d1c18f3ae039bc5edbb8627
- SHA512 0f8125d38b9f9189c6d0eeff65d3e0b8a942a2ee14a9b300727fddc096b6ba4af3ddd17290f4394f1b18eb8efaa155abf198713e395b3f513570f8f74129c13e
- SSDEEP 3072:xmSRusEZl96tsxFIYuU8WO/nAP5PRjNHL46fHxgsthSv3Vok7MYZfzvFG///D:R4bzym5JhovNj
- TLSH T1D454BA1027EC336CDBF75A3DB06A896007657D27F460C38C9766A0CE8951B61DAE3A73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Unix
Minor OS version
0
Major OS version
4
Entry point
311030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
J:\CEX\Finix Obfuscator V2\Confuser.Renamer\obj\Release\Confuser.Renamer.pdb
mscoree
_CorDllMain
Name
.text
Size
296KB
Virtual Size
295KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/Renamer/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2562089caafba02fffe74207ea2fb2ba049c58852f3ac4749dc820950c1f6798
- MD5 d5192b93e33685e3099fa23689eb5e9d
- SHA1 65d5098014c676822a5d0ce134df2c9737694414
- SHA512 ee991cac25c7af7e0cc3c8344d6c541d5b4f10917464ea01a92da91cff3e7b7d139d95ae12c9820fb3bfceb6f44539d0c0849a9e594c96d473574b1bb9ef96bc
- SSDEEP 12288://K+yTp9LVy4lDpv1wsMUheWG7Bo3ygNnbzRf9juASpOSIRL4uV3N/ynYD9LUmeN:/JqpXFSsT47BontpSp6jV3NLe4+v7f
- TLSH T18A254B1237FC5B27C09E4736A03108298BF1FE59B797EB4F5650A6A66C837649C203B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Unix
Minor OS version
0
Major OS version
4
Entry point
995650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Xull\Desktop\Finix Obfuscator\dnlib\src\obj\Release\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
964KB
Virtual Size
964KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/XVM.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 257be95dd0695cc93d2b617d97edf92c023a275123677a7f868b916959f6c681
- MD5 5023cc358b95e6593584093107abb8ba
- SHA1 586fac78b46dff9733a10f75e83c0886318be970
- SHA512 0357421dff4752e40453abcbb533fa9ba7757a3adb0a232f64a5f35d3736431ee70a6867dbd1896fd82bc2a3781cd2f4bff340a14b3039018b02b9ec09a6095e
- SSDEEP 12288:lpSSCjS4Wv06Z2hmphRu66dJCVI7O5sfSNgQH7+Ng6MARWch8k:lpL4WJZempW4VI7O5sfSNg2
- TLSH T1EDB4C501A7F81639F7FF8B79687A59180AF7FEC26A81D65D1950908E0C72B40CDA6373
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Unix
Minor OS version
0
Major OS version
4
Entry point
512978
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\pc\Desktop\XerinFullSRCByCode2Reverse\XVM.Core\obj\Release\XVM.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
493KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/XVM.Runtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a3c7e097d5806c6e9cdce2418c5949b45d53dd09ec3da443a171b9e56a41b63d
- MD5 306d6da1071615e4d3bdc756d0e1e0ec
- SHA1 bc03252514b97d6dfbe16d77ba0fe4e1461467fe
- SHA512 5c3d5f2fd226f4bc1b67210287c90bddb7fd45e5a39961fe5db8df6605832d245d65fe4b3b5908927decfc44428e237c9e269228f04c1ead7b91f3d80683e0f2
- SSDEEP 1536:yrM2qz6GWIL+W6UWnSWeyWBIWstoWHoWXIWb+ZK7x/5uLpo9tkxV+XCTGNgYPvdX:gM2qOooT0DqffDRl5Co9tki2sDndh/Y0
- TLSH T15573527C4E274E60C4ED8978DC675E0CA7F48F2598CED7B69980F0E55643AA2D132E83
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Unix
Minor OS version
0
Major OS version
4
Entry point
81986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\pc\Desktop\XerinFullSRCByCode2Reverse\XVM.Runtime\obj\Release\XVM.Runtime.pdb
mscoree
_CorDllMain
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/Xerin.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ddea908da6421e5cd5d56c45e9e297f4982ac8571970ba5c9e901a3ae1e3c06
- MD5 3bd157760c0b4fe65cd09a253b6b6776
- SHA1 ff8381a21e9f1df300841a546d8cac757747aa2a
- SHA512 86e43669bc00c4118799c61c2e84fa75770e1918333b414d1a16283c66def2ccb53eb2e8299ccb71f1375ce4e13dce195c84cb1c191224ba05534766142fca2f
- SSDEEP 3072:xzo3vCTjNoa3NCkfdAJS2uoB/yGjAGtweJogcxglhL1EuR:2fCTj23/cGtwkixOE
- TLSH T11BE34B2923DC8F16C7BF567AF0B4140992F0D127E697F78A6CD960FA1D033426B621A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
152546
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\pc\Desktop\XerinFullSRCByCode2Reverse\Xerin.Core\obj\Release\Xerin.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/Xerin.Protections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5a1a9f8ebcba57b53d872ef8f83d4b353fdf4e74a36a6b094a3689d9b05d289d
- MD5 71aa971af308eccc853ac8231f2a3e66
- SHA1 cf2aa7f68d8f69d5e252ba6e4afe4e4a742f93d0
- SHA512 92910d68d1e19aaff7a563f158afb21b2c21f5cb7b34c8f20361b27a34b71acc730f6945cdd8e5c555c66c2ef3290665e1698a9634636a9080b7d099e919dfdb
- SSDEEP 1536:5vyqGcp9RTiEpf2haMSqMhL/dBHTRya2W9gv5eMOB2fabkHoPxZrl/m/yeJbO:5vyqGcp9ROEp+haxqMxlaa2W9idOBDb1
- TLSH T171A33A24ABA5CF56C7FF09BAB068458646F1D31BDA03E78A4CC565D60E137908BC12EF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\pc\Desktop\XerinFullSRCByCode2Reverse\Xerin.Protections\obj\Release\Xerin.Protections.pdb
mscoree
_CorDllMain
Name
.text
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/Xerin.Runtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1d552c42bc1078e2d3fd35fde974a12dbd8c54d96c64948c1d79e11922f6ebe4
- MD5 4423cb3f265cdbbf8d9eb85885d50c22
- SHA1 8cad4986d34e83357b8bf8977a6b61826fae0aa2
- SHA512 57af6bbda6851b04cd248c53fcb12c9f9281e20e6c348602f859c80dbdf7586351f0ff33447c3f06132bc913b5eeea5d079ad1a1c4d8c6732422e096067f3713
- SSDEEP 768:/pp6PF3KOipNnYwrly0EQMW/VoCbBy9DcyFHj4XfLZ7/B:G1KHpNYF0QcDbBWRHj4jZ7J
- TLSH T1FB034A0637EC5505F2BEFBB4DDF595100572F4639932EA1F1C81A0DDAA72B848B207B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45006
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\pc\Desktop\XerinFullSRCByCode2Reverse\Xerin.Runtime\obj\Release\Xerin.Runtime.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/XerinFuscator G3.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f930a61e23d3bd80996fddaed7ff3ea686a0990d384e45530042a057ea0640be
- MD5 7a98e8a163e6067f093f88345d0bdb1c
- SHA1 ce508f15c0583414499eeea964046a2241f397d1
- SHA512 43c1f725af4a78ed38f7b174d45dc3b1774b298558272aa86028a480f6be85227ebc98b94d3ce65fcc3f2173320c38f812a2dd208f290e32f7e5631f3f6458d4
- SSDEEP 24576:Kjf4mOln2TIcjwsgi7o5uAU/r7o5uAU/onw7o5uAU/:KjQ752TIcjwsgOERUfERUQnkERU
- TLSH T1FCC5B77B291CC89EE7344977C4DA9F09DA247CE0281B84C2EBE435D97EF2A9C5C4126D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2132942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
519KB
Virtual Size
518KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Xerin/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bdb84aa16678189510def7c589851f6ea15e60ff977ea4c7c8c156504e6ac0ff
- MD5 3d913aab7b1c514502c6a232e37d470e
- SHA1 28ac2d1519ec5ea58b81fe40777645acc043b349
- SHA512 311e8f73c52dd65cbaf9f6e008b3231090ea99edf3471bac63cca4156a37a0d874ac590b19c01b15e05345bb6a5b636a11698bbd4e88c59c138dd3f358800027
- SSDEEP 24576:2gW20arTgWkk7z2B3Kqwf11Ot9Awr89Iv7f+NGGL:XC3o4swrY
- TLSH T105456C1177EC9BB7E0EE4737E8320A5807F2D5066693EB4F5610ABA96C833589D013B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1182782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ