df025008bab8a9d1b780276526007d60abaafb894af2cca82bc633c715945ec5
- SHA256 df025008bab8a9d1b780276526007d60abaafb894af2cca82bc633c715945ec5
General
- Target df025008bab8a9d1b780276526007d60abaafb894af2cca82bc633c715945ec5
- Size 86.0MB
- Sample260820-p4k17sdd98
- SHA256 df025008bab8a9d1b780276526007d60abaafb894af2cca82bc633c715945ec5
- MD5 19fb4e894c62e324b0bedc2187241c47
- SHA1 83b5fc153e31399c85f61a204e87984bbe47e1f3
- SHA512 952e1024da2cb0b199dff8e7e1f72e98e41e74b932f824fd0ab100c77fb5650d5a77f240cb2046d882b1a94e5260345a066c25271c9a7a6ab324f703e7526c61
- SSDEEP 1572864:YmQw0iXhAVnIioVFORvozU3KeQ4kuH2eFcwgGsj1u0Pkk6rC6LAOl:YmQ8X4+nORu6JQQHlqwvis0YC6LZl
- TLSH T1291833F1A1825EC7051752E3E20A6A6F419B48EB3FE197190590F64BEB4FAF7ED12310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
aali13212.ddns.net:1177
Mutex
-
6f3851bd96f8b2182bdbb36e94744d6e
Attributes
-
reg_key
6f3851bd96f8b2182bdbb36e94744d6e
-
splitter
|'|'|
Signatures
- Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/4674413749185f93771a9b693b1b24ac.exe family_asyncrat -
resource yara_rule static1/unpack001/43e3cf7f28351d5c551164a74a93d356.exe dcrat static1/unpack001/43e3cf7f28351d5c551164a74a93d356.exe family_dcrat_v2 static1/unpack001/442867883ccfe230ba518cbc7ccc1faa.exe dcrat static1/unpack001/4454ceb4919130c9dd9ac71aefa53879.exe dcrat static1/unpack001/4454ceb4919130c9dd9ac71aefa53879.exe family_dcrat_v2 static1/unpack001/4455bb88d29981861dadef760040858a341c74e4bb39a4ae4007b4522f354382.exe dcrat static1/unpack001/454e6ce92c1c3a8c55164afd9b2d4f08.exe dcrat static1/unpack001/4593a7dd1764819476f64896c0a97c66.exe dcrat static1/unpack001/4593a7dd1764819476f64896c0a97c66.exe family_dcrat_v2 static1/unpack001/473d46818e847042357c66d6dca16717a415fa7c712501cd02d3a8d4930a9d09.exe dcrat - Codesign digest Mismatch 6 IoCs
File was altered after it was signed.
resource unpack001/450bef50c0fe86686e7577c80502e567.exe unpack001/4584c4b37cf8f6bce11abaea1304ff8a1bcff5882a13458068ceb51ee992411e.exe unpack001/45852690b252ca710426eed9c12f242a.exe unpack001/464c221c2537591a1414bc07075716544abd3fdbfa559494ce6250d069f455cc.exe unpack001/4762e1c048c8e7250bc3b6eaf30fc915bd338a0ffc8d45ea8139c383b49cb8b9.exe unpack001/476c20f3fe853f7bad320f0edb3b7ff6.exe - ConfuserEx .NET packer 3 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/441b1668aa7980a3ec40cf151cea5f5d.exe ConfuserEx static1/unpack001/4581583c2f034e772d9704377ab4f333859492605d8bf3bcefe8e20d4dd4d86c.exe ConfuserEx static1/unpack001/4653c726a7fdd8443fcd08fe65dc9914.exe ConfuserEx - Unsigned PE 26 IoCs
Checks for missing Authenticode signature.
resource unpack001/43e3cf7f28351d5c551164a74a93d356.exe unpack001/441b1668aa7980a3ec40cf151cea5f5d.exe unpack001/442867883ccfe230ba518cbc7ccc1faa.exe unpack001/444561befcef7bad6bb899304fb31524.exe unpack001/4454ceb4919130c9dd9ac71aefa53879.exe unpack001/4455bb88d29981861dadef760040858a341c74e4bb39a4ae4007b4522f354382.exe unpack001/4478036b24730075b2da4b9c1a601533.exe unpack001/44936a5622329c67528012ecd4ad27c4.exe unpack001/44a74f61eef0e7cea8bf142172ed4228.exe unpack001/4502536cf49aa03ba4a7b695d7eaef2e.exe unpack001/45031250d699e08b14558e0a13a75d94.exe unpack001/45031a9738ccab5f9cf3a399c5ac0374.exe unpack001/453d8a70001855e0de88f95920eecd22.exe unpack001/454e6ce92c1c3a8c55164afd9b2d4f08.exe unpack001/45707ca513bf23cac8fe8c8f84507bcaee2fa236ec7a887c678b978bc560454f.exe unpack001/4581583c2f034e772d9704377ab4f333859492605d8bf3bcefe8e20d4dd4d86c.exe unpack001/4593a7dd1764819476f64896c0a97c66.exe unpack001/45be306e0f454b946091c3c0742655878a7eb69a1c7675c9a677438f4e684c34.exe unpack001/460450473f12847e281e5af300a74fe7c184cca52d375aba36b4669ebc3607a2.exe unpack001/4653c726a7fdd8443fcd08fe65dc9914.exe unpack001/4674413749185f93771a9b693b1b24ac.exe unpack001/46ac20c12dbd837fa7883bc94aa3157557cd0effb0e60f6b2dadbc5726d6776a.exe unpack001/470554ef6149b8a1cdf85b56d3f27176.exe unpack001/473d46818e847042357c66d6dca16717a415fa7c712501cd02d3a8d4930a9d09.exe unpack001/47431747aa96f7c0a653db2925aa2f68b869a1f0d75f65e4aeb72ea2f97d3f3a.exe unpack001/4761739fee40bd2773ef1da516ca636c.exe
File Explorer
-
df025008bab8a9d1b780276526007d60abaafb894af2cca82bc633c715945ec5.zip 86.0MB
-
43e3cf7f28351d5c551164a74a93d356.exe.exe 885KB
-
441b1668aa7980a3ec40cf151cea5f5d.exe.exe 1.9MB
-
442867883ccfe230ba518cbc7ccc1faa.exe.exe 1.6MB
-
444561befcef7bad6bb899304fb31524.exe.exe 5.6MB
-
4454ceb4919130c9dd9ac71aefa53879.exe.exe 885KB
-
4455bb88d29981861dadef760040858a341c74e4bb39a4ae4007b4522f354382.exe.exe 2.0MB
-
4478036b24730075b2da4b9c1a601533.exe.exe 272KB
-
44936a5622329c67528012ecd4ad27c4.exe.exe 1.1MB
-
44a74f61eef0e7cea8bf142172ed4228.exe.exe 23KB
-
4502536cf49aa03ba4a7b695d7eaef2e.exe.exe 78KB
-
45031250d699e08b14558e0a13a75d94.exe.exe 16.1MB
-
45031a9738ccab5f9cf3a399c5ac0374.exe.exe 2.1MB
-
450bef50c0fe86686e7577c80502e567.exe.exe 657KB
-
453d8a70001855e0de88f95920eecd22.exe.exe 3.7MB
-
454e6ce92c1c3a8c55164afd9b2d4f08.exe.exe 1.6MB
-
45707ca513bf23cac8fe8c8f84507bcaee2fa236ec7a887c678b978bc560454f.exe.exe 28.9MB
-
4581583c2f034e772d9704377ab4f333859492605d8bf3bcefe8e20d4dd4d86c.exe.exe 1.9MB
-
4584c4b37cf8f6bce11abaea1304ff8a1bcff5882a13458068ceb51ee992411e.exe.exe 538KB
-
45852690b252ca710426eed9c12f242a.exe.exe 771KB
-
4593a7dd1764819476f64896c0a97c66.exe.exe 885KB
-
45be306e0f454b946091c3c0742655878a7eb69a1c7675c9a677438f4e684c34.exe.exe 641KB
-
460450473f12847e281e5af300a74fe7c184cca52d375aba36b4669ebc3607a2.exe.exe 99KB
-
464c221c2537591a1414bc07075716544abd3fdbfa559494ce6250d069f455cc.exe.exe 873KB
-
4653c726a7fdd8443fcd08fe65dc9914.exe.exe 1.6MB
-
4674413749185f93771a9b693b1b24ac.exe.exe 55KB
-
46ac20c12dbd837fa7883bc94aa3157557cd0effb0e60f6b2dadbc5726d6776a.exe.exe 3.8MB
-
470554ef6149b8a1cdf85b56d3f27176.exe.exe 18.4MB
-
473d46818e847042357c66d6dca16717a415fa7c712501cd02d3a8d4930a9d09.exe.exe 827KB
-
47431747aa96f7c0a653db2925aa2f68b869a1f0d75f65e4aeb72ea2f97d3f3a.exe.exe 382KB
-
4761739fee40bd2773ef1da516ca636c.exe.exe 418KB
-
4762e1c048c8e7250bc3b6eaf30fc915bd338a0ffc8d45ea8139c383b49cb8b9.exe.exe 1.7MB
-
476c20f3fe853f7bad320f0edb3b7ff6.exe.exe 769KB
43e3cf7f28351d5c551164a74a93d356.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ed6e748881b649402434d33ab8831f87d239ef339b7909620877678b09c0e6eb
- MD5 43e3cf7f28351d5c551164a74a93d356
- SHA1 9437db06357fce38247b3f3ef0f67185b3f5a9f0
- SHA512 c5651323110e6af4400664baab5238b5b5ab55835737b64d2e0cb971694023e8bce2307d26dcbfc7b7a2a2a53b4bb3c157f55156ba095795d081fe19208516cc
- SSDEEP 12288:8lNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:8lNCv6XJ5BClaXfD9vUha+u
- TLSH T10A1575342EEA102AF173AF7D9AE07596DA6EB6A33707995D00B103C60723B42DDD153E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
912286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
883KB
Virtual Size
882KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
441b1668aa7980a3ec40cf151cea5f5d.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8fff8f0b312deb03f0f95f4df36073a6b5da22b83d571151c7b5d0ee4837c06a
- MD5 441b1668aa7980a3ec40cf151cea5f5d
- SHA1 c38963f651a4a062fb712e9fbe7cb39cb9b4b0f5
- SHA512 299c3014e97c402f59d8878ed67e406ada3b277c3d43a1c4e698c825e27631c8acf3987459f588d3e02d7a7d7b4f0e656b641a56d11ba1bfca2e813a1e9fa817
- SSDEEP 24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD
- TLSH T1DA95CF79BB0B9733DAE87775C4FF5C4C92A01363AA9287096C4998E40F8539B8B05F47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
442867883ccfe230ba518cbc7ccc1faa.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e73b6a783715ee86d06a645c158eb006e14b7eaed35c23d2b83afa9377fb7be1
- MD5 442867883ccfe230ba518cbc7ccc1faa
- SHA1 395dc86a807f4675c172bc5e4177aca9cb948cf7
- SHA512 507d50d70abbc07b9f46d5567da998850bae6423c8a77ac7369347bb238a14c96788f9149654dda34eb3d0f5f710df8d369e3d00b52024ead4bf87a4fc9d12b3
- SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
- TLSH T15C759D027E448E12F01D1633C2EF454847B0A9516AE6E36B7DBA376E59123A73E1C9CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
444561befcef7bad6bb899304fb31524.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 945a6d17823852e7f5442b87d6282cc480ba90aa4892a0f8ed20eefaec0a0739
- MD5 444561befcef7bad6bb899304fb31524
- SHA1 152d9d0b64d30dbcafed5bf728e576e384b9fd81
- SHA512 37e07aa564a9b21a4e8d6299d2d359684512757a23a78b1c33669e755d3c29f8b8d9775efd0e872a03dafd7b7d28edf21c4ae2f8270f0d32f3ebfbb1c46c220c
- SSDEEP 98304:F3h6d68gwIteZNiiPwVpL/fh6ImzzJoDfuBcMv+A73XA2:FR668aaELPHh6ImzD+F2
- TLSH T1DB46AE51FEDB95F5EA035A3045A7A37F6330A6098335CBC3CA405FA6E957AD20A33217
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1704746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
VuDH.pdb
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4454ceb4919130c9dd9ac71aefa53879.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b7c8e0d773962b93371cd3a7f5617d0ced09ed117b3082fdabe319954cc2c59d
- MD5 4454ceb4919130c9dd9ac71aefa53879
- SHA1 718ee7efda5afef9a41513902c33a767d3eba95c
- SHA512 7a7a4f2bca12d9a518d8e5dbee655a4a210c13eb44edd1d93597bd6a010a4fe9ede1c0ef6d9baca14f411ca27524ccdee486758cfb36bc67727b9c42ecca7cd1
- SSDEEP 12288:clNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:clNCv6XJ5BClaXfD9vUha+u
- TLSH T1001575342EEA102AF173AF7D9AE07596DA6EB6A33707995D00B103C60723B42DDD153E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
912286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
883KB
Virtual Size
882KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4455bb88d29981861dadef760040858a341c74e4bb39a4ae4007b4522f354382.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4455bb88d29981861dadef760040858a341c74e4bb39a4ae4007b4522f354382
- MD5 fb06d061e7ff1dabba7a22f8346d1669
- SHA1 7373b076fa51511e844efc5363c205b2161bc808
- SHA512 687448c2c719297bd6b65c5d8710567c357f9dc4c0f261b7099180e3fdcf28f595f04bc1c238c09dc8819b42532f26541c305a39c63313a364e9c044c257ec90
- SSDEEP 49152:brYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:bdxVJC9UqRzsu+8N
- TLSH T1B5A5BF017E44CE11F0091637C2EF494847B9A9516AA6E32FBDBA37AE15523E77C0C9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2105326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
964B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4478036b24730075b2da4b9c1a601533.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d233b1e7a55864b83d22ab61d24b66a4d68fe503efe6b568bd058833f146f3f9
- MD5 4478036b24730075b2da4b9c1a601533
- SHA1 34dfa5ee56ed334f2ad46e2dfdc024498d27dc56
- SHA512 ae887bfc70049ffc72fb250e50f5f1ea6825ce4765c1174a073e804fb1b21fd4032d30e28ff52e49dc61e070aa98ef393646f8824a10f6946eb40566c6cdd7ef
- SSDEEP 3072:WdvzDqxs8ORikgogWfiuRXd3YmSffdTKXNXANewGBvskX1pWA/s8sdT3:WFzDqa86hV6uRRqX1evPlwAEd7
- TLSH T10B547138F88C552EC679D5F0A9F447C6FE582C6B3550A9CD6BA63388483364B68CDE1C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
169742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
158KB
Virtual Size
157KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
44936a5622329c67528012ecd4ad27c4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 9f749c1460165ddda4f8f035219b995054ded815675fcda8a2355b7683101506
- MD5 44936a5622329c67528012ecd4ad27c4
- SHA1 85d931f92ca4aacd7958ddc87d5a3d91ae82816a
- SHA512 28a33009baa9836f7c29fe01259f49331ac0eb0e43a1c7ae0a1aa4e1a9c0c59f1f83c6fc1b2e3b08b79ad527f46769d48a4e43b21fdfea6b5f4a61ee336babf6
- SSDEEP 24576:MR+DqKevReoudkvQyPOe5qejfR4H0B33lIx:MiqK4udkvQyPZ5qejfjB31
- TLSH T169351207BA56D5A2CA41677EE8CB050133A4E1A1B713F72A30CA13BFF94777E490126B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1155342
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
44a74f61eef0e7cea8bf142172ed4228.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 71bd4842dc10d1b104046e06e2fd9d7dd0ee8b6ac6ec4b47e8db3a60a82d85a2
- MD5 44a74f61eef0e7cea8bf142172ed4228
- SHA1 9d116e6efa4a3510c28d9d46726786af8f65a2c3
- SHA512 1bd97dca228848e9dd705e36072c42f846706f058260a637d625b248fd83f49c1f644d0ef319ce39685046e26ad1ca126e50bfc19987041eb0330e2be238eb9c
- SSDEEP 384:5+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZjiI:Om+71d5XRpcnu4
- TLSH T137B22A4E3FA98856C5BC177486A6965003B0A1470413EE2FCDC564DBAFB3AD92D4CAF8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29838
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
576B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4502536cf49aa03ba4a7b695d7eaef2e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7057a204b5f0886da9c758a11bc7587df6cd50cf6b1f47587d05aef2f3411027
- MD5 4502536cf49aa03ba4a7b695d7eaef2e
- SHA1 5496f9936d988aef528f785ae7c3d3d4a1cd3e25
- SHA512 31be44ed80cb071345024ccafc841db6df4bdf8e0e1e3c9f041740d7209164bd7c6cd7325c0eab0bd812159fb8989da445e9ceaed43cadea5809b6205f60a784
- SSDEEP 1536:HRWtHF3638dy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtR79/cd1Up:HRWtHFq3Ln7N041QqhgR79/F
- TLSH T1F873CF05AF410D08E7F80B3205DC76DA067FFB4EE67053CA5D1E69A82B37B9095E0768
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
45031250d699e08b14558e0a13a75d94.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 da9de4402f6983b7c93b6f30084b115e98f1c7603828922ff37cf6af9cccb9f9
- MD5 45031250d699e08b14558e0a13a75d94
- SHA1 f52f77522198079fef50d275d7b465b08741245f
- SHA512 0b8e97999ffaf0b676b81dd0aeda0ec9a48f8dc982f7f3e380c91711ed30615e1d7502dfc9f8cef95efde5e979ef57feb76ae232f0ffe3419d8e2a0f133ea946
- SSDEEP 393216:PGg4aXGg4amGg4aiGg4aiGg4aCGg4aOGg4aCGg4a6Gg4aKGg4aGGg4ayGg4a74:PH0QQwMwYoUg74
- TLSH T1CB07238073F40A67C53B56F5DA21519607F67A663C65E3DE0C80308EAFDAF619A81B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1377598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
14.8MB
Virtual Size
14.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
45031a9738ccab5f9cf3a399c5ac0374.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8c56eb191159283133ef2e71898f39e75b14decb237ca5f98911ca1394dcb44d
- MD5 45031a9738ccab5f9cf3a399c5ac0374
- SHA1 933ac6f5a5316b47ae8e9e808022058db565d8fa
- SHA512 b3ca645819df6325e985063799e505a1837cf56585a27ddf599ce397cd50ab28f926c4af9270da8b5fc8038188d28c4342ecaf78f1ab09f3fcb84f2614e58000
- SSDEEP 49152:b/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4Cf:
- TLSH T1A2A5542428EF104EF773AAAD9BD4B9EE895EF773261A20B9207107064713D42DDD2B35
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2137886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
450bef50c0fe86686e7577c80502e567.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 311d7ba7581d7e8f887a64c9d5c9712e5560544aef7e7a2315f706133104f26e
- MD5 450bef50c0fe86686e7577c80502e567
- SHA1 ef2c159f3e8ffe43c69bbed077ac3ce7455548d1
- SHA512 ad883cf2b59a217aea50e1aadc36631ca55428a12e5715c2475acb2d840655974eeafff3c06ea4bec359cfa1ab729ef0d1673ab79cee30be3de2373c4e269be4
- SSDEEP 6144:D+8j7qF9OdSGTMNEGNvfO+994bqOc+UznPg7aIFKn9g5uS:D+8j7e9O0GA2wXO+99ucqL
- TLSH T17DE4503E1E44CECCEAE1C9FF4507C1368BAAA4AF1399448845633EF7C9965F4C869706
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
be:be:4c:1b:16:67:8e:95:66:6c:a9:c6:15:c6:92:26:96:b9:84:6b:3c:0a:a9:4f:00:80:1e:1b:f0:c5:41:e0
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=Acrobat 11,O=Adobe Systems\, Incorporated,POSTALCODE=95110,STREET=345 Park Ave,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Nov 1, 2017
SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=Acrobat 11,O=Adobe Systems\, Incorporated,POSTALCODE=95110,STREET=345 Park Ave,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=Acrobat 11,O=Adobe Systems\, Incorporated,POSTALCODE=95110,STREET=345 Park Ave,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
01:a8:4e:7f:9f:e4:8d:a3:eb:eb:e2:24:7f:f4:cc:27
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 15, 2017 - Mar 20, 2019
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 2, 2017 - Apr 1, 2028
Minor OS version
0
Major OS version
4
Entry point
384958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
368KB
Virtual Size
367KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
281KB
Virtual Size
280KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
453d8a70001855e0de88f95920eecd22.exe
- SHA256 099ac5c59d32074a1883ef3f4e17796c1244b20f6ca311446062f493f80c8997
- MD5 453d8a70001855e0de88f95920eecd22
- SHA1 01aeba5a239a5bec4a1028343d48692a5f75794b
- SHA512 e7b601043fdc65eb4667865fc55928ef0eb4e5693eb6cb1e1203a9351a44d18209ce652afb2ed86e0806a28d53bdbcc0f7687897b678600362d3d3460d73fe9a
- SSDEEP 98304:WdLdnDeAr4fRH/o+2y90A+KyuqvkmNBNMWEUVH:Wdcq4ZfoltAiHvRmWZ
- TLSH T1B10633E0DE217616FF5B45B5BAD5CE1B0384EECC9E1DBF218228DB55862F908DDAC081
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
454e6ce92c1c3a8c55164afd9b2d4f08.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f2931e5d0ed208b3ff25ea01cb1b3c2f9e03990b9e5ac912a6abce922aa16501
- MD5 454e6ce92c1c3a8c55164afd9b2d4f08
- SHA1 fe300937097e5e84fe9b9ee61292a8aa4462cec2
- SHA512 91f631962f40a284638509a4c5087327b39fc1f65d3eb2e69369a611f0dffc0e60ba69aaa2061682a2ed979e42cad2b3c8c95483031f492acfce13b31662483a
- SSDEEP 24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE
- TLSH T1FB759D027E448E12F01D1633C2EF454847B0A9516AE6E36B7DBA376E59123A73E1C9CF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1676270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
45707ca513bf23cac8fe8c8f84507bcaee2fa236ec7a887c678b978bc560454f.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 45707ca513bf23cac8fe8c8f84507bcaee2fa236ec7a887c678b978bc560454f
- MD5 f326cb6f424adc400a0dfbb365d7050e
- SHA1 2bf5995d4f6d67b278422bc0f8e7d53e0c1da1c8
- SHA512 f5fc0fae93a86d332d41d04aba72f0cc4d7649b1aeab2f6e3decd7a298d48c525e7b9a7b03b80e799e575e11fcd1dfc3e67d1dee94231531c9cd4710c4649e8a
- SSDEEP 786432:4XuCHGJTk6G76kgFVM9MKbb6vpJ3ckMeD+Ud:5ZPkWM1/6xJMv0Pd
- TLSH T1D767129365040593F2657AFAD2F78637A3641DA16F028A0D917CF5C86AF3047EE83E6C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1709934
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
363KB
Virtual Size
363KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4581583c2f034e772d9704377ab4f333859492605d8bf3bcefe8e20d4dd4d86c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4581583c2f034e772d9704377ab4f333859492605d8bf3bcefe8e20d4dd4d86c
- MD5 056ac51e4bd99a43093a69d7da6a944a
- SHA1 844150a63e87238ca5bda01240b4e224fc64bdce
- SHA512 7a25671c18664814b27db8f23f9b143fb599622d7f03adaf4897107f4b916d054f144f8152c36f14a55063b9c72a4ee1c69b9e8feadbe9f9cb05ac8283502806
- SSDEEP 24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD
- TLSH T11195CF79BB0B9733DAE87775C4FF5C4C92A01363AA9287096C4998E40F8539B8B05F47
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1990558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4584c4b37cf8f6bce11abaea1304ff8a1bcff5882a13458068ceb51ee992411e.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4584c4b37cf8f6bce11abaea1304ff8a1bcff5882a13458068ceb51ee992411e
- MD5 f9f57d44b3743f05e0280f6bcda48d18
- SHA1 1381363eeb124f97f7744df8c844c027a423fd7e
- SHA512 4807b3af311037f46deacf26b80e9cf5ee380c82462cd403e65c1cfc429c9e678aa9e2c44bedc23baf6d6c5432a94630a5e0dc110d7d0cac6957a0773a23c4b0
- SSDEEP 12288:/MTxlloFeH0hsYNVOyUgOzU1dEcVZC8lSBuxmcRdLagkFJGvb6bkR:/MblUX+dI1eaZMQxm4+avr
- TLSH T13FC402161529E907C4870FB42990D1B963FA8FCEB511C763ABEAFCAF74EA7112250353
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
77:34:d0:09:75:35:a0:22:2d:aa:30:a0:ad:f5:83:41:58:c2:35:f9:1f:83:db:b6:c7:d6:6d:ce:f6:97:a7:c3
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
Chains
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
PE Signature issue
Digest
60:b4:6d:ed:5a:6d:7f:03:e8:c5:ea:f8:d0:33:62:6e:bd:cc:f8:8c
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
Chains
Mar 16, 2019
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 19, 2010 - Jan 18, 2038
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB
Serial Number
7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 13, 2018 - Nov 8, 2021
Subject
CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
540682
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
JBKC.pdb
mscoree
_CorExeMain
Name
.text
Size
521KB
Virtual Size
520KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
45852690b252ca710426eed9c12f242a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 02118b9b833ae13d27247b748a8268cc78198f28503787cfc1fc570e6640e093
- MD5 45852690b252ca710426eed9c12f242a
- SHA1 56141f3a38d515c85fafcc859c63b733fe3e65b9
- SHA512 79a9f12edc3677a2dd0407b085234a296f62f75b852a38a36be66cdee5f48f105f6070dc5608ac6b119d46a29b2495761c79869448cb4628e939a538afdd7e4f
- SSDEEP 6144:TtT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rcnKH6:16u7+487IFjvelQypyfy7cnKH6
- TLSH T163F48E85EA2CA942D98B5D707BBCDB837D398FE30E905726509AF4981BB33E4B71441C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
f7:43:6e:12:d5:31:56:c4:b3:11:90:c0:ac:29:e1:1d:71:ce:9a:99
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 4, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7BF1-E3EA-B808,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:19:a8:1d:78:2e:73:69:b2:09:00:00:00:00:01:19
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 24, 2018 - Jan 10, 2020
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4593a7dd1764819476f64896c0a97c66.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2fe8d140ff8c709c4b95466b3f455bc49fe32e1ed59d13e92881f4fa4441dd7e
- MD5 4593a7dd1764819476f64896c0a97c66
- SHA1 9cb477fa5a2045f44cd4fbf6b285332a220a0b78
- SHA512 7460b8581237dfce993dea97b81c0a7768da5076e09b0627675afc3cb91bc1fc88f66f955f7c065b1fbad296d9bba55fb856ea45d913b9d253f7f7a07d0d9600
- SSDEEP 12288:0lNE5VnZuh+ZIlXJBH5SP2I/lwvDT77/wOKsV42i3GULVaHeopyyx:0lNCv6XJ5BClaXfD9vUha+u
- TLSH T1AB1575342EEA102AF173AF7D9AE07596DA6EB6A33707995D00B103C60723B42DDD153E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
912286
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
883KB
Virtual Size
882KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
908B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
45be306e0f454b946091c3c0742655878a7eb69a1c7675c9a677438f4e684c34.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 45be306e0f454b946091c3c0742655878a7eb69a1c7675c9a677438f4e684c34
- MD5 be28798fb13ebd61d94d6712436dc399
- SHA1 186c13dd590594a63e81b24205d1520a2e03b2cc
- SHA512 473273021ba324077ae022c8bb10e457d78ce1bfeef95045287915fd15bf1e23cf5a2db42d67c4bb93aba4babb9a8cc71e906ed305f6ad223cf5d1e4534b86a1
- SSDEEP 12288:XV/iTQhh6j6tvCI8DbWHK2k7Wyv1Gp4Nt9DcxGY:l/TcaCIlHK/WegKSG
- TLSH T10ED42378CBB8D65AD8158A3E3BA166C0E130353172B1B78D678A58DA23376FC734D8D4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
661646
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
638KB
Virtual Size
638KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
460450473f12847e281e5af300a74fe7c184cca52d375aba36b4669ebc3607a2.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 460450473f12847e281e5af300a74fe7c184cca52d375aba36b4669ebc3607a2
- MD5 386b9a58bb569af2dccc21c1da4e847e
- SHA1 6797eda382c708b190c892be2a37bfec2d7c0c50
- SHA512 7543be1107e17e55df86bd9e4a1f91fd0da0dd4bf04c891a81a83b0f9c7255d770861fd0a58b157657661d7053cf11b53b392cdad39f34f74419ffd74a87b1e4
- SSDEEP 1536:MJrkVvD4vE8lukQZ5Zqa125S8w74pzTFCWI5fFCHnen7Fumas0nhSDfS7Fah:EqDRh8pzJCWysen7FX0hSDfS7Fah
- TLSH T16FA3D517BB8AC6A1CA115B7FFD9A450013A8E282F657C71F384A372E4C477BB9841B17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
464c221c2537591a1414bc07075716544abd3fdbfa559494ce6250d069f455cc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 464c221c2537591a1414bc07075716544abd3fdbfa559494ce6250d069f455cc
- MD5 afea0f6ec93979ae6b73ed55aa6019e6
- SHA1 c9fb589b585c43ebf889fcf148a353092fe2afb7
- SHA512 2da72df5d86f3c03bdd720939b661d78ad41dec9a947c8812568aabbbb013ac558e23c160c1adfb85e3398fa6450004d81405af8237dbaafdb196e2f827ab30b
- SSDEEP 6144:CtT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rT7V:e6u7+487IFjvelQypyfy7T7V
- TLSH T1C1157C81DA7CA542D98B5D707BACDA837D3DCFD30E905726509AF4A81AB33E4BB1481C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
68:2a:61:e5:88:81:2c:a9:90:b2:d3:f8:86:0e:71:17:d5:d1:65:98
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 8, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:be:a4:0f:f5:c9:a5:0e:e1:30:00:00:00:00:00:be
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4653c726a7fdd8443fcd08fe65dc9914.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 059b8ebff6ab682bf5c96d025e60d38e957eadae16b90f04707d9aff96ef648a
- MD5 4653c726a7fdd8443fcd08fe65dc9914
- SHA1 1e2c3c74736b99b64712db622602f6187a9005b0
- SHA512 a97f0c8c2358f767a86a680aae3ecc922b5d8aeccd33e2a8618e4ec6ddb3cd23d6946e7c5bb53b640e4db5f018195423b667b19e20c173df19938e4ce430d7f2
- SSDEEP 49152:gI667fYgIiD/snVM2khZOhK19qquDvQeoVWmXOBVEaQ:gI60fYriD8V3UZOhCXeoV7OY7
- TLSH T133753371EBCCE81AE84BA032D915B5371820FB862F66D29D3D747B466DAD7E921230C4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1708078
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4674413749185f93771a9b693b1b24ac.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 67def2c9d29b6b3fa51af8cebb87c47c01264f0a482ce4bcc10fb5dc4d486231
- MD5 4674413749185f93771a9b693b1b24ac
- SHA1 f5c6c9bd6a6853a02b78fb92a7e768314680dbc7
- SHA512 f4b02df142fbaf0baddaac2e5d08fbbb25b3d1885668b5d38fa17b688cebc98183c18e54be4491de7155ab7da5650201227f11a8a1c41671ea7492f9cfc840d3
- SSDEEP 768:piiB3aEEOzcf8XTPGUi1h3ASrLp8zZht+jbugrdB1DDEjUx5PtnaAhg9WShF+:p9BqwbicZrybRJbIUx5PAAh6WKF+
- TLSH T1C8431B1037E8C127E27E4F7599E1B1618A79F6632603E58D2C9012CB5B23BC2DA535FE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
55054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
46ac20c12dbd837fa7883bc94aa3157557cd0effb0e60f6b2dadbc5726d6776a.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 46ac20c12dbd837fa7883bc94aa3157557cd0effb0e60f6b2dadbc5726d6776a
- MD5 94bbad70347b2dbd7bf509f1324a657a
- SHA1 dcd04de0e1fab61e9aba10c83c35ac9f9d66bff0
- SHA512 4d3be5814f0d80ff71cac1ff626ed8ced50442dc1927ba39b9c78d5ce4c247ffe35d1907350d3c21436054beffbaae4c982e4339d87228ab56eb7d2193d13c64
- SSDEEP 98304:zZGGzcPAQbGrJVM1nCPx7O2AMh1n5j4bQgk/Pm:z3EGr/MR4O1MHnXgk/e
- TLSH T1D7063359BA43C6D2C38384B272B5EFF60A83EFA949F81202C76176FE3D77554A253490
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3933902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.7MB
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
470554ef6149b8a1cdf85b56d3f27176.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ab74776ae3aacde9299f19ea13e76f9158567f9d053de9b1bc39515fced521ff
- MD5 470554ef6149b8a1cdf85b56d3f27176
- SHA1 35e2a3ffc11e509bc2041ca073fcc9f052249f5f
- SHA512 ca7704304ece52f7aa078c8da5a401dd2823ebde8d1841ff799056ccce874e7f1f546512313466981bdc911637610c40bf081d9da6435b0b115de74affb38c35
- SSDEEP 393216:8YGbY6iHonlQCe88BYdY3SHFPJXFODKSbk63qPpYWsEv:87Y2CCe4dAmFOmS73qWWdv
- TLSH T1B51733E836C80F98C32E5F3B8056310C7FBDB0954EE2E71D5918A6FAC99A33AD09551D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
247630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
234KB
Virtual Size
233KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
473d46818e847042357c66d6dca16717a415fa7c712501cd02d3a8d4930a9d09.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 473d46818e847042357c66d6dca16717a415fa7c712501cd02d3a8d4930a9d09
- MD5 c148994b6f887dfaeb705dbab3b44b06
- SHA1 2a853651529a0350de04ace25bef147b60781df9
- SHA512 9fc2f1a0d1dbe0fe2a5e49d064dde6123ba6d376170ff1fd4907840ac7038596ddb48eddf645acc6ec665ba034079fce19288afb34024421bde6e46bb45f23f3
- SSDEEP 12288:O6wOrQ831HP4YbCPHMUpKrtisw4c+Wb0FI6HuaowaRw9/:O6w231xoHRpKrtintD6HuaowaRg/
- TLSH T17B05F8117E84CE91F0191673C2EF421887B499517AE6E71BBDAA337E55123A33C0E9CB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
840574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
813KB
Virtual Size
812KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
47431747aa96f7c0a653db2925aa2f68b869a1f0d75f65e4aeb72ea2f97d3f3a.exe
- SHA256 47431747aa96f7c0a653db2925aa2f68b869a1f0d75f65e4aeb72ea2f97d3f3a
- MD5 8961f6badd6b1c470364b2b7233423b5
- SHA1 1e14608324251b7d707e7ab03ba6b9228f1b92b3
- SHA512 e46f6ee702382fc7c4e457b83f7eff3f8a992871f518917f7c031b24c68979c1b00cf66ffda906a5895bd905957b9a18fdc9c102c17deb7e2ce3c09e65063cb1
- SSDEEP 6144:bpyTWOfFId0GscTyzZl37mGzEF3xlwtUKpWFon+ANFfgeTpz0kv2AYSJ0GDkLTta:kNRmgIzwtlWCn+CJ3b0Oi
- TLSH T17884C769625E18D2FA16713544D26BCBC13BA90A7762E3DFB44702452CFDF8170AB38E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\vilg4\Desktop\SHOTYXX X CHEATER\SHOTYXX X CHEATER\obj\Release\SHOTYXX X CHEATER.pdb
Name
.text
Size
380KB
Virtual Size
380KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
4761739fee40bd2773ef1da516ca636c.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4282c58f6128041a424fa7cf327a6bf36b7d967836c21a2d87feb558c1f2e38d
- MD5 4761739fee40bd2773ef1da516ca636c
- SHA1 86ecc1fcbcd6885f56c324571c1985acc9d1a92d
- SHA512 a96c87434f0defa0f3bff3d421beee91f0b51f0c0104c01036f002a8f0ebf8df6f1dbde0a063ecc9585f944ca0f551a928c2044fd795ad119fed4fc7cc282c1e
- SSDEEP 6144:ITNE3ZRrnaBVlvphVxmP+6CiejgcME1cwYfU+va+RUwbl:ITNYrnE3bm/CiejewY5vXl
- TLSH T1D694F670A0F26AC9F896CEB28E60E609FFE70D419A51861FE17439F65133B85C2451FE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
251246
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
237KB
Virtual Size
237KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
1024B
Virtual Size
516B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
168KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
4762e1c048c8e7250bc3b6eaf30fc915bd338a0ffc8d45ea8139c383b49cb8b9.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4762e1c048c8e7250bc3b6eaf30fc915bd338a0ffc8d45ea8139c383b49cb8b9
- MD5 2c864d486d29ae270b0f3c04c07178f2
- SHA1 87487fceb8c267a474a73a88e473081e524ca6b7
- SHA512 cedba3c5c67ace0ef46553eaefba19c106265730a96eede2d2905e0d47864c726c8276f28ee566f96120630815d93fa5cb8a0db69b7b9ec56b7189c51f8aad53
- SSDEEP 24576:lD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjoIQ:lp7E+QrFUBgq2dQ
- TLSH T1B0855BC6CA7CA543DD875D7067A8DA837C3DCFD30D50562650AAF4E81AB33E4AB1882D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
a1:b4:b6:a3:2c:d3:f9:e4:c0:36:84:dc:5d:83:de:af:d5:8f:2a:62
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Feb 27, 2014
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 27, 2013 - Jun 27, 2014
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 24, 2013 - Apr 24, 2014
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
722670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
698KB
Virtual Size
697KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
476c20f3fe853f7bad320f0edb3b7ff6.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a3d0326f5ed11c46933a53e935e63d3a952c1561e124ecd0ae79adc9dd9afa8d
- MD5 476c20f3fe853f7bad320f0edb3b7ff6
- SHA1 10e1a56a6918a13722db2d61bca4112ee7464a65
- SHA512 404e668cb26ea2284af5379ff91c58df0592aaa979a5860d3e5cca7499cfde746e71571b97b4889f778551f3509cd6a522667d7280944b375feda0826243ee5e
- SSDEEP 6144:1tT/Yq3v9Auky+4dusAIFB++velibxPyp/64wjOjn6cB3rTJz:n6u7+487IFjvelQypyfy7TJz
- TLSH T1DCF48E81DA6CA942D88B5D707BBCDB837D398FE30E905726509AF4991BB33E4B71481C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
e0:c6:43:4f:e7:85:24:f3:5a:2c:fa:ba:46:e9:12:94:dc:d6:97:c4
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 4, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:7BF1-E3EA-B808,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:19:a8:1d:78:2e:73:69:b2:09:00:00:00:00:01:19
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 24, 2018 - Jan 10, 2020
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 12, 2018 - Jul 26, 2019
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Minor OS version
0
Major OS version
4
Entry point
438782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
421KB
Virtual Size
420KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ