quasar | Client-built[.]exe

resource	yara_rule
static1/unpack001/pulsar.common.dll	pulsarat_module

resource	yara_rule
sample	family_quasar

resource
Client-built.exe
unpack001/aforge.dll
unpack001/aforge.video.directshow.dll
unpack001/aforge.video.dll
unpack001/gma.system.mousekeyhook.dll
unpack001/messagepack.annotations.dll
unpack001/messagepack.dll
unpack001/naudio.core.dll
unpack001/naudio.wasapi.dll
unpack001/naudio.winforms.dll
unpack001/naudio.winmm.dll
unpack001/pulsar.common.dll
unpack001/sharpdx.d3dcompiler.dll
unpack001/sharpdx.direct2d1.dll
unpack001/sharpdx.direct3d11.dll
unpack001/sharpdx.dll
unpack001/sharpdx.dxgi.dll
unpack001/sharpdx.mathematics.dll

Client-built.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 936faed38fa85f481995a37af7963be3408970718464d52a6c1c498c1e01d6f2
MD5 12e784e88a73d094f408d326872e188f
SHA1 cb532d2c7d80aa781bbb50869d54c5b9caf1f07f
SHA512 b34a4356beb4af7c0c98d479016c7b2dad129d5c88526529bb2d1e88afdfaab5451886ee9dda05633f78247fa04be140a7b85d2617a5ab14495805d824ee00a0
SSDEEP 24576:Pg0iMfHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfEez8LSBNB:Pg0TSGOGqnXpyWc
TLSH
T16A850150B7E88507E1BF2BB9E8B216054773FA52E93ADB4F5948509C0EA7780DE503B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

1872462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aforge.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Core\obj\Release\AForge.pdb

aforge.video.directshow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

67246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb

aforge.video.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb

gma.system.mousekeyhook.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9736bed57d137a0bd4a454a70436020312db5a365bdd243037e766695c18ccd
MD5 41b34eab1585d5381c56730b93dd1310
SHA1 510b640517342dbcc40c81b63db23fa1444a71ed
SHA512 14abe45c04c9620a0f1c4a5ea3882f8388d0d73f497b84020033ce9d3f8d49922694580aedea5e75652101df3c98818f3ebc4ce2865d75e77fdaf3b18b3c354a
SSDEEP 768:I/t9KqM6Un424sqnGxnRLTxT2Wjq7oEs+DfQ9n5xXK:Ilgl6a424sHXv93ji/siY9ni
TLSH
T169436B24835C0337CBDD8B3FA476412A87B1D7863953EBB7AB9881F02867B541929377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

52854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

messagepack.annotations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4d7aa07d288c6a39109eedf6435e3ba8c413342876ed08bb5a64d55dd39dd04d
MD5 3876cd00a3ad6d0a5fdbfc19877f300a
SHA1 a0690708c86f009d41fda400fead8407b8168895
SHA512 0cb6821318ab5ee8b5598018cb13d142511b5d033b596ee6d3265dab1d898ac1c07adc784d64d26bceee4a07c980a6e49065209055c8769c09edc4c81f1dac65
SSDEEP 384:/C9rT5pVmE6yc1xEpYF+/vkfLRcwMgjjxPW:Wj0E6yYxiO+/cf1cwMgjj5
TLSH
T14F82E835E398A377DE7B0BB9FC6462610E3AE5487503E63B9708D4572B06BC146A0B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/MessagePack-CSharp/MessagePack-CSharp/obj/src/MessagePack.Annotations/Release/netstandard2.0/MessagePack.Annotations.pdb

messagepack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 067413dff0f9d7a386fe3968cb3988594e68f647c157502ab11d939fc8e2d6ef
MD5 e2fbecbb3953cb5d5de98a38e5323095
SHA1 b57b485ba7372fb3403fd0c36043a051af2afc05
SHA512 25e1fa8e8d78b5d9436255b6995763417ba874d2b16e26ea4f6e03b738994d72ea2468bd566d644e624e810c2ac5548e1e5db0e0024b6c2dab7f30d30e595da5
SSDEEP 6144:c4dxt4Yw//8mlhqkkwqE1zbTmRiVUBa9lssUk80/JssG6WpoY:cJgRD1sdJ7G
TLSH
T146845B9463EC4F23CF9E8E78D4A010064F71C52BB09BE75E418CA5FD3DA6795DA212A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

381926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/MessagePack-CSharp/MessagePack-CSharp/obj/src/MessagePack/Release/net472/MessagePack.pdb

naudio.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
MD5 48867f392b8e77dc06c062638c6fbd36
SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
TLSH
T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

190890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb

naudio.wasapi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
MD5 278ebb79da14ecf8e0559530c2fda076
SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
TLSH
T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

185178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb

naudio.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
MD5 be8205f435b2afbfd178960c46310c17
SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
TLSH
T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

46878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb

naudio.winmm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
MD5 faf1ba532964984a34d60674fbc7a5a7
SHA1 0999178949de510a47d87de3b8a117a003c572ee
SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
TLSH
T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

63254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb

pulsar.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d0fdbc1d203eb3d7c436859fe277dc0ba36cee727cc43cd2e5733a46b9083853
MD5 df88ab9b6e8170ea4906b3b917bb37ce
SHA1 3227325d277e4b1d328cdc7f9d9195a788360767
SHA512 a80d3b3fdf1fd0b10cb94ef0fdee3ebe5c0bd16e359e1b78bf9b84ca9d2e22b9fd7a2c28c0ad465cfa5166cb81216e9d0aa4b7426d79322786fd1536ce6ee8ac
SSDEEP 3072:UGvfloxqpQqoApzyXs4xjo93+W9Qfg/Rf7bbL0ow4toOiT:VvtoWz4xjgk8f7jMGo
TLSH
T197E3D6006774CF7DC3AE59F8B05C4139A3F88A4A3193EBA7A78875D9385379344906BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

162126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

sharpdx.d3dcompiler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 268b44a78354f7a225e5b1567223179c7b73453c0a27eb4bf18bb57d7a8e08d9
MD5 66aeaaba0629daf8544afc8008079386
SHA1 1e09e5d24e1aa3d1700b265c6ff94b7524813f4d
SHA512 dd2cd1df484600e6cc3e686e64559c3447f255f723b5f57cd51f76a838a79416bf68b7a7b380467bce172fc3ec868eb54a0d754108926782d31bb0cbd66f5a54
SSDEEP 768:VbFZAPoGIjmU9ZMPVNOhTJCj+775suxTvJREFhtK4shNeYJub4h8ZGdwv1PmQYEQ:Vm9SXGunREFhtKhNeA+4h8Md81VYExO
TLSH
T1E4434D21E7486256F68E0BFDB0264F064331F2467417E78BB9CC98E52D97354EB1A3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

64302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.D3DCompiler.pdb

sharpdx.d3dcompiler.pdb

SHA256 226f82b448c2f8700ca5c9f3658a0808a251f98d8543753e6231bc41b2a2053c
MD5 3c7ce2802daee6dba9e39970995c4069
SHA1 4fb7a312cc269cb44487b0fee6b94695024a6b0b
SHA512 203b5f374ae63ad4f9a3f926d8d0afd351f2886d6b3a1ff6d0356c080980e850b9934b875b34accab8eb0382a69b168c3497484bd2ce9f2f4b23b5230d751ac6
SSDEEP 384:OXwP73y8HB6AreJkS9RBbwX/QreSLG1UI43I6Y3Ix:OXmyiB6hkSVsoFI60Ix
TLSH
T1ABA29415E3E0AD3DDB833A3760636327837DD04886CB8F0712ECD7BABD997044666A59
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.direct2d1.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f4b5e240cb42ce903082f81633bba0c781c1e684fd5903bc3915e3805b5e83e
MD5 b992dfabf27b4c32c57d5cc2960cd8e3
SHA1 b012190d4cefbca3c63218f8fcd6e7211de40913
SHA512 f6d86cb73cb44c2d0ced4585f628f953ff604adde07da724f64122c6d07536985c4052a4aadfabee69f16a47797ef87f48e46eb5ff9601d0d3564aa4979f9467
SSDEEP 6144:90MJT4AfGTJX022MfHZJo/AuiEqQvWW9mArUXCxfBRh2O4OFr77:l4BJECZSxBW6mvS7RhQ8r
TLSH
T1B8B44B1127D84B2BD98D5EF7D171861892F8D10BB227EB4B398691794DC33214E0EBEE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

500894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct2D1.pdb

sharpdx.direct2d1.pdb

SHA256 c85d2fd579c5ddc47d6c7f9a399558931447c66cc878218fdf78708103a4c5ab
MD5 b7e9ec399d002f3c92a80d73296b8fee
SHA1 44e30b6f808b43a07716f804cf694f95ebeeaac5
SHA512 68222884e0dd0b4d9552717efa64ddbcaad8f12c83f8bf6e32f6b2d2699021ec73f005c21a981857a723f862aac58e09ba819958a3736a45c75930011158af30
SSDEEP 3072:DSaGja/imizEYq7wlvNqrrFdnW7SXuIC8MsjjHtZRRftTFZ2aOO:x6ev4EYq7SvNqVdncIC8Ms7RjTFZrL
TLSH
T1E824D70AEA58831DCB368A3515A7D2162370D288DC4FDB4FB6ECA7391C5B78A04B357D
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.direct3d11.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 56f525e33494f4cd2a560a71cdf237303a3fb54a8fa44e1693eba35c9245c60a
MD5 07137e5cc4d5ecc95ca267c9dce042d4
SHA1 d82f5e3d718bc9172fcfe0e8c50cb20251762058
SHA512 9d1d6eb2887653260b62a24d3ab2c358bf15b89f68a1a3a1104f1eb5362725eb535218b9a53211f9cdb67d7793ce346c520a289d66c3edf786b0da5db7c39f0c
SSDEEP 3072:zTlyoOCGOd8DxSEjnhkHTI4A2j4xBJz+gM5w9HDAVvbLvm5KhgeeCjDrgvmjG0Wz:N3n2lB+xQyUeklXAknj1ur
TLSH
T16254F911EA084E8BC98E55FEBC12F90782F98C15004AF7A7E84DC59B1ED23D9D91E7C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

288270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct3D11.pdb

sharpdx.direct3d11.pdb

SHA256 bba95514fb062788c9aec9cd7bc553cf47843c42ca5eb572814ff4b7c82ce7fd
MD5 1600d8adb3e99f85c1e9719e59828559
SHA1 a2259a45ea284247b3aa65ec9c1dbebd47fe208f
SHA512 dd967ab0f86d77fef2e09830c00f318020b519205dd6f8be70fb5d07fd5f6b988ace83487b56ee49973216b385dcaf802408223aa0fd6d9f6203dac6066bcc00
SSDEEP 1536:CpHzmX5+N9aIcSyP6JFzIocUNX290MKc7P9tOaZQTZH:CpyTmyiJFzvNX29frPaTZH
TLSH
T16173E90BEA84AF2ADF574D30586391067374A148DB8FDF47A6DCA33B9C9B794486390C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a0af255ea4b09a8cdb995b8c6fd1075e46f098e23c2351c974e6ded9b8b620cf
MD5 c52a44933d17d576d4c97b4cb0545841
SHA1 092696fdcc034910aa02c94a5c93f4e1e86e0c50
SHA512 8273ddb86a54c4834d469bbc856d1793c86f2577e21411f30083d4e597427170fd9ca38da2e86f081d284043d5ea4a6d3330037eededd17e37aa885927d0a76d
SSDEEP 6144:IyfsmUCs3Zchh2UBSFKu033XbEUsHBEAT0C:Iy7UCs3Z22UXuwbkHBX
TLSH
T118446D36FF0C1A93CD8E46BAAD63951303B098102552D64FB944A6AD2DCF7847F267E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

280462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.pdb

sharpdx.dxgi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bc0243134c93c55ea105d0e9c2a43b6030e973290d0a061cf3a61986a2268a88
MD5 d2edde626c241549eab636aa87fb5d38
SHA1 8d836febd477b3ec44cc37f4f0aecdaa1d7db788
SHA512 490878e20ed764e81e42b8f43faf2adc0810dcd2f65d36f6d6980411617fae9543f0d7b6f110e5363be494097ba3b30dcf3695aea41314fbe19c6a59a55538d1
SSDEEP 1536:x/xP0dmNHRIfvXyTjUxk0+8shTbRqpzMA1JhkrIAcFpZMD9hVRg5bT+02nBJdbea:x/OSSfP60kpVxbUuZKq/4qaTXc
TLSH
T1CDE321826D7483B4E9CF7FBEE695B92A5523F1110481B64612E27A004BC52438F9FFDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

153678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.DXGI.pdb

sharpdx.dxgi.pdb

SHA256 adc6991011da455e001f537db1970b2208d960ba7e66d4d4a534d293235b4463
MD5 44e3cf00d4eda7f4aa38044d578aa537
SHA1 d73e59804e3ee494a4612185771f7f67b2fd64ae
SHA512 b83080b7968e5b32dd7b1be70eb7f9bde797de248a5b4c5c94eea6ec0342ad8fa78b4ff46e63835edca340c3f3b254044f0348bc84f728edd37db1ec223030dd
SSDEEP 384:JNne+E628lTYV+5Puni3MKW6kqQ9aRrwytEc8nl0FXGwxXl3kKjF2kCkB72KRleh:je+E628lv5Gi3MKWNqR928ksF2t4lg
TLSH
T151F2604AEFA4931EC3239B7594A3A32303749149CFDB471B13DDB7296C4A3E84DA295C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.mathematics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4c9615496970ea84320e2a6e99f8fb828e3c7790384df5585d93fc368885d94e
MD5 50e6524b7ee9c2c93f5210b63cb1ca54
SHA1 3e296ec3bb24750833ea80515e6fb4c73874c91a
SHA512 f9d3b296e14d72f4bff727acfdcfb520ae1436ba5ded03be04a559f493d4a8f9f915c0a2f498214309d0b84d6b3ae29750186615ae3250ad218aeb09dd7175ab
SSDEEP 3072:BW+i1u3AZ2YRCPJ4e3qHKSOZ53ZSOUE5Cgil7MEcR5hpGO5wZ+iEZUn1Bt+ZknSB:BdAZDCziyEs5Pib+ZknSTpc
TLSH
T14324E75CCFEB4576CBAACAF9F01D0EDB67295158122FEF1AB19894FA0803369D1012D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

221054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Mathematics.pdb

sharpdx.mathematics.pdb

SHA256 ca3492f46e271c70182d04783b4731c6a6ead3659ffa22ec02a758b3905e8508
MD5 2056464074215066d3d06abbba1a0519
SHA1 c2d459a790cb21aa1c8fa92f55b96804aefb78aa
SHA512 eedef1f1dcead2f15928d24028c62b518f7f6b89a4e739b64c3c1fae0b1123dc9c1a6ce024187cf2656cf5620ca670858435ab6d9c34ef9a99e283b1c14bcdf9
SSDEEP 1536:1ernxRpKZkJklUHHIWNVXVxYGGGGGGGjQYXHEmM7F7MlXZE747fBL/zdx:cbKK1NVXJTXkt7F78e747fBLJx
TLSH
T179938327CA888606CD06A9778972072533B9D0A8974D9F4663DDF379FCA3B50A9D334C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.pdb

SHA256 4109cfff6e17d9bd2efdc7fd52a4f544b5c66c9743c9e8ccf7d8a2f6cfc23eb7
MD5 2883c3a35927e62ebe1871c130e93f31
SHA1 1a7c10aa582cceebffd9bc77a11353aaae6417e9
SHA512 9bc6cdae59163756f9110867353e513cf53003a2c171e9458d920d83a8d025ab9dcffc3278309223e9ba257b88cdb3f7f5c23ba78bb8ca4168b74f91dace8658
SSDEEP 768:wIla9Y6ZBiygU1v+cALYbshPln6wWxwAU/fHKcnLQ8:CO0zWcQEIlnxF66
TLSH
T10213C506D9A68B2BCA56163E4F3347155B30E28CEA06CB0713EDF7B5AC5BB040DA356C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.collections.immutable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5ec0837bb176abf13dcd52c658c4e84c5264f67065b9c19679b6643f7d21564
MD5 af7880a90c02c0115cd169c7182ab378
SHA1 6e3ccf50bb1d30805dce58ab6bdd63e0196669e6
SHA512 5377f83cfb8b9892727ed22ba0b9b1a75b2d4750caa6da04f4eeb0f6f9c0f75949226b2ca00876ad1f4c9de02f8ffb1cbcdb3048fbe6d26a6119148282e818a1
SSDEEP 3072:QBn4ZzK9VbHknD118xm7DnNeHr6n4xJ2WGK8xSSpz5TXui5cb7rq2cAVaSX7hyVY:Qn8CVbHknvteO4xMlpQbHcSzkVaND
TLSH
T15C344A04B78C9B76DA6F89F3B9A0D46A0E72C51360DB739A60DEF7E42CC37949C58094
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

48:5c:ff:60:3a:fb:bd:3e:3d:27:c2:f1:6a:e0:d4:da:f8:bd:6e:ae:ca:08:33:3b:e1:a4:90:5f:9d:70:d7:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2023 - May 8, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cc:86:a5:dc:37:eb:d9:61:2d:00:01:00:00:01:cc

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

246334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Collections.Immutable/Release/net462/System.Collections.Immutable.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 8, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 2, 2021 - Sep 1, 2022

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

136114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:3f:15:d3:a3:69:9e:ef:89:cc:00:00:00:00:04:3f

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 19, 2024 - Nov 12, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:fd:73:f9:68:5a:cd:0c:61:ed:00:01:00:00:01:fd

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Client-built.exe

mscoree

dotnet

aforge.dll

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

gma.system.mousekeyhook.dll

mscoree

dotnet

messagepack.annotations.dll

mscoree

dotnet

messagepack.dll

mscoree

dotnet

naudio.core.dll

mscoree

dotnet

naudio.wasapi.dll

mscoree

dotnet

naudio.winforms.dll

mscoree

dotnet

naudio.winmm.dll

mscoree

dotnet

pulsar.common.dll

mscoree

dotnet

sharpdx.d3dcompiler.dll

mscoree

dotnet

sharpdx.d3dcompiler.pdb

sharpdx.direct2d1.dll

mscoree

dotnet

sharpdx.direct2d1.pdb

sharpdx.direct3d11.dll

mscoree

dotnet

sharpdx.direct3d11.pdb

sharpdx.dll

mscoree

dotnet

sharpdx.dxgi.dll

mscoree

dotnet

sharpdx.dxgi.pdb

sharpdx.mathematics.dll

mscoree

dotnet

sharpdx.mathematics.pdb

sharpdx.pdb

system.buffers.dll

mscoree

dotnet

system.collections.immutable.dll

mscoree

dotnet

system.memory.dll

mscoree

dotnet

system.numerics.vectors.dll

PE Signature issue

mscoree

dotnet

system.runtime.compilerservices.unsafe.dll