XWorm V3.0.rar
- SHA256 7f7c2ed7a2fd6163a6004386287033bcaca83d7332fd592e4291c8a89252ea5a
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
XWorm V3.0.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
XWorm V3.0.rar
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
XWorm V3.0.rar
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
XWorm V3.0.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target XWorm V3.0.rar
- Size 23.9MB
- Sample260831-nfd3bas1ew
- SHA256 7f7c2ed7a2fd6163a6004386287033bcaca83d7332fd592e4291c8a89252ea5a
- MD5 f38e858f5ee1fd28cff7d67aa5bcd91c
- SHA1 0cd4d698e0d96892f2840edc3edb84327cc25d22
- SHA512 7c8556b361d4f69601892317d0a070e0d374f1b6d554f7e1ed7bb669b5eccdb55e2665d5460998909b7cece4c660b9f75231080b312ce9c753880122765874b7
- SSDEEP 393216:edY1Ze39n+LWKFa0zoSVV8f2aG2aIKKBfg9LXbBBn4QCV1jyjDVkOQ08T:edY63wfamVV8fpGNIKKBfUTbBBeVByfI
- TLSH T1144733C6B2A853980C56B8ECFBC3C5D9CF442BA2045D7138A621C5927D6DB80F7E5F89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/XWorm V3.0/Plugins/Options.dll disable_win_def - .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule static1/unpack001/XWorm V3.0/XWorm V3.0.exe net_reactor - Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack002/system.data.sqlite.dll - Unsigned PE 37 IoCs
Checks for missing Authenticode signature.
resource unpack001/XWorm V3.0/FastColoredTextBox.dll unpack001/XWorm V3.0/GMap.NET.Core.dll unpack001/XWorm V3.0/GMap.NET.WindowsForms.dll unpack001/XWorm V3.0/IconExtractor.dll unpack001/XWorm V3.0/Plugins/ActiveWindows.dll unpack001/XWorm V3.0/Plugins/All-In-One.dll unpack001/XWorm V3.0/Plugins/Chat.dll unpack001/XWorm V3.0/Plugins/Clipboard.dll unpack001/XWorm V3.0/Plugins/FileManager.dll unpack001/XWorm V3.0/Plugins/FileSeacher.dll unpack001/XWorm V3.0/Plugins/HRDP.dll unpack001/XWorm V3.0/Plugins/HVNC.dll unpack001/XWorm V3.0/Plugins/Informations.dll unpack001/XWorm V3.0/Plugins/Keylogger.dll unpack001/XWorm V3.0/Plugins/Maps.dll unpack001/XWorm V3.0/Plugins/Microphone.dll unpack001/XWorm V3.0/Plugins/Ngrok-Disk.dll unpack001/XWorm V3.0/Plugins/Options.dll unpack001/XWorm V3.0/Plugins/Pastime.dll unpack001/XWorm V3.0/Plugins/Performance.dll unpack001/XWorm V3.0/Plugins/ProcessManager.dll unpack001/XWorm V3.0/Plugins/Programs.dll unpack001/XWorm V3.0/Plugins/Ransomware.dll unpack001/XWorm V3.0/Plugins/Recovery.dll unpack001/XWorm V3.0/Plugins/Regedit.dll unpack001/XWorm V3.0/Plugins/RemoteDesktop.dll unpack001/XWorm V3.0/Plugins/ReverseProxy.dll unpack001/XWorm V3.0/Plugins/RunPE.dll unpack001/XWorm V3.0/Plugins/Shell.dll unpack001/XWorm V3.0/Plugins/StartupManager.dll unpack001/XWorm V3.0/Plugins/TCPConnections.dll unpack001/XWorm V3.0/Plugins/UACBypass.dll unpack001/XWorm V3.0/Plugins/VB.NET Compiler.dll unpack001/XWorm V3.0/Plugins/WSound.dll unpack001/XWorm V3.0/Plugins/WebCam.dll unpack001/XWorm V3.0/SimpleObfuscator.dll unpack001/XWorm V3.0/XWorm V3.0.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack002/newtonsoft.json.dll
File Explorer
-
XWorm V3.0.rar.rar 23.9MB
-
XWorm V3.0/Background.png.png 17KB
-
XWorm V3.0/FastColoredTextBox.dll.dll 333KB
-
XWorm V3.0/Fixer.bat122B
-
XWorm V3.0/GMap.NET.Core.dll.dll 2.9MB
-
XWorm V3.0/GMap.NET.WindowsForms.dll.dll 147KB
-
XWorm V3.0/GeoIP.dat1.2MB
-
XWorm V3.0/IconExtractor.dll.dll 10KB
-
XWorm V3.0/Icons/icon (1).ico97KB
-
XWorm V3.0/Icons/icon (10).ico115KB
-
XWorm V3.0/Icons/icon (11).ico9KB
-
XWorm V3.0/Icons/icon (12).ico9KB
-
XWorm V3.0/Icons/icon (13).ico361KB
-
XWorm V3.0/Icons/icon (14).ico361KB
-
XWorm V3.0/Icons/icon (15).ico361KB
-
XWorm V3.0/Icons/icon (16).ico97KB
-
XWorm V3.0/Icons/icon (17).ico66KB
-
XWorm V3.0/Icons/icon (2).ico112KB
-
XWorm V3.0/Icons/icon (3).ico131KB
-
XWorm V3.0/Icons/icon (4).ico125KB
-
XWorm V3.0/Icons/icon (5).ico100KB
-
XWorm V3.0/Icons/icon (6).ico106KB
-
XWorm V3.0/Icons/icon (7).ico164KB
-
XWorm V3.0/Icons/icon (8).ico108KB
-
XWorm V3.0/Icons/icon (9).ico264KB
-
XWorm V3.0/Intro.wav319KB
-
XWorm V3.0/NAudio.dll.dll 502KB
-
XWorm V3.0/Plugins/ActiveWindows.dll.dll 14KB
-
XWorm V3.0/Plugins/All-In-One.dll.dll 4.8MB
-
XWorm V3.0/Plugins/Chat.dll.dll 18KB
-
XWorm V3.0/Plugins/Clipboard.dll.dll 14KB
-
XWorm V3.0/Plugins/FileManager.dll.dll 27KB
-
XWorm V3.0/Plugins/FileSeacher.dll.dll 478KB
-
XWorm V3.0/Plugins/HRDP.dll.dll 1.7MB
-
XWorm V3.0/Plugins/HVNC.dll.dll 57KB
-
XWorm V3.0/Plugins/Informations.dll.dll 22KB
-
XWorm V3.0/Plugins/Keylogger.dll.dll 17KB
-
XWorm V3.0/Plugins/Maps.dll.dll 15KB
-
XWorm V3.0/Plugins/Microphone.dll.dll 540KB
-
XWorm V3.0/Plugins/Ngrok-Disk.dll.dll 7.0MB
-
XWorm V3.0/Plugins/Options.dll.dll 29KB
-
XWorm V3.0/Plugins/Pastime.dll.dll 17KB
-
XWorm V3.0/Plugins/Performance.dll.dll 15KB
-
XWorm V3.0/Plugins/ProcessManager.dll.dll 17KB
-
XWorm V3.0/Plugins/Programs.dll.dll 13KB
-
XWorm V3.0/Plugins/Ransomware.dll.dll 20KB
-
XWorm V3.0/Plugins/Recovery.dll.dll 496KB
-
newtonsoft.json.dll.dll 540KB
-
system.data.sqlite.dll.dll 392KB
-
XWorm V3.0/Plugins/Regedit.dll.dll 15KB
-
XWorm V3.0/Plugins/RemoteDesktop.dll.dll 17KB
-
XWorm V3.0/Plugins/ReverseProxy.dll.dll 16KB
-
XWorm V3.0/Plugins/RunPE.dll.dll 11KB
-
XWorm V3.0/Plugins/Shell.dll.dll 15KB
-
XWorm V3.0/Plugins/StartupManager.dll.dll 189KB
-
XWorm V3.0/Plugins/TCPConnections.dll.dll 16KB
-
XWorm V3.0/Plugins/UACBypass.dll.dll 12KB
-
XWorm V3.0/Plugins/VB.NET Compiler.dll.dll 15KB
-
XWorm V3.0/Plugins/WSound.dll.dll 539KB
-
XWorm V3.0/Plugins/WebCam.dll.dll 209KB
-
XWorm V3.0/SimpleObfuscator.dll.dll 1.4MB
-
XWorm V3.0/XWorm V3.0.exe.exe 7.1MB
-
XWorm V3.0/XWorm V3.0.exe.config.xml 183B
XWorm V3.0/Background.png
- SHA256 5047dc90d705a1a50c325fc00b26d5290939c42d6aa727d09e8d21d0537cec85
- MD5 a466fc11f42a6de40e050c9813947612
- SHA1 81845f1a0a98f590d97670c19d0a762123a2a539
- SHA512 59e3349a9291abe96c663e2f63345ea13c79e9a8a716a9408e74526f05642f1a8d59cc5ae866287299a4aa4a4fb8385f509de0d2dab483ffa6859a6a29c24556
- SSDEEP 192:lCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxp:s2wDZijJE+w2QIfGR
- TLSH T181827D29324091A1C0E4997F282D67A5BB87BE274744DF46B2F702FD8C13BD4D9843C9
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
346910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Fixer.bat
- SHA256 a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55
- MD5 2dabc46ce85aaff29f22cd74ec074f86
- SHA1 208ae3e48d67b94cc8be7bbfd9341d373fa8a730
- SHA512 6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3
- TLSH T10DB02B177482E290838004430271224D39FDA002C291F2C375224530CD84CF0C333795
- MD5 SHA1 SHA512 TLSH
XWorm V3.0/GMap.NET.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3002430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1016B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/GMap.NET.WindowsForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
155790
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
144KB
Virtual Size
144KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/GeoIP.dat
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/IconExtractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Icons/icon (1).ico
- SHA256 115f0db669b624d0a7782a7cfaf6e7c17282d88de3a287855dbd6fe0f8551a8f
- MD5 4f409511e9f93f175cd18187379e94cb
- SHA1 598893866d60cd3a070279cc80fda49ee8c06c9b
- SHA512 0d1f50243a3959968174aa3fd8f1a163946e9f7e743cbb2c9ef2492073f20da97949bf7d02c229096b97482ff725c08406e2e9aa72c820489535758470cf604f
- SSDEEP 1536:RBrn6a7/Zu/M615kfNOfEK3EpQkGhD94TtcmeVQU71qiLSeznFkKeUqvllR/t6c1:RBz65/M6If+3Js+3JFkKeTn1
- TLSH T1DFA39283B511D2E1E5308A33E15BE9F10F227C5EEB5A281B7684FF173873151AE2791A
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (10).ico
- SHA256 7a97547954aaad629b0563cc78bca75e3339e8408b70da2ed67fa73b4935d878
- MD5 ad1740cb3317527aa1acae6e7440311e
- SHA1 7a0f8669ed1950db65632b01c489ed4d9aba434e
- SHA512 eee7807b78d4dd27b51cee07a6567e0d022180e007e1241266f4c53f1192c389be97332fcd9f0b8fda50627b40b8cf53027872304a68a210f4d754aa0243b0c2
- SSDEEP 768:VDRRKECMsn3H2GkmPe3KUDlGEJ57ukb8rJXAtnvWrpLDvZ8EZN:tjls3WGkoe6Uso9T8r9AtnertLFN
- TLSH T1B9C31747A1281C21DBB0EE39A2DCC8BB594F5E79F1A6464C7CB5FC6864F68F1053AC06
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (11).ico
- SHA256 3b64b79e4092251ebf090164cd2c4815390f34849bbd76fb51085b6a13301b6d
- MD5 1c2cea154deedc5a39daec2f1dadf991
- SHA1 6b130d79f314fa9e4015758dea5f331bbe1e8997
- SHA512 dceebc1e6fdfe67afebaef1aff11dd23eda6fae79eb6b222de16edebdfebd8e45de896e501608254fb041824080cb41c81ac972032638407efc6bfeb930bfd00
- SSDEEP 96:hc4i1w+DSf0RxO/Csg9nL2CupMqM4pSg36IfgT9A+QdwhFKQfkIvxIm3sW88H:qa+DSf0RxOQnLjoSg3hfG5/X8cOO88H
- TLSH T122123AC826B0CF07E6591B36C8B27FB5142D4DD0DAAA262B94CCFF4471A0FF87585994
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (12).ico
- SHA256 84b48ca52dfcd7c74171cf291d2ef1247c3c7591a56b538083834d82857fee50
- MD5 4ea9ab789f5ae96766e3f64c8a4e2480
- SHA1 423cb762ce81fab3b2b4c9066fe6ea197d691770
- SHA512 f917059b6f85e4a25909a27cad38b1ef0659161c32df54860226ff3d858127d8da592ea9072ad41d5a9986dd8c04a37e9ad34e2251883a8c2f0933e6aa201414
- SSDEEP 192:8mEKEEjOjzSId77Fe0ggzSXlYtAMXa77gieRHw9S1IId:HUNdsgzS1EAEaHB8IId
- TLSH T13312C764B449D511C83A4139CC2BC9AD03250EF5C5340C1BA89AFF6736DBAC5131B56E
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (13).ico
- SHA256 2e2f17b7dd15007192e7cbbd0019355f8be58068dc5042323123724b99ae4b44
- MD5 e6fec4185b607e01a938fa405e0a6c6c
- SHA1 565e72809586e46700b74931e490e2dc1e7e3db1
- SHA512 13daeb2bf124e573590359f18a1d962157dc635a88319c9ed1a2e8ccad6322fb081579e1e8fbe62ffe55c8286c2bc8acb251d572a4beb00641ad5009a380e513
- SSDEEP 384:AyIh9xb9bexqcmOg1/JuiiiiiilllllioiiiilllliiiiiuGxbu:9Ih9Z91hJy
- TLSH T1B674056F7E12B9BAC77856BF0810B18D59586C2696DCF103791FFB2CAC3DD076A09242
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (14).ico
- SHA256 8fc693238afc49a8098dac1762bfae891e818bb84749c6eef5f1b0c6c8ffddb2
- MD5 0c24edec606abda7c6570b7dcf439298
- SHA1 4478a102892e5eb4bb1da8e9c62d17724965691a
- SHA512 f8de3ffb8f9fe1394b3626ae5616213d4612b43f0635fa9053d74ac6fe536657e796289487f245b8abff74f1de8368c0df8e56bf21f540366ed86a378649ea24
- SSDEEP 384:FY9tDXICTUj6Q+CUsn2JiAAA/////////A+AA////////AAAiA////kujYYFsG3I:+PMXT0
- TLSH T13574D45560B2F99CE512CAF714F0D5005DF2AC68AE6CA65EB9317FBE4E7708230867B0
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (15).ico
- SHA256 b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
- MD5 e3143e8c70427a56dac73a808cba0c79
- SHA1 63556c7ad9e778d5bd9092f834b5cc751e419d16
- SHA512 74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
- SSDEEP 768:0nnnnnnnnnnnnnnnnnnnnnnnQInU2/gohN/yRUZZZZZZZZZZZaaa0KaaILjeuFgZ:Rkccckccccct
- TLSH T18E74051CB53AFC87E85A9E727E42E77588BE2C135F608841F604FFBE9639505A3D8811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (16).ico
- SHA256 3f3c5ce486e5b9fa88dc60b60916053e8808c69167df1a11287fd3cd6db1ca6e
- MD5 14465d8d0f4688a4366c3bf163ba0a17
- SHA1 9f1fa68a285db742e4834f7d670cae415ce6b3b6
- SHA512 01db4fac75136baf9c162265785877b21fba9c4b8d9dbe4e495191f15aa9c914e3d5baf1c4606041279a7138c7e5c8f4ccf6e64689354fc3fb3fa66ab3b1da2d
- SSDEEP 768:5As1Fd6jrW6QKysmsolxc4nvPQIfjRuw+mqbz9j1MWLQes2aXS5Cjr:5AMwflmsolaTIrRuw+mqbz9j1MWLQs2
- TLSH T15DA3D2F1A740C465D8A796B9883BDAA7A423A24DDC6C490D3D92FF0B7D723474027C9B
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (17).ico
- SHA256 12f600b09c0db00877684a950fc14936ecc28df8f0ddc6821d68e4b82077ad92
- MD5 167425a3fa7114b1800aa903adc35b2a
- SHA1 601e8bd872ea31aff03721a0361e65a57b299cad
- SHA512 586ce1360eb06f1df8e95ad178abfae7c9d41cba1be55276b3d3947d0504ca09185e543b7dbf1ba72dde4942ff626859a6d2e8a1faaaf6c5daaebd8740dcf538
- SSDEEP 384:keGRHCUZYDikdQarfw8lGqMtxoYDQqrp0KR1QCOICdu2kkyPgE+zi/hScVsUIGVN:8fY/lVoTlR1vCU/he6H
- TLSH T10163C4D2F200C5A8FC398B75D53B4A7411137CBEDDB4A56F78887E2236B72A2402B957
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (2).ico
- SHA256 142b529799268a753f5214265c53a26a7a6f8833b31640c90a69a4ff94cee5ec
- MD5 f1463f4e1a6ef6cc6e290d46830d2da1
- SHA1 bda0d74a53c3f7aaf0da0f375d0c1b5aca2a7aaf
- SHA512 0fa93d009cc2f007d19e6fdda7ebe44c7ed77f30b49a6ef65c319133c0570ab84f2d86e8282b5069d7f2e238547722ac3966d2fa2fae4504133f0001a0387ae2
- SSDEEP 1536:WE4NpLpq8Bb7RFRz8nqF+o2Hc0cccwccyccxcccMcccNmccdccccTccccncccNJ+:j4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv2
- TLSH T186B30F6A8EEBB642C5425474797363814A3D1F78A4CE35518EF33FED5AF3CA521230A2
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (3).ico
- SHA256 b2f7fb22cd5b935cf19a2f58f7fef9db99db40772ff4bb331a73c345161c2574
- MD5 a512719efc9e6ecc5e2375abceb1669a
- SHA1 51fae98edfab7cd6b6baac6df5ecbda082eeb1db
- SHA512 e0153dbc8f3fdda8d1a7082bc30a3895d7f4b3bc2982b4b4ece55653d1b4c293eba3ba6d4a0a581f0f7db95ab287d6616ef7bf03af4485904111798bf9d9e625
- SSDEEP 1536:Ms6se7llqn17KineXd2wwKtivEYoNRh8RX9EIKhI49NT:MsgbcUieNJHKoPC5+Ld
- TLSH T1C5D36CFF29A9491FC2052D78C249F735044EFD6278C6CA03B5A57E9FF23996A1C20993
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (4).ico
- SHA256 5bb21d6c04ed64a1368dace8f44aff855860e69f235492a5dc8b642a9ea88e41
- MD5 9c053bef57c4a7b575a0726af0e26dae
- SHA1 47148d30bc9a6120a1d92617bf1f3e1ba6ca1a2c
- SHA512 482d639ba60f57827d8a343f807f4f914289c45643307efaa666b584a085fe01ac7892252f41b7756fde93d215b4f3fed16e608bc45102d320d77239fa93146a
- SSDEEP 1536:zVRUhw3TWxcZss+SP21wH7QOK/PPLr8zdYpizfgMRHGuTRLJHPxDsPsx3CXhRcVN:ZRUGKXs+S++7KFSbxeY+qDDrMY
- TLSH T1BAC32C2D5E4BB8DBE42449B558A6EBD10A6CEFA4F4E1169834E8FE3CB7D1474C500F90
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (5).ico
- SHA256 45c85bdaaf0e0c30678d8d77e2585871ea6d1298ee0d30037745bacea6338484
- MD5 9dbdd6972e129d31568661a89c81d8f9
- SHA1 747399af62062598120214cef29761c367cfd28a
- SHA512 e52572de3f0d57d24a24d65eca4ff638890ccc9c5aca3f213ff885eda3c40de115849eb64c341f557d601f566ce21f8fc0df25cc4b13aaad5e941449a6b7f87d
- SSDEEP 192:sVLDqC6ot/2AlVx1qa6mgIwEk4w00wILxuudXCnadwyHXZ:EH/6A/9d1qDIwEk4w00wsuuXdwyHJ
- TLSH T112A379CB6E1486B7CB4CF63054A7B33C032BA83D6BD38E0EE55B3E59AB3265C9945105
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (6).ico
- SHA256 6ea04cf08751a2f6bb2f0e994258a44d5183b6cdb1471a0ee285659eada045b5
- MD5 d7c9666d30936e29ce156a2e04807863
- SHA1 845e805d55156372232e0110e5dc80380e2cb1e5
- SHA512 3cfd7a41f65c5a0dc23a90c6af358179efb3ae771f50534c3d76c486fe2d432ea3128a46b4b367c4714e86e8c0862a7385bd80662fe6ea82d7048f453570ed56
- SSDEEP 768:LZe7enyslZ87gUcXmEHNBFNJC5jWb2NM2:Npysa7iAM2
- TLSH T1E1B3EEA41820C65DD5C4A776CD17B37D37882E5C14319B8A9270B8EEB23710D297EAFE
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (7).ico
- SHA256 29d38c75af79aa0554f34cdfecb311f88f8dd02b02facaa299b9700841806ab8
- MD5 7891c91d1761dc8a8846d362e6e31869
- SHA1 0229bb01b7b4a0fca305eb521ec5dfbaa53674ea
- SHA512 ed14614a706da985566853dc13df0d1128a718f39ec9957320813803fe07e59de337d51033970e2f57d9f56da3546c506f5f0f3becfa91ce741576855be14ba7
- SSDEEP 3072:Y8SKfbzxcwg7es6/Vsb8VKTu549oJMfF/H9N3Ky9NzLn+:YUhcX7elbKTua9bfF/H9d9n+
- TLSH T1A6F3BF6D2E55CD46E9854C7544B7D3BCE66C4DB32E4C8912E72C7EA41B3AE483E22323
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (8).ico
- SHA256 a65cbbdc2ca671a9edd7edac0c6737b3b116e357727e003e5fdeff163c6c21ab
- MD5 af1739a9b1a1bf72e7072ad9551c6eea
- SHA1 8da0a34c3a8040c4b7c67d7143c853c71b3d208d
- SHA512 eeeac307371c38b75e256083c55a3fe4ab096c1c7520a4b7acb40fad3af5a0d6c88aaf85f2c3e418034abee422c2a3ba13731adf7ee6078016da4dd2e989b120
- SSDEEP 768:ygjWAisCkoAbhMDB8dfO944J+IiIxzAILEhmtkW9iVHD:yOybBYfOS4J+1oEhyiHD
- TLSH T168B3A69A1D055BF7E70CF43480F3732D637ECE3A3E961E4DE9AE7EA862708491598811
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Icons/icon (9).ico
- SHA256 bd1c33a67244801e828035904882ec53bd2ea8a1db9265a06d1aa08cf444ca80
- MD5 3e24e40b41ecc59750c9231d8f8da40b
- SHA1 91a701cf25aea2984f75846b6c83865d668ccad6
- SHA512 fe62edddb62dd4b695f1ef40ffb7a0119d480d1c176f0254acee19a45d6433ef6c308acbe567c721018390626c71f7a0f7bcd195d59d54c19cf019f13c4f7572
- SSDEEP 3072:HAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZZvZZZ+:H+GIIIIIIIhIIIIIIIIIIIIIIIUP
- TLSH T13344EE606A050EBCEFE0BA78EBDD536513A52E91017B54CF13D03F8A3537E53BA9A052
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/Intro.wav
- SHA256 4c0e42c48b2d0944023ec9b45dfb88029d92bce5a4f30aa8064e6400bd9488d2
- MD5 232b04fb1abe851a5cbcf6dac970674f
- SHA1 d687afa6507432ae377516e5f14d754f3cc8dc7b
- SHA512 7ec75d4e764af2962da3226df5e6e117c02e90049b5d0df25551adcbcb3cc430f85325d8f41dd87793795ef049c3c66f5669e3170e6cf3eb6952aa2446c90515
- SSDEEP 3072:Be6ThNq+L2/U+oH92ljKmTfG4OTntP8oGtBT4vx87+tyu5m04Q2NNl6bmT2WtjKH:LNKsPCG4OTntPgt14fUHtNp2n
- TLSH T1C0643D93B201D901D8081E7A4C63EBE95732BD69FF1E531731847B5E6E732C28E94AE1
- MD5 SHA1 SHA512 SSDEEP TLSH
XWorm V3.0/NAudio.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Chains
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
Serial Number
37:37:aa:de:9f:72:21:81:eb:6e:a4:00:21:65:fb:e1
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 22, 2019 - Feb 27, 2022
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
0
Major OS version
4
Entry point
510758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
493KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
952B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/ActiveWindows.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4263c50674c6ab64a9b5a1ad5e301628baa975e4c919d0c7767ec39adf4cbfe0
- MD5 d45c2a95c5670074713be9e669e4d610
- SHA1 96d26829b4ef8156eb5906f84535866f7f859203
- SHA512 e15a8fc7fa81ad1a6446db7c18494b2e4c15ab28844dbb77deadcae72064ed6bd6e08fe59604c27bd4e44ed059c1a424f322a753293d76bd574262aa31b9e3ea
- SSDEEP 384:7qIGejCUccJeGCJWM2YFegdT8Ft0Y7XZ3W6DMz:7qIGeXcWrCJ+EtYZ3W6Du
- TLSH T15B620715E3E54331C6FE1AB34C7363401B70C2099C53FB1E4EDC6096AF63A9986957AA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/All-In-One.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2987ef4a83e2c44a9abe57cdd9a4bc2b8cbaa01f6835c45cfce180b4d978982c
- MD5 f21e73b79f9aec821c976b4fbae7225c
- SHA1 7be974156ad16f23f4b91b47c380f8c3422a9863
- SHA512 476bdb0c6ac8703e467c51b90b23e45ab72a2e81652e3106732b69d9d299c277c0f9d308117cd338089d3578ebe73d12559b4300fda24d32ca7f1991827aa8df
- SSDEEP 98304:pl19F9QORkChiDC9OtH7c2iwGxIvPBOw0JefVfQ2a5cFd4KssODtd:J9FPRkC8C9OH7c2ilInz0kfVo26Wsd
- TLSH T10F3623187FE18717F9EF97F1D5A2420A9BF4E053B356E79F5E9484E9388230089222D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5042578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.8MB
Virtual Size
4.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 eef8fb30e32b48e1480a6131de34436c0a8efafcf807856fcebd618661b7a6c6
- MD5 c1a27e18603cdd587ae47e0e4b71c5f1
- SHA1 9a8a3b938c0e4c79687750dbbd459ff3879c4c2f
- SHA512 53467107f6f0443854879d61135d73e04e387f9cc5e6ccd277732d582095eea9268d5ad6be1a8502421109ba77d86bb20d42efbe67b97d309b4c6c215b6575b9
- SSDEEP 384:KeUeLD8aDbXCtSeEd3uq7uQZRHUrwTKvt0GIKoIkfiUWGfZ:MkbCtSeE5uq7uQYr0HIkfiX6
- TLSH T173823A2DA391C3F2C6FD2BF64C72928107B1D221DE03FF2A9ECC946A9DA37854644785
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Clipboard.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5a70530748decb0c81fb9c912fd3d75d7d493fd67675bb7dbfe141c3fda15587
- MD5 b23bb3be1718e1aeefc3e822119692f9
- SHA1 d4dabddf9b9d3f0b2adb86a3799f1cf9ec614d48
- SHA512 d66697d97146148978aa5f46cc14232230e553842601cc0e3b0eaaf86f21e91f907153dc710405df7d1dc32d8120134886b29ec164738cef0fa7a827a2ae90a1
- SSDEEP 192:KkAXyVpJlyIxlioHESRJ29u+6ZWSYASO3tOXXgNTen1i9iY6IW1mX/60/qAqEM7R:KkXVpuoHpMDfAR98STe1oi2X/6kMrwU
- TLSH T16A524B59B3D44339C6EE1AB21C3392800774D715AC13FF2E2CD8A0B15DA76D58762BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f13aa0515a65a4701269a57183884846417688d1476c7252291ac5bf7149746b
- MD5 d2c7a574a9b9df92366a981761d494ba
- SHA1 d7d6c4674eac54102e61331fc116ac5abebf42ee
- SHA512 a876da49f048fffb0dc522d4f7471b1c1076fda327d7ad0282162b749375dc13797300f51ccb0b5d2327d6b6f6e0f75f3204a83a4a384108f1e34b7a179b0ce0
- SSDEEP 384:tp4K215dISbc/TY0mN1PGDQXSBJVYol/tF37enOAkxqb8cq/hsutzgk/b7oBxkSE:h21vWk0yPGsXAr7dtRKPb8V3emjC0b
- TLSH T1A9C22BAE3BD08211C5FE89B2597294080730EA039823FF5E7DC4359E9E33AD64E107E9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
34042
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/FileSeacher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 557a215cec1a3df37da8a6798354e79a3a70f548f7955cfa43a2d75e1d037053
- MD5 21e5acae055bddd2ad584271d77f881e
- SHA1 df3b8db334e5bce0597cea77a4770fad8d7db6fb
- SHA512 52896aabc03595320370a1318749e899b451020f74cedc511b6daa618908bcaa4aee7d0b808a4df6721e2c1a4f93e2f84cea00179f0c7149dccbe6f155eb3dab
- SSDEEP 6144:OPv5T5fIIC8W8XqeGtSV41QJDsTDDh0Yhe6dwxLV/vuhgS0mOdwcG:0nfIICLlS4Ys50ie6CfigSji
- TLSH T146A48D406BE8C657F1BF27B6C4F262A0C7B0E465A52EDB8F5D4024EE2D17340E9117AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
495966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
476KB
Virtual Size
476KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/HRDP.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d4b0d5cc5f09f26183aa34468b78b083ddd895802a41273583f45202a9a618e
- MD5 e8130166c9f0919f0c94f989898a26b2
- SHA1 3611474d473bad7474f8bea8e3277652d72cd3b4
- SHA512 a444b8945dec63fa64452408cb0f3f95d5b60330b74f927df7e16feedad08862d164381a137bf2a14c42af5fe9eaa6813c2f8d1d44fcbe570eec3b7cecf12a8d
- SSDEEP 24576:UrKxoVT2iXc+IZ++6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKumYr7:RHZ5pdqYH8ia6GcKuR7
- TLSH T19F851918F6D8423ED857D2359A7153B2D7FAB9482F20738A2928075A7F2B3D02B3575C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1790578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/HVNC.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a17d1922ada241def8a14f9ac7a7789bf2b5dd4cc9045ed08f28546982c233d
- MD5 cb5c8cd73ed161125e46bb455fe468b5
- SHA1 2f5852f549262e0a5ee8e385c336e3d9860e3441
- SHA512 e6f26e61e8c75fa18d7b6e8800b07104f1314cd312d85b3d3d0db7f8d482bc4582a7237643d24308e0b7ccb5d779b666be6216b3364e6d0d7ee9aeeaa40394bd
- SSDEEP 1536:uth/ecTkz12BWR7mmt+0d7tzGxh23tnc2/:2h/ejz12BWR78M7tCxh2hz/
- TLSH T124434B9577E98A31E2FE0F7A8873971083B1E1575913EB0E17C5A0656FA33868510FE3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23238
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
55KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Informations.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0452d60d658a43929bf2d5bc049e2c57c2d61f58b6444bab88834c870305dfdf
- MD5 92ba1499b2547f0e38e26360f94101af
- SHA1 71b9ac23eca1c0f50517631cffe59ec1950147b3
- SHA512 1106d4386cda5fe98736138e0e6a01fb2e234700a9e5ed61e2b6a59cdfc82cf82dc2486488944ad009ad34fb3a04b9894bd52fea52968741350b09c7975d4d9c
- SSDEEP 384:4nQf5APE80e6vkD7RQQpOJXWn3TmoNhxJNSOFD4rfZ41:4nQfGPEOD7vcJKj3NSDZQ
- TLSH T19FA21A98B7E44265D1FE2AB30872904513B6F70B9D13FA2D1EC8929E4D737C4CA54BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
28738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Keylogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c2dc7f27304ad0b1a726b5784b030207b93765a8986c4a4f3999733097a4d43e
- MD5 666290af0aade9cf9f377c5fdce9cba3
- SHA1 d981466e4838b2bac54edf53548169124bdea145
- SHA512 23ccd8c1ea776a70637dad70ccea3f435d99c7465fe99a6d4f8f726f6c320081f5d7327f654bc0f7abf0389b6b95c55809f474c52ca2e3898e99efbe454e77d9
- SSDEEP 192:tLCuLDdyxqvzfZ3ium13gyWacxv8ilNwOHLnq4UP1XPeDN6IW1Y6Up90KWi8Jlb0:EuDdYe0umJ6xfwEO4UNWD8Upt+5h6V
- TLSH T11F825D0D77D88375C5FE9AB20C3363501BB1C209A803FB6E2DDC716A5E93B854B54AA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23718
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Maps.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b1699235a5ea07dd6516230309f6d94c697d6f9db96ac664dd269aa471a56dcc
- MD5 fef310962c772bbce74c9d9dd3516803
- SHA1 bc3923626417961059688730b464a10fe4eb6115
- SHA512 389ed724fbcb298e5e302166725ceef7067d85e5d71c0a11267717584906c328686110c19ab5b275ee075e1b88b294c9a072c9d3ddef76e0759c584862622bef
- SSDEEP 192:5zW/qqmhqfohvEajSJz+5q6gn+jNq7gGte31HC9T6IW14X/bQeIY3t2vLOo2:KqqmhxvEajr53xgjteFi9BX/b3t1o2
- TLSH T160622917A7E48271DBFE0FB24C72620017B6D609CD07FB2E25DC606A5E27696CE21772
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Microphone.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b04ce7ba6ce58408b53ef7d4ef84866539727a76871cb09fef99314711aabb57
- MD5 563090381b43ef273e0dae20ada50d0d
- SHA1 acd5271cf0f959c09d940733a92fc8ee0ed434a6
- SHA512 f0f172b6591766f4e13b7df29c51674f84e80cd7c8317b305519b54f635605b96402764a04cc600024d3cca11c46b5e041692eba3ac919f8f63dd73e08ba37ec
- SSDEEP 6144:1iwpFWBbjRTvqihWI1ElZT2J2CDt4azYPfb78+OmmN8fCgN8OQ9oYCY8gQNUyFJU:QkFWBxTvTWzlZSYXbg6TS4UYTPzeVzn
- TLSH T11AC45C11BBD49627D16F33B2E0E20F2A57B1E4467326EB4F169097E89ED77424C01BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558642
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
538KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Ngrok-Disk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 390f542854416819047e474e5c34ec39e80360cc8c69728d19e8d12732e932fc
- MD5 e11f0adf9a1374112ee0b52ca41a2a9b
- SHA1 23c742a1839800b4606fdb42f2baa9151876d894
- SHA512 6acf4f3f888230aed388d31c0b2c52f6da0c1c31f4184e065511f07aee87757c6f101bbddb8d20d651b7e65d8c329fe871ffb5a4ceebb3ace928fd042a97307c
- SSDEEP 196608:NCsxED7kwTV6B/nCR7+AA3e5MryK5Rj1Bpw7Vdjz8wEO+Dl:NTED7/VEqt/A3TryARj1BpwLktl
- TLSH T1277633287BD48167FBEF67F1CD92414A0BF46017B2DAE7CE19DA48FE1D81300992169B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7368622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 035f48b413cf328ddf2bada1b6afd5698f9b8cddf2bcc0187a97629f1063c042
- MD5 90a1c5c0d1cd88b6fe390278c93c4530
- SHA1 b4bec20a1c53e8255518505709a8947dcf7e13aa
- SHA512 ade19d4160bee947a0df9b5bc0ecb4976c1e4ba848e9360b978429fd94aa39a00016107d3daefdc795e45bcb3717c9673fdc543ef544b3e11d92ecfc473c71e8
- SSDEEP 768:01fYFYWjF84UGEm3uGIKxbF/OfUs5Rd794kv:YfYFYWjUm3uabF/1s5Rd79R
- TLSH T106D20B45BBF04754F2FE0F75AEB522148A36FD06AD22EA2E09D0601D5C73AC5CA60B76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Pastime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 87baedbd864856f6fdd2ee4fb256842de326b1eea2f71a4fc1914402cdda1f07
- MD5 787f48174c04f87346bdb09f5aff1d95
- SHA1 18278dbb1102a3e0772c5661a51bef6f4965f688
- SHA512 af26853c8372529f109220722045e2a920c5cb9dea5310e1f6fe7d30a8189c54725db743e228709bcef3e20b50325fed57089b044eb18164b4affdbc388fbe12
- SSDEEP 384:KhzO/ClGe/9GGzHQl3HREpi5/mY7//AlxsA8/rHbx:kzO/CEe/9GGzHQxH+wH/xA8/rHt
- TLSH T14C822A255BE58271C2BE1EF148B3B3000379E342DE03EF1E99D87556AD73986C620BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Performance.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1f6fd6b09773fbd53c4eac5d0e77ef4e1be43872ee226983414e65141921d634
- MD5 7ed248558ba25c9fb1eb55e2f1e1dd2e
- SHA1 3f2f71f24f94861922b54f147992d6b94b85acac
- SHA512 2ffe3b5220cf6b92e1f3d2065ba96c685c1ef9ff28470afb5ad8e38b6f821514f4e69ba23caae2f46fa64d94fb8b8de061ca2c979e8c5ae32a5a2dfd046db427
- SSDEEP 384:AmdLFVZ8ERBT32czPbHmTgK62QxHS7OVpPH7EqV:rdLDbRBT32czDuCHPEu
- TLSH T17B621959E3E58239C5ED4EF20C73A2011771EB039D13FB2F49D860965F736898E64BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dc12cb5a2c0be8d6e7dd02c761022bc6b12cc6777d38eb7d529178c3d6adaecf
- MD5 96f281e2deb206e3561f0a2dc881b44c
- SHA1 a41ac27787d3e61302d8139874ef68aff89d3f97
- SHA512 9f8336ccd0ed5f6936c9f68527056da7a88e986d24ffcf19e3aca2537307b9cd9e315b55f56e7712b4e49f4442244280073eac4c7d7da7e8a10b4c8200f4ac48
- SSDEEP 384:OdftFqxTfNDgiIsCH9q/Y1aLCEYpt1pnrDhI5XkAvfw5bZLnVb:OdftIwn8TY4XkAv4L
- TLSH T176723A1EABE493B4C1EC1EB218B396400770E60A9D23FB2E1DD860276E737958B31795
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Programs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 221e1461a2c950336c0a25cb147d996578c1e9461824b750ca9a4f9d3be93cb5
- MD5 b7ae0664d55bd6b3800871baf6139aed
- SHA1 eccee8e082d9002e551efb8791d323c07ac8abaa
- SHA512 84b8d2f80ea9b1b6b4c4b952f18f9f226473a7e98205c2ca6d5bc6b5cf97ec58f0393f39fbb43bf1f1118da8c369c88b9ee6e228b7012d8953c0607e7dbadf4d
- SSDEEP 384:GjnqNd9cZMvidxD/nTu1NYTX/1bxbBvFxb:GjnqNyBFTN/1/vz
- TLSH T16C52085973E5C27AC6FE0AB21C7362401B31EB058D03FF2E16E871865DA79958760BB2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19914
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Ransomware.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1727ba841000a1c6176bc285853b54904ea69944fa2d59e8daf66872dd4c1d92
- MD5 9f2c86036e8454b2322fb37297e2b119
- SHA1 f54ff6b78099548592db00d8667ece62312e1bb0
- SHA512 a3201c1378b5c6bc1e427f6aaa1637a197ad18a5b38f705d8dc09c73d19e568c5ee8534e844eaed35e5c83da6d1b7db93c9ccbb789845a60943bb8c790a7edbd
- SSDEEP 384:AVSO27QJHvpebFn0LC9Tk7ff2ji+ZMuqI+sHY4k7E3eEHtHxh:AVm7Q1vpebF0LC9TqH2Mj7KtR
- TLSH T15392F62D67E0E171DCBF1AF354B3D2510371DD35A821F62C3ACEB0AA1FB21498295E66
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
26370
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 179dcd0bad17db8e467a40d7b57437461cdc3263090966a687bdd40b279e4df2
- MD5 3830944fe780e36b1a3c67dabae5c29e
- SHA1 afd2b6852330f86ad16103ac17a471602dc2a8e2
- SHA512 615bbb13305029ee2aa131ecb8bc397c2a3217fcc7d9a49469f90f1104726ac2c00cc534d72c90cf1cb4f2c2b720e5740089179e23d3394a519236c79cc6cd4b
- SSDEEP 12288:cMEW+SHIWnFEn6YwriYW+aiJdIyl1HXuKtMCiK:+W+iIWqnwiYWefrXuj
- TLSH T1B9B4F15827B88A64E5FF4E7EB0B0002543B1B1476A53F79E0FE488E92E71784CD15BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
514318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\PC\Desktop\XWorm V3.0\XWorm V3.0\XWorm V3.0\Dark Worm\Plugins\Recovery\Recovery\obj\Debug\Recovery.pdb
mscoree
_CorDllMain
Name
.text
Size
494KB
Virtual Size
494KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
newtonsoft.json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3eb81192a710332165eab74e7390ed4807b0aa207d774974b96d79e3ea44d085
- MD5 5649f69ab44390e78cd0afc645ace8d9
- SHA1 0ca606ad54903eec8f5ed2d10cedbe3cd45e32b7
- SHA512 7db055211902fae02c580e193d424de0c5c777d5e1587c90695f7e4d16a6d236151cf5f0059cf75afe4e024540aa7fca30b3cde35cc4baf0c160f1478b097ddc
- SSDEEP 6144:p0qYtfAapMA1dMkvQm9anCT0BOKQGYmizmC9AksCaLzBuJtKxOj69JBGk:p0zAFakVB+GYFzmoHOBIjoJBGk
- TLSH T15AC4391073F88A26E6EE2334E430851953F6F916E7B6D78F2E4199A61C93F919C107B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
77:88:e4:de:ca:37:b9:7b:90:5a:8f:f1:e6:60:18:ee:71:d9:c9:03:26:e3:51:33:09:d8:de:43:c2:68:2d:77
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Aug 26, 2026
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
550574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
530KB
Virtual Size
529KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
system.data.sqlite.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e52eabbc8dbe872eb729024e7650720c405aa10c3d5c47cdec6fcc1d8b1f5e8
- MD5 bd0f6b6051bc1f1323770a92e7431a07
- SHA1 d38fcd5aeb6372a8f0cfde277989225decf62bb1
- SHA512 c3b9e7e75881cd5ac5ff293d74b4d0b5f80f31d4028c2d47529b9cd87991603f49bb213450644380abc4ad5fae83a2cffe85d5ead6b7f63862a9e4557c9ab1ae
- SSDEEP 12288:Nb8qJypIFWFNFfcaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbcN:58qJypIF+mJ4p
- TLSH T105845B9533ECA519E1FF5774E8B208458B74F4629EA7E30E78C050AE1DABB00A943777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
84:27:67:0f:b0:1f:94:fa:42:4d:ed:5e:05:51:eb:97:c0:57:08:91:81:2f:8b:98:5f:56:82:e1:d5:96:30:86:6a:5e:33:37:8f:b9:3c:db:43:d4:b6:18:44:f6:df:1b:1a:1e:7a:84:a7:ad:da:d4:54:ff:e2:af:69:12:e5:67
Digest Algorithm
sha512
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
4b:ca:67:6a:50:91:5b:2e:fd:f5:5a:b7:b9:90:7b:c3:f8:f1:29:4e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Chains
Nov 2, 2021
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479
Serial Number
05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 1, 2021 - Dec 12, 2024
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
390590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\dev\sqlite\dotnet-private\obj\2010\System.Data.SQLite.2010\Release\System.Data.SQLite.pdb
mscoree
_CorDllMain
Name
.text
Size
373KB
Virtual Size
373KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Regedit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e8b3185dfb4605cf9e1df4403fafa36f12f484f4d9604541da0121403dc39b1
- MD5 68d1cd646b429ee4845934cadd05695b
- SHA1 c971c853ff3b53e336ebd150562d5f696f092409
- SHA512 348988df175382247348e6d1329c61e4dd54f724cb2a3c624df1d74827058e4c00aa5f5acc1430d0ed3d63148c603bb75b60487e97e22699986c1e630dce5e88
- SSDEEP 384:+jKSC4zdLNUpTmeyAYvpYrQcfw9A8/QYbleZ:+jK1wrUs5Y0DA8/QYs
- TLSH T1B662096AB7D54331C7EE0AB31CB392004371E70A9803EF5F5FD821969E6719C87907A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8be2fb14b479ccdd9bc15beaf091a52df492882cb14b74f194a69e01eef8e94c
- MD5 971ef565c65f696214cb77b06e46c5e5
- SHA1 7d72c0b772a9b681ae463c3999998d7db6604785
- SHA512 de4326f2575c7dfbd57ca51947d6698d21a384a4e6a393c9765d5fb6874820e3512fa338cedf94aa199514b8de363a393eb6beacc0a54da9d25c29394b8f72fe
- SSDEEP 384:pZi1wjbuu8stkZYbbV9q/q6t5Nxt2d6QH9G/jrH:WKiu5tkCb2dtWs/j7
- TLSH T1F7822C5A73E58371D6FC0AB64C33E7400774D246C903F73B2ADCA16A9DA3AD18760BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/ReverseProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 922563d6198f0ea597a0c862f18d6ff9c2c2201608cef962b8cc064c46c796d9
- MD5 c929f13e3096b725eb1475b3aed0bf8b
- SHA1 ba7b4f294f0b198399bccb926afbad2cde38a822
- SHA512 238bb09f7b51027de7622ba0450f648d9ab52d0e5a3497192584bc1320f54737bba473aef3844533a22dd4ce2699c01881b2d3920a520e6143b2ce6d11290969
- SSDEEP 384:F45RejLUCUPxVPdN7FAv8zTNrxYFXoaFlS9icPCv:F4HGUCUZV1N7FLfaoaFQ9icPY
- TLSH T1F472071D6BF68372C9EE1BB205B2A2005770D605D813FB2E5DDC30970E776968798FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22966
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/RunPE.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8f73c87a4a95feed70ecc082bd97a4e05ba85d0ad7bf66a5e39991e108028aae
- MD5 75a1fc9ee199e9072f6088f8c1312e0f
- SHA1 38b80990ad84419310cbb578de135b21b80c048a
- SHA512 b4c12ad9806c2eda8135ffa196b84f898147f536067196781a19bd68756c015e9a0fb48571c9412b01e390264e12dee17d40bb8fbe24f061d2eb3140d61c0432
- SSDEEP 192:Vbfqh94qP9XFw3l+JNGGOueq1JtSnIW1fUseQpo7SLOYN:VbChWqPj5jJtGUseQpoHYN
- TLSH T15E320A1D93D4D679C9EE0AF24CB222811B72DA448E57FB3F55E4A4261CE33864AA1731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17334
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/Shell.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e9beffde0866bf4bc9e53cf4a748a96525a459c7c49d0ce6d2b542609563491d
- MD5 940ddf611e72e90cc2ba9f50cf5b38ad
- SHA1 15be3b300a07a2f883201e5d45a1c89d8ecdb707
- SHA512 6c6c1fbde1ffda75671a90295bbe9f8c8f654b089696df894debdd4c372fe5f281e49a076fe3c780f0b10200b0481cc618c99570eaed96adc6a1fe223c4c7d88
- SSDEEP 384:Xw3mb1rUAz2nvV/Vd1vRHfF88XT0L6YpU1b0YNpQ:Xw3mJrUao/d15/vDt1bdNu
- TLSH T158623915A7D48276C6FC89B61C73674117B1D306DE03FF2E6ED861AA5D632C18A307B2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/StartupManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c8fe07db19e5103384495a8d9636927cf8203e21e21cdbc61884829349a43f00
- MD5 83572e22aabf502e47478cbadc9f625a
- SHA1 537696a5a47719e58be7fe65367294eae996b1fa
- SHA512 3b41041df3edeaddfbc09484499fcb3df809c607a3e526422e3dbf8ab65f8f72c40fd652d7e39afca65c45ab29667c16403e15083b0ba218c2c10dc87f09c121
- SSDEEP 3072:UtkjKRhBK2A4kjTUsq7EHBAnpK37nXF83+4QvC74Syoh+0KryiT6RXHLzgaUcndn:U6jKRhBKvjTCo8FI6dfCcn
- TLSH T148142A4127A8C92BEBBF17F9E0B1160467B4F10B9561EB8A788C15F95B533409A133BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
199226
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
187KB
Virtual Size
186KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/TCPConnections.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2193a674c4816fef54b2fabb6ab321265edfc4ae932769ae017c658afbb84790
- MD5 d41b8051db33f2915a7fcadc3f23f194
- SHA1 05367451b5ff4fa3ed68c5fba553e435bbd31f3b
- SHA512 30010fa9cb101a26da0f4f1422e5489c36633c103da67c11509186d3a18780ecb6b26ee84f7dd7679f36734da1f6d62d49560071abeeeafdc43bd08b6f5ab0a5
- SSDEEP 192:3jg7Ks3wBH3Ud9eGLVOpkidXiS+O6FtQi11OtCEox0GTeE1tZ/J6IW1Gz/t/hYrb:s7Ks3wcxIdo3wCzTeST/Zz/uF/v
- TLSH T1D3722A5C63B5837ECBED0AB208B3A14113B5DB0D8D53FF6E18D8B1655D53A888721BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/UACBypass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2151d5f96bde452c96d280b00b3a99629b3d74b3c7526e988ab179c57f7b3335
- MD5 682099d00c1da6604a2e26103915f0e8
- SHA1 29b22d96a514a8ee69cb2a33b691a076eb598df4
- SHA512 8f14c821906bfdf7b70233fb5d7a4b101e831bf59af0f7b48f79e1c6edf3cfb5cc588defd92b40a77712e083a8bf7865e1f5408f041b97802036edcb81e51075
- SSDEEP 384:rNKWZxTvVue3L70mWbqpynY9r/zFlhFs5rUOV:LhvVuOkXb+/TPs5rb
- TLSH T1F142C61577E44274EB7E4E729FB292010B72FE088D77EA2E15C4904A0C7F745CBA1B62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18458
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/VB.NET Compiler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 69f3273c8a43cfdb2e282f02da2ed084e154e33497f788f65f58bfdae3d9aa94
- MD5 f5797fdad244c71defa5095dea05d66e
- SHA1 72a7a6385f754af0650eda0fa809df7eb302d6f7
- SHA512 be569ac5c01a72568d46ee956c85202a8f033de2159f7466f5f724e2b325b7494af2462e33e184be46170067613e8be3db0c03575ff7e841dfd99dd434b0316b
- SSDEEP 192:hWgDO0lNTlnqybcTwBJA+wGnzOSeJyxlTen1W9gotlF6IW1oXxvKWkWQEcGSL25L:DO0lZ8GcQA+ZeyTe1sgIXxvZQEcoh
- TLSH T174621B69A3D88371C6EF0F721DB2A20053B0E705DC53FF1E5ECC619689636988365FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/WSound.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3419a06ffd8bf5fce906ea553d0d6591d7a90ba7301541331c0d380e072bc7e4
- MD5 bfccd9383a458f978090f4f8dd54f6ef
- SHA1 cee9b3893a93446e5d4f9466408c472e14aa9438
- SHA512 ab68298664b2f5fe7f7a5b2c33452dcd170603d8ae74648dc390cf21dd12ae2c927140df635af301388474a4d1f4040f3f475db1d5ec1b601e73e420405a7643
- SSDEEP 12288:EyGwLs78GJUndM5/zobglKwM/W5pKg/+VnSXhu5:9GwO8GJUndM50bglZM/W5pqSxu
- TLSH T178C45C11BFE49567C16F33B2E0E20B6B57F1E48A7226EF4F059086A95EC37424C41BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
558170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
537KB
Virtual Size
537KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/Plugins/WebCam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cf4cc0a8559162b17fd3c2f99b272da6145c9a5afed527547e682e5fb33dabc2
- MD5 e35f3b277027fc5f1206f45d49bd8690
- SHA1 84ff7a255a6125e5db26ee30224355c9f78a1132
- SHA512 5cb7b61450250b5d1022eafbe64c98d9e7e40744b577e8ba1f2a6b814df09fa56f4ccc542cb2dadaa51f9942b15a5485a0f30033ed73628796331f0e2e5474b1
- SSDEEP 3072:ar2hWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJxL:aE+22fFcgBgakL320zYZHpMXM/fWzx
- TLSH T13E247D06B3E5807AD5BE4A3588735A189779F8118B71DFAF1B94025E0F633D18E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
220362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
207KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/SimpleObfuscator.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- TLSH T149654A01AFE6C72BD69F97F6D87206142BF4D049B3ABF79F161863A91C837425C06227
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1456282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/XWorm V3.0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d1b0cb76d6ff1e54e5669cc3ba76ba6224be19e721cc61a9e223a596a9bb332f
- MD5 71b0bb52ae4137c3e40dc802711e2acc
- SHA1 e154869a5725806c2b12866479be8cf326d52116
- SHA512 eea4513a347d9b2a5ee700388c34d9677869702384128b57e3299cff277b585fd713f4b44830c79da2b74ecc138d99c8aec9b4757d9dda6d3fa475a1dfdb6588
- SSDEEP 196608:rJNE1b0RkLZvaU6ScXc4sqgCzlMNxKa+M9:rJt4vKSoiqgASNUP
- TLSH T11E76F1053F90DB0DD02A3E7284E4D03047F2FDEA5A61D60B7BD52FDBF912296A887259
- MD5 SHA1 SHA512 SSDEEP TLSH
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7384670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
7.0MB
Virtual Size
7.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
XWorm V3.0/XWorm V3.0.exe.config
- SHA256 7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7
- MD5 66f09a3993dcae94acfe39d45b553f58
- SHA1 9d09f8e22d464f7021d7f713269b8169aed98682
- SHA512 c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed
- TLSH T171C0122940A8BD269D328A279252C962FFB022A2A024000CF02FAA670B3105D4257326
- MD5 SHA1 SHA512 TLSH