synapse-launcher[.]zip

General

Target
synapse-launcher.zip
Size 958KB
Sample260827-cjcswayepf
SHA256 87833cd00c74069e9ac05623f5d8d5e9bc122d1cf6727e75a6c91d5c7fa87d89
MD5 0c0819aefd2b4f835bb5e6ecba74ceeb
SHA1 926146cb42adcb80945862f795a4d6e4182a3d5e
SHA512 db23ef0801bca5c113619a53872f8113b6a474f33c252f5ee805b734422ad2952a06d889f20c6cb7d9adfd2a8fee6f246eba5d7fbf03ef571123b40b22f1ff69
SSDEEP 24576:qZlsry7tLeSZJx3xkTfFRucBif0pwlrnk2OBI7Ev89:qZlrVZHxkTdMcBif02hO5u
TLSH
T1ED25338587B32422D98FB85453110898075B5FA889E97137010BE1876FF6FD7AA22FF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

costura packer

Malware Config

Signatures

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
static1/unpack001/Synapse Launcher.exe	ConfuserEx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
static1/unpack001/Synapse Launcher.exe	costura

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Synapse Launcher.exe

File Explorer

synapse-launcher.zip

.zip 958KB
README.txt

862B
Synapse Launcher.exe

.exe 1.1MB

synapse-launcher.zip

SHA256 87833cd00c74069e9ac05623f5d8d5e9bc122d1cf6727e75a6c91d5c7fa87d89
MD5 0c0819aefd2b4f835bb5e6ecba74ceeb
SHA1 926146cb42adcb80945862f795a4d6e4182a3d5e
SHA512 db23ef0801bca5c113619a53872f8113b6a474f33c252f5ee805b734422ad2952a06d889f20c6cb7d9adfd2a8fee6f246eba5d7fbf03ef571123b40b22f1ff69
SSDEEP 24576:qZlsry7tLeSZJx3xkTfFRucBif0pwlrnk2OBI7Ev89:qZlrVZHxkTdMcBif02hO5u
TLSH
T1ED25338587B32422D98FB85453110898075B5FA889E97137010BE1876FF6FD7AA22FF7
MD5 SHA1 SHA512 SSDEEP TLSH

Synapse Launcher.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 453ca434580c037530743d0ae1f92279bfc14a2553fff955a812077f3c7a5f76
MD5 c77b045610b04dad8369be0f4e518e2a
SHA1 259a0275bc82f0562d6a79d2a1a41c5855e38688
SHA512 90b54597053986e82ea8fe7b43c099b938d07886101823c3650507317ff42e2fc4999583e457453aa6507c833be98d539c714f7e40fa13e52615d1bf008f6d05
SSDEEP 24576:+7qjAvXL+wZ/x3Zk1fjt8KtEPapwbr1auuBDWDfsvh3:87pZRZk1LSKtEPaWzuFWDfsvh
TLSH
T1F135E098351170AEC9D3D472EF574E54AB936666431A52335323EEADFBBD4828F030B2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ConfuserEx .NET packer

Detects ConfuserEx .NET packer.
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1163274

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

synapse-launcher.zip

README.txt

Synapse Launcher.exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

synapse-launcher.zip

README.txt

Synapse Launcher.exe

mscoree

dotnet