nixda-temp-v3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nixda-temp-v3.exe
Size 3.8MB
Sample260822-ag2ccazare
SHA256 4e6e2166ae0c58788e53dad42d0c5ac38bf702fa596219636ab435489dad7210
MD5 3c5dcdb943f53d7bc8c54f2c306af99b
SHA1 27752cbe50c8abd0f874e4887348ed5c6b80fe09
SHA512 fd6d7d883e785f1b2d32b96274f68fc4f8fae7c6b56be24f2bde99edba813d33a6f90272bd8bfd657909732d47feef6d156a7745c30aa06938cec9aba9989ee3
SSDEEP 49152:GBPzeweKASR5Q3c6x8ET5daZ5LUbuOeY5Rw8PgX:Vpd53Ym5daZdjObRw8PS
TLSH
T140069C40A3144052C4A2367DD16E7B145B69B2FFB0D6DAC3319DBB09D897B8EC3287E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

costura packer

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/guna.ui2.dll	ConfuserEx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
nixda-temp-v3.exe
unpack001/costura.dll

Untrusted Codesign Signers 3 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/guna.ui.dll
unpack001/guna.ui2.dll
unpack001/siticone.ui.dll

File Explorer

nixda-temp-v3.exe

.exe 3.8MB
costura.dll

.dll 5KB
costura.pdb

7KB
guna.ui.dll

.dll 1.1MB
guna.ui2.dll

.dll 3.8MB
siticone.ui.dll

.dll 1.3MB

nixda-temp-v3.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4e6e2166ae0c58788e53dad42d0c5ac38bf702fa596219636ab435489dad7210
MD5 3c5dcdb943f53d7bc8c54f2c306af99b
SHA1 27752cbe50c8abd0f874e4887348ed5c6b80fe09
SHA512 fd6d7d883e785f1b2d32b96274f68fc4f8fae7c6b56be24f2bde99edba813d33a6f90272bd8bfd657909732d47feef6d156a7745c30aa06938cec9aba9989ee3
SSDEEP 49152:GBPzeweKASR5Q3c6x8ET5daZ5LUbuOeY5Rw8PgX:Vpd53Ym5daZdjObRw8PS
TLSH
T140069C40A3144052C4A2367DD16E7B145B69B2FFB0D6DAC3319DBB09D897B8EC3287E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3942286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\sxxw\Desktop\nixda-temp-v3-main\nixda-temp-v3\obj\Release\nixda-temp-v3.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

guna.ui.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 576d2de2c9ef5bc1ea9bdd73ae8f408004260037c3b72227eed27e995166276d
MD5 8673eae95d67e5eb19f0eca3111408e8
SHA1 ad3e1ce93782537ffd3cd9e0bb9d30ae22d40ddb
SHA512 65c4eadf448a643f45fa9a0d91497bb25af404c41a3a32686d9e99ba4f4e50783d73f5b13d5df505cc62c465be300746d84a2eaa8000531893cd0b19d6436239
SSDEEP 24576:hUsmpWNSUFmCqJPNsTuJDYYviEcHy1t6Y:hSUQWSF8q
TLSH
T199356CD173E4C9C3E0A947BA501641DC0FB5C109BF47B35782A8A29C3E467A79E3E993
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3f:f5:b3:24:9f:84:88:19:f3:b5:45:4a:64:72:1b:3d:3f:77:2d:b4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Mar 23, 2020

CN=Sobatdata Software

Minor OS version

Major OS version

Entry point

1136746

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Guna.UI\Guna.UI\bin\Release\build\.net 4.0\Guna.UI.pdb

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5613682635617cd43720807448f69b10090932e8571a358b92361d2a2c7a4597
MD5 846a7e5993282e220b26b82e7a39a40a
SHA1 e37fe15d2fb33753c042e16d1d008d412e7d99e7
SHA512 fcf608391d7f8406bb538aca0e9dafb804cceda6c590dcd98d684645bc3bfc0c1d43455a74854988b4b30e56a68ef8be886e92e993f1504b49f0e4baa1c0cc0b
SSDEEP 24576:d1N5YmLfrTboUFM1dFqgWy/KKu7wG0Q/vtDyaBhTDs1l+zTdE+LHQ/jz4AN3KC:dLDoUFmagPKKu7wG0QHBTal+fa+PAv
TLSH
T16A066C023B919517C56EFF77A463001C87B1FA11EABBE74E3585F2AC2B9B3645842363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

53:fe:48:3a:4e:3f:2b:3b:e3:71:7e:2b:07:d1:02:37:21:e1:7a:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Sep 9, 2022

CN=Sobatdata Software

Minor OS version

Major OS version

Entry point

4001278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Guna.UI2.pdb

siticone.ui.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 27c56a28cbde094157206da1bfcd7a395111ab97b8a5ff600b11c2175dcefb26
MD5 750c58af2e56b6addecffcf152520ab8
SHA1 14995e7f1d12498606d9d209d78d55fe6fd87802
SHA512 2179790e23f61b3dfea828457f8609279c70b1e071cddc73b1dbda02caa664e0aae2553fc24a4956f9e89c477d66b1a704bde26fa23bc6db26c19e18db00abb5
SSDEEP 24576:QVMCtIZJntOFmMlMqPilaiS4Yr6ugPngPfjv9tLF2cH8gb:u8NlaVeuHFb
TLSH
T1B755074433E09AABE406E77EA0A303657774E1087B56F31745B4927CBED372B4D09A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Siticone Technology

Chains

Mar 24, 2020

CN=Siticone Technology

Minor OS version

Major OS version

Entry point

1344742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdb

nixda-temp-v3.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

guna.ui.dll

PE Signature issue

mscoree

dotnet

guna.ui2.dll

PE Signature issue

mscoree

dotnet

siticone.ui.dll

PE Signature issue

mscoree

dotnet