jaffacakes118_11019206463_eml_quotation.zip
- SHA256 3a30b483822bfc64e9874f2a846e8233b19a8eedb0258f55ff51a67c9e8ee055
Password
infected
Overview
overview
10Static
static
3Bid Acknow...3.docx
windows10-2004-x64
1Bid Acknow...3.docx
windows11-ltsc_2024-x64
1COMMERCIAL...AS.pdf
windows10-2004-x64
3COMMERCIAL...AS.pdf
windows11-ltsc_2024-x64
3L-GT-005-F...n).pdf
windows10-2004-x64
3L-GT-005-F...n).pdf
windows11-ltsc_2024-x64
3RFQ-945730...19.exe
windows10-2004-x64
10RFQ-945730...19.exe
windows11-ltsc_2024-x64
10$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Dyrepark/H...ce.dll
windows10-2004-x64
1Dyrepark/H...ce.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Bid Acknowledgement 94573.docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Bid Acknowledgement 94573.docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
COMMERCIAL CONDITIONS AND INSTRUCTIONS TECNICAS REUNIDAS.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
COMMERCIAL CONDITIONS AND INSTRUCTIONS TECNICAS REUNIDAS.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral5
Sample
L-GT-005-F_2 (Terms Cond Transportation).pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
L-GT-005-F_2 (Terms Cond Transportation).pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
RFQ-945730101-B0000005023019.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral8
Sample
RFQ-945730101-B0000005023019.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
Dyrepark/Hypothesist/System.Diagnostics.TraceSource.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Dyrepark/Hypothesist/System.Diagnostics.TraceSource.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target jaffacakes118_11019206463_eml_quotation.zip
- Size 5.3MB
- Sample260917-wtak2shd35
- SHA256 3a30b483822bfc64e9874f2a846e8233b19a8eedb0258f55ff51a67c9e8ee055
- MD5 f17238acd8ac2305a4a76cefc5c9015f
- SHA1 342b7cf3c80fe1c8284550b5aef384a6727d7cfc
- SHA512 075c5af8495d2bd42f4977f7f08c9d3b894f415d6e3aa6c2f93ed17c242d0d97e75f630a426f0ff13f1c477ad2cfe6e0918fcd1934c6104416394fa4778926ef
- SSDEEP 98304:JDkr3tduEpKRx7a3NgBmCy1zdvdCnRIWfyIi46j2Zs5DqG5cW:JY5/9nDdvdC2Ii4U265Dqo
- TLSH T1C246335925196F7F0DF2CF3A034AAE49534AE3A81D6C16E88038A94DC1B3C5EF7511EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack006/$PLUGINSDIR/System.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack005/RFQ-945730101-B0000005023019.exe
File Explorer
-
jaffacakes118_11019206463_eml_quotation.zip.zip 5.3MB
-
8f42ae971ecf314e8390b80df377f3ab9c0c7991267ceccb54af251d82a682f8.msg 6.1MB
-
Bid Acknowledgement 94573.docx.docx 33KB
-
COMMERCIAL CONDITIONS AND INSTRUCTIONS TECNICAS REUNIDAS.pdf.pdf 369KB
-
L-GT-005-F_2 (Terms Cond Transportation).pdf.pdf 5.0MB
-
RFQ-945730101-B0000005023019.cab.cab 337KB
-
RFQ-945730101-B0000005023019.exe.exe 372KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
Dyrepark/Hypothesist/Bogproduktionernes.Fis144KB
-
Dyrepark/Hypothesist/System.Diagnostics.TraceSource.dll.dll 130KB
-
Dyrepark/Hypothesist/edit-undo.png.png 442B
-
Dyrepark/Hypothesist/es.txt9KB
-
Dyrepark/Hypothesist/trophy-bronze.png.png 838B
-
Marxisternes/Divergenss/Archaisers152.Bag273KB
8f42ae971ecf314e8390b80df377f3ab9c0c7991267ceccb54af251d82a682f8
- SHA256 8f42ae971ecf314e8390b80df377f3ab9c0c7991267ceccb54af251d82a682f8
- MD5 2c3f08b781fc0273063b26ac3d1718ea
- SHA1 99c51fb0d4ff56f4b6227fdc17610c5f62246fbc
- SHA512 c204275839f1e1554f76bb497a216fe05dbf4235b44a03c3436a531e194b49bebf99d0dc67cee6b80f0ab3248952afabc032e354e2facf4759f46ed8e4fc11f9
- SSDEEP 196608:4MyLBWLBiuzZnLu4AkO8SKpnvr4UfEa/HTp13zvUt6fA:4PBWtfzZLu4HrpnkOEaX3z+6I
- TLSH T197562A035C994A87E12987F4BF535E9D2F1A7B1DE94639FF10220ECB3E616124C9E12E
- MD5 SHA1 SHA512 SSDEEP TLSH
Email Headers
From
Sender
Rosa Fernandez Alfageme <[email protected]>
Return-Path
Date
Fri, 19 May 2023 03:27:40 +0700
Subject
Request for Quotation 94573-LAR&SAF CAPSA/BIO OILS / 945730101 EQUIPMENTS / MATERIALS / TR
Content-Type
multipart/mixed; boundary="=_f42e7bd1f790e4832f29446ba43f0a9d"
Received
from ZRAP278MB0739.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:4b::12) by ZR0P278MB1025.CHEP278.PROD.OUTLOOK.COM with HTTPS; Wed, 14 Jun 2023 12:17:04 +0000
from SmtpServer.Submit by ZRAP278MB0739 with Microsoft SMTP Server id 15.20.6477.29; Wed, 14 Jun 2023 12:17:00 +0000
from AM0PR04CA0006.eurprd04.prod.outlook.com (2603:10a6:208:122::19) by GVAP278MB0055.CHEP278.PROD.OUTLOOK.COM (2603:10a6:710:21::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6411.21; Fri, 19 May 2023 00:52:11 +0000
from VE1EUR01FT064.eop-EUR01.prod.protection.outlook.com (2603:10a6:208:122:cafe::ed) by AM0PR04CA0006.outlook.office365.com (2603:10a6:208:122::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6411.21 via Frontend Transport; Fri, 19 May 2023 00:52:11 +0000
from wonderful-bose.147-50-227-13.plesk.page (147.50.227.13) by VE1EUR01FT064.mail.protection.outlook.com (10.152.3.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6411.21 via Frontend Transport; Fri, 19 May 2023 00:52:11 +0000
from webmail.cellumax.net (localhost.localdomain [IPv6:::1]) by wonderful-bose.147-50-227-13.plesk.page (Postfix) with ESMTPSA id B223F4373B; Fri, 19 May 2023 03:27:40 +0700 (+07)
Received-Spf
SoftFail (protection.outlook.com: domain of transitioning tecnicasraunidas.es discourages use of 147.50.227.13 as permitted sender)
pass (thsv73.hostatom.com: connection is authenticated)
Message-Id
Extracted URLs
-
file http://tecnicasraunidas.es
-
file http://tecnicasreunidas.es
-
file http://tecnicasreunidas.es/
Bid Acknowledgement 94573.docx
- SHA256 7af46e0bfac71c5acf1597d6e3a230cf42af7c5200e3dceec2287d315646a9c9
- MD5 6f8b0082b256607da9f25bf9e91fced4
- SHA1 3d1fe0d7affcd51630328fc54a7824092f9aba0d
- SHA512 c147fb5019c77715438e1e755f52a0ef03f41fa01aba6208968e69c6b6574e7de8520820b755855bc60452906a7a8f3ac4ed607511ad0c285dfcfb7e8984a683
- SSDEEP 768:VniFedr13albPPKcD448xllNlwuUXtSIN5VZ2aof7f:tiFebalbPPKj48BstSIXVZ0fT
- TLSH T189E2E03AC701388BC22A4FBCA20742CEF5599867E50A545E3F42B6ADDD44CC75782F8E
- MD5 SHA1 SHA512 SSDEEP TLSH
COMMERCIAL CONDITIONS AND INSTRUCTIONS TECNICAS REUNIDAS.pdf
- SHA256 a33042256eb3ec0a6e01cd19ec88eb7666a31aa5e36569e7653da0bbd2cc69a4
- MD5 679099f325141eee5af04c22ebaf9eac
- SHA1 25c481b5ded274cb6e824f35f2aab5fe8eba549b
- SHA512 19c94ab6a768664ac40401882407e3689fa1c251d4ac86ebeb707591f6c70ad039ec159443d913608371e148d978312bbab30b2a9bda8eac98c61618c3e92ff3
- SSDEEP 6144:9ybGexp5D8QNM5PWE34gtbaneTdh/8wCUHIq+jPxUwCl0A/8Lkh6XsHh8uyVjR2Z:96HpVzNM5PP3ZCWFL+jE0BAB8FPu
- TLSH T1F084128A86D8EEDC9030D8E53F654463DBDBF0B2B0EA6250541DD45F0586F4AF6A33B2
- MD5 SHA1 SHA512 SSDEEP TLSH
L-GT-005-F_2 (Terms Cond Transportation).pdf
- SHA256 91b73e305c59352b3526afbdf56f18cc977d7d9fad35750e0f8d4a96302d866a
- MD5 189d239316b58fa75ae62a33093d1f52
- SHA1 217eb353bb4d74ddb499a2cc115df1c5d300d8eb
- SHA512 f4810895e25d2372b0b5fd910ca0760e8082e69f29c853005cc19fc9b8cf4c48c9e20b4dc1568d1444fa20946227f55e61551085a4ab46d39a2b231a8bd84adb
- SSDEEP 98304:woLBiuz7wZf8ndhuluAkO8SKpnYsrHYC5fDQaiSHTp/d3z15UyUS3r:hLBiuzZnLu4AkO8SKpnvr4UfEa/HTp1x
- TLSH T1D2362D034C199B93A42997D4BE571F9C2F163F1CE98639FF01664EDB7E602225C9E02E
- MD5 SHA1 SHA512 SSDEEP TLSH
RFQ-945730101-B0000005023019.cab
- SHA256 bc671169f3b7f158b63c97be59f23c2319b1cd35a12275a10caf9c0bc753f378
- MD5 6921966b0378fe2e4daa77173448d034
- SHA1 4db627cff2af5de1f7ceec1ad1125a4a9dcefdab
- SHA512 b8f9370558dcfeb41684bb92fb0c392def2806cbbcee8dfb9812fe1fbfd71687097259a7ac5ecc398cc5b8d25e891106bc60d77ca52c628ecb3d5ac2cf2302e7
- SSDEEP 6144:PfZhluIc4qHV3e2SuoWtfYUR1flKM9ufvMgxZtE61PnoPFHGLBCEumgGJ3:HzMCqHV3eJuoWFslEgLa6WyaGd
- TLSH T10574235DB65572AC366484B204BFF187F227FD4B0A30A24D21711C83EBB58F5E8F616A
- MD5 SHA1 SHA512 SSDEEP TLSH
RFQ-945730101-B0000005023019.exe
- IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
- SHA256 0ab6668c4bc57f654f1b09af524dd2313ecf7900f347e0c0b2d5b9f8e07eb6d6
- MD5 a181890ed3921d788821c0a60a209238
- SHA1 a1bc539d996f64dc79cb8f72e4a1f0cc201b986e
- SHA512 f2a62a8f1881a46e2b8a0857ddab276ea1ee76e22519b7fb0c7d8cd5726aea7ddee342ac9fa4c7285d0d9d48cfd66fa0c10db1738f29fcf5cc83ccd48768348f
- SSDEEP 6144:y4t6LsKwbbbbPbbbbVbbb7bbH+bobRe0bHjkF4qHVMe2SuoWtfYfR1jlKM96fvXd:ykKwbbbbPbbbbVbbb7bbebobRe0bHjku
- TLSH T1F384120877A1D0A7E26646B1897FE397FA35FD090E60520F23203E9F7C723919D5A369
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
45:cb:d3:15:90:63:42:36:57:42:13:3b:ee:bb:c9:e3:4f:27:4d:1a:5f:60:c8:57:2d:1d:4c:37:d0:a1:71:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
OU=Udpolstret Monocoelia\ ,O=Envoys,L=Milligan College,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a47617a657474696e67404163636570746572657333332e536174
Chains
May 18, 2023
OU=Udpolstret Monocoelia\ ,O=Envoys,L=Milligan College,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a47617a657474696e67404163636570746572657333332e536174
Subject
OU=Udpolstret Monocoelia\ ,O=Envoys,L=Milligan College,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a47617a657474696e67404163636570746572657333332e536174
Serial Number
74:21:1f:d0:b8:58:79:2c:df:d8:9f:40:c5:f6:1a:ca:9b:cb:2f:1e
Issuer
OU=Udpolstret Monocoelia\ ,O=Envoys,L=Milligan College,ST=Tennessee,C=US,1.2.840.113549.1.9.1=#0c1a47617a657474696e67404163636570746572657333332e536174
Revocation Status
Not revoked
Timespan
Oct 7, 2022 - Oct 6, 2025
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
0
Major OS version
4
Entry point
13054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
user32
GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow
gdi32
SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
advapi32
RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
196KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=166, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
- MD5 17ed1c86bd67e78ade4712be48a7d2bd
- SHA1 1cc9fe86d6d6030b4dae45ecddce5907991c01a0
- SHA512 0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
- SSDEEP 192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
- TLSH T1E3325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10183
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
610B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Dyrepark/Hypothesist/Bogproduktionernes.Fis
- SHA256 abcaf3606dd085d66055fff976d4c0d8ddf8c0674297c4518a74ec45e681963a
- MD5 eb5cae00b73873ceac0a947cf9ce0b1a
- SHA1 a5a69fa4646a2c57daad7085e20ba3b6ee665e87
- SHA512 ab93cecdd8041948e35a4712279473a1c42c8b98c6cd4f1062e190dc485ddee039a413474df604d6581e8e68bc1b9f8eba99d7593cb374ad25b6a6396c5bdb5e
- SSDEEP 1536:qhcSidqFxC56XRCj0N37aMNZRkBvZOc66+rYgz/XPbpCSBTU9KYj0XxiZ:qhcxdQVAWaMNMBX6BxL/bcAU0Yj0A
- TLSH T1CDE3BF52DB66CCF9DD07C138D86E61D64C6970118B4FE0BDA236E81AC19B1F327286ED
- MD5 SHA1 SHA512 SSDEEP TLSH
Dyrepark/Hypothesist/System.Diagnostics.TraceSource.dll
- SHA256 1268992f73b4cababad60132ffd0e5b263be1fcefa3424682122ea30c782215a
- MD5 cf7d33a3a62a5afc82b7d5edbcc004b4
- SHA1 8af51453c9ef2634e3a6ba8bcf7f3bd84c38662b
- SHA512 7876bb41e37f6b14a435b036ed9336e994c5f865b2b57712e99b1d7c1f6b1d476f7eecf5ab18e2dd5ea360f4c0d4a91663c9635ed40a233bffcd87fb6870b2dd
- SSDEEP 1536:3FEHjJ1F0C7aR7cqVZ/PM32FsMNjCOE20esf9eVliqRIL8Dnmty6n7BNM/WZze:3WNb0Galj6SsuOj2Sf9eVliimty67HR6
- TLSH T1CAD36A26B3D84247CE2F927888538542DAB3D1D32382D3CF0956A6B92F437D6BF72156
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d2:71:5d:b9:ca:a2:73:e0:92:41:e4:6f:37:f7:7b:88:84:83:cf:7c:97:44:10:1c:01:f1:08:ee:85:5f:10:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 23, 2021
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 11, 2021 - Feb 10, 2022
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:3BD4-4B80-69C3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:89:b4:bf:86:30:84:1c:4b:8f:00:01:00:00:01:89
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 28, 2021 - Jan 26, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
System.Diagnostics.TraceSource.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.Diagnostics.TraceSource\net6.0-Release\System.Diagnostics.TraceSource.pdb
Name
.text
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Dyrepark/Hypothesist/edit-undo.png
- SHA256 e99f242040241c4a5a7b61916d6d5ff3f17019a1b31a5c5cd0ef6952c16dc12c
- MD5 299e1b0a503a59fe6d8252c0972d7633
- SHA1 7ae2ec9c5f04856088f1b914cd596b2c6f2d79b1
- SHA512 9ccc9eca78f4bc5333767a5630516ac39a17050956baa3fb9a6d6512a9742fe16777855aadb81d48e47e45dbc79bc9c0078904899e8647885e64da7eada739c1
- TLSH T197F02347823E713CD39DF6410928E0CCC347254CEC965588861E02FC3896F8C03B02C4
- MD5 SHA1 SHA512 TLSH
Dyrepark/Hypothesist/es.txt
- SHA256 7dddae25296f14c1f45ac032d9c950c3a8d39a41489f9d2b06000edcfa7a6660
- MD5 5a449308a0176d6401181bef4af13765
- SHA1 9d8bc3e801bcfb43c7dbfab94ab91a4079a2070f
- SHA512 2aebd25219b12d88bdf7a4a1b90b6b13b4ed5d4215e15d2316494c56b7d696eeb3252478200bcf0d84160d11979f5a71c72ca110dd3e28e901cfdb13255c45b0
- SSDEEP 192:i3vSP1uIlLvt2WSBL7hBC2pjlRS03gyLuBODltrO9K:i3KPUIlrt29BdGK
- TLSH T1C612943EB5CC47923092136EAB43C09BE5C4E9913C1BD18AB37943A952ECDD9CF57829
- MD5 SHA1 SHA512 SSDEEP TLSH
Dyrepark/Hypothesist/trophy-bronze.png
- SHA256 3bdf78afe616bf4dbd3b55ddc8e8926991d1d14c06e2ad84bdc9591f9caca41c
- MD5 80e9af68b23078929e273fb406803747
- SHA1 fc4ac68169399750c6009122246fcc1f7a8838fd
- SHA512 b66dd06acfa7e74281e86e05e15b20f75b44ae6a4e13579d9765d221015330e226ffab20a85da48d143ddfa12b9ef73c2437f3edd6594de4770ad9e012b0be4f
- TLSH T18701D6DA2E193C3B128AD67E2A19DBF659342F82E4E97C9CA804C14A3D895488188344
- MD5 SHA1 SHA512 TLSH
Marxisternes/Divergenss/Archaisers152.Bag
- SHA256 2153e521325aad8d1fea55c0add24ef69263533a9ae893997bec20bdae4153d4
- MD5 80fa86d80cf39e0e7537b80708574ee9
- SHA1 bc5a47d87fb208a34b216e1d7c6e00cb93e76c75
- SHA512 898e368caefaf2d8b6dd4153422d2a1073d8d0b3bb8660fcff7df043c3043d3e7e681b237a4166eeccac5bfdc9756399891fe9b14aced14df273307e0ff0d1e3
- SSDEEP 3072:2dY4SSPJvNVP4ICx5Z5Ctp+ktOVzP5YCD8GaHNQkm7IxsFyehW/B8nnbjO:27xtbgx5ZOnsBPSZGatdmExsFU58nnO
- TLSH T10D547DF4A41E5E87E21BD0795030F67B8AD92C25EB41E1BBB015F5A836B37C11CCA91E
- MD5 SHA1 SHA512 SSDEEP TLSH