dnSpy[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dnSpy.exe
Size 207KB
Sample260924-pq1vhateqa
SHA256 bc1c4e0fc49c138bbfc223d3e94231cd4884439c663646d91e48fa005df6704a
MD5 5cf180fec9628c4df4267de3ed7a98a7
SHA1 edeaac9111d8f499378b67c983f7b7defbddb268
SHA512 97149bb70657393965382a152f8dcdcd9bdca5a6914b788dcba6b92be1547a83fd2720afbd6b2deb9d20da524ee2bb85375d9ffd4b019157f0eef51d46539133
SSDEEP 3072:XUffq4qd9J+AbT9aMqOQl+RgAvImdr+fwjZV:XQANK4bNOwb
TLSH
T194241A3E62E41BDCD061B1374F61B103AFE138EB06618EDEBED42E5A3E265908D3561D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dnSpy.exe

File Explorer

dnSpy.exe

.exe 207KB

dnSpy.exe

IMPHASH ea4dd374d22e48fdcffcc7ad5e323053
SHA256 bc1c4e0fc49c138bbfc223d3e94231cd4884439c663646d91e48fa005df6704a
MD5 5cf180fec9628c4df4267de3ed7a98a7
SHA1 edeaac9111d8f499378b67c983f7b7defbddb268
SHA512 97149bb70657393965382a152f8dcdcd9bdca5a6914b788dcba6b92be1547a83fd2720afbd6b2deb9d20da524ee2bb85375d9ffd4b019157f0eef51d46539133
SSDEEP 3072:XUffq4qd9J+AbT9aMqOQl+RgAvImdr+fwjZV:XQANK4bNOwb
TLSH
T194241A3E62E41BDCD061B1374F61B103AFE138EB06618EDEBED42E5A3E265908D3561D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\standalone\Release\apphost.pdb

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetLastError GetFileAttributesExW GetFullPathNameW GetProcAddress DeleteCriticalSection WideCharToMultiByte IsWow64Process LoadLibraryExW FreeLibrary RaiseException RtlPcToFileHeader EnterCriticalSection FindFirstFileExW OutputDebugStringW LoadLibraryA GetModuleHandleW RtlUnwindEx InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_errno _cexit _seh_filter_exe _set_app_type _invalid_parameter_noinfo_noreturn _configure_wide_argv _initialize_wide_environment exit terminate _get_initial_wide_environment _initterm _register_onexit_function _initterm_e _initialize_onexit_table _exit _crt_atexit abort __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __p__commode _set_fmode __stdio_common_vsprintf_s setvbuf _wfopen __stdio_common_vfwprintf fflush __acrt_iob_func fputwc fputws

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc

api-ms-win-crt-string-l1-1-0

wcsncmp strcspn wcsnlen strcpy_s _wcsdup

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-locale-l1-1-0

_lock_locales setlocale __pctype_func ___lc_locale_name_func ___lc_codepage_func ___mb_cur_max_func _unlock_locales _configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-time-l1-1-0

_gmtime64 wcsftime _time64

Name

.text

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dnSpy.exe

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic