GoonAV-3.1.1.zip
- SHA256 68e29cbd417a3a765af1a8f94b596641a90fc7990c183ed6ddede49f66f39988
Static task
static1
1 signatures
General
- Target GoonAV-3.1.1.zip
- Size 2.7MB
- Sample260924-rsreysfb83
- SHA256 68e29cbd417a3a765af1a8f94b596641a90fc7990c183ed6ddede49f66f39988
- MD5 7dd4ec763d6997fe1adf303c46d171a8
- SHA1 4589e9fbced61b34c305fb616f79fc7affaa256c
- SHA512 4a2f81deffabd0069896284ac91abd31a374b31909305f59461f3746a10a80475b01a54b0bfab8aa37b9d2c3dcd28e0582f82678701b54443ebe1f92aa1ea7fc
- SSDEEP 49152:lhWZGmSKqj519z3RuZzjr8fhJ5N8KiTTxfkG/1t47nLCpskMskt0:lMkmSB/BczjKv61pMG/1KLCWCj
- TLSH T171D5337C48A9D1E4FC9B0763048ECA7AF7D721BA5CB1709E558055863CE7820AF8F0E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/net8.0-windows/GoonAV.dll unpack001/net8.0-windows/GoonAV.exe
File Explorer
-
GoonAV-3.1.1.zip.zip 2.7MB
-
net8.0-windows/.goonav-install-root56B
-
net8.0-windows/Alarms/AV.MP3656KB
-
net8.0-windows/Alarms/Ghost143.m4a131KB
-
net8.0-windows/Alarms/GoonAV_Default_Alarm.mp3121KB
-
net8.0-windows/Alarms/README.txt410B
-
net8.0-windows/Alarms/Reveille Loud + FAST [Alarm ringtone for mobiles].mp3759KB
-
net8.0-windows/Assets/goonav.ico77KB
-
net8.0-windows/Assets/goonav_shield.png.png 750KB
-
net8.0-windows/Assets/goonav_wordmark.png.png 92KB
-
net8.0-windows/Assets/goonav_wordmark_original.png.png 115KB
-
net8.0-windows/GoonAV.deps.json2KB
-
net8.0-windows/GoonAV.dll.exe 247KB
-
net8.0-windows/GoonAV.exe.exe 227KB
-
net8.0-windows/GoonAV.runtimeconfig.json515B
-
net8.0-windows/System.Management.dll.dll 71KB
-
net8.0-windows/runtimes/win/lib/net8.0/System.Management.dll.dll 304KB
net8.0-windows/.goonav-install-root
- SHA256 eaf8ec08570bc0cf07dd924477adcaf3cbc31e0b177fe82b7251a5a3b7ea17b6
- MD5 a250aaaa208239b5af8328483fcd4160
- SHA1 f1869904e66131740c933f14d03bee7b0f723551
- SHA512 ebb8f7b6eee809eceaa72dd19be71c14aa78dcb6c92f4554fd349844093750ba2c85a89d5a4d5881824c1b17447d3bc14006c7acf4500be55ddb2f588df8fe7a
- TLSH T17090024520B083106D4D226E81A15E1E256A77B4B15659156667954084118185B7B091
- MD5 SHA1 SHA512 TLSH
net8.0-windows/Alarms/AV.MP3
- SHA256 727834c0a06e9cc2a2cc1cc5dfb7b3b8a8e62a2a0614d33cc39f0fc508702ea9
- MD5 7ef196db297971c97545ece6bf3957eb
- SHA1 de4ecddbdd348bd5040c2f33ca750c137fa2a123
- SHA512 e52ca9116decfa36214de1290a59fa0b1ef9ceef6ab264800876ecb54bb319dec4d3596f61ef9f1f84491591428b526a533f6037ebcfcf7516a5c4d981f97751
- SSDEEP 6144:4R5jWCp0Pqwkt+9io4GoPOQp5N7fr0rZQ5hdCTZOzXwOD7lXuBVvxXnL3:4RBUPqwktkiFXPOQF8yfdCNKS53T
- TLSH T1E6E42AA34F3006FEF0970ABC755FE575D1986D088645EDDF85A3E70A01BBDAA2372188
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/Alarms/Ghost143.m4a
- SHA256 40510f3e49ff638f188bbc63fec2e58ee3b55fe15260c2f9a56265ee084cef80
- MD5 527beb08b6be307d152dcc7e8ed498dd
- SHA1 d04110c2dc671b4e89bf311b1910a5358a28086b
- SHA512 6f6b4cddcd0fae02eb18092b2ce38f50b3bd3047b0315fd007b88c43579a8233e26aaced891615c8a1342291fef3cebff65e982c3aa6e6fd186d7fd7aba9aa65
- SSDEEP 3072:IxhYUz4+zAlPU4athNiI5y3OjuddA3qa4PwgWXtZaytbHbJ3:HJaGsUImkeG3cwtthbJ3
- TLSH T18FD3029BBB287B1BE998533FC5E3535237F189504758D69FD708188378340D26E93A8D
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/Alarms/GoonAV_Default_Alarm.mp3
- SHA256 06d0a525e612d1513a6f3b0a7baecb6fac8846b1580cb76d3d79ca0da1441e40
- MD5 239f57e13c693892b2447107febdccaf
- SHA1 ab4d6ca03e29f4853fb8f84595f0b7da37d3c473
- SHA512 d36fa6f6c6d0fa4c79d2593fbd3dda9521963e182b309494bea482d486ae08795beae4e4b216e99fe055f257aa6ab37f0f0f52e0a5ffb8908463960c54263d0a
- SSDEEP 3072:4CJGfGs1+BcCR+iqvOn3xsU/ov9b4pUHlhI2Q:21+BcCbOOh9/ovhfFhzQ
- TLSH T157C3129B4ED452FAC81103B5E4ABD244502B2F14171A09F5D3B6F3B2D533ABBB6CE0A4
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/Alarms/README.txt
- SHA256 b206ba34c2012434ce2165cf0c513d61a639f36408e30d876ec4bb56c58e34d3
- MD5 9ba82ebdda6a0af3fcc882fe6ef5b273
- SHA1 8bf0e1fa7df6fe14e47289b588cbccf62b53f1a5
- SHA512 de00d3a3eb65cb6e93c3845f84a327cec740dfc0268d9e11b9a27d05b623cb4540f7ccea9e38e266d6543f9f6974e47a0c997989d9fd69e3aeefcb07c74522e5
- TLSH T18FE02B2F31A4133611864193A79E28F3CD2B066CF9520E54C444502DA219561C2ADB8A
- MD5 SHA1 SHA512 TLSH
net8.0-windows/Alarms/Reveille Loud + FAST [Alarm ringtone for mobiles].mp3
- SHA256 4fb5acd80238db129ab8cc81b32ea745f2aa832544a36f835843c8fd0e131653
- MD5 475e24d5654d87e62b16b4f08288eb87
- SHA1 75f7d11335a0d07e27309342de145ded5073b815
- SHA512 70ffa0a66a6cff7ad1bda163936d9f899d76788479647f8c7d2b6fa6cc9f3c518fd2b76da0156277e6e3de7e6015f0cccd59505204dd5b51162d71b4abe36b79
- SSDEEP 12288:sZR8v8CJ3JCR363LVBPYw3zitA9RrnuFYgWuLf4JHGL834gXZp2W/tke8w1ieB+s:sZJCFMK3xNYwjPnuFJGJN34gXZp2AD59
- TLSH T118F4236B8B11B335F8EB43320FB6D296F6A39D21066901CDE728BB946177B473F06590
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/Assets/goonav.ico
- SHA256 afab4d662197fd1600bc8fd850369beb0b9dc9c4e9073465fee80b50e89a1780
- MD5 43da3479c2fee40413b9dcf4bc28311a
- SHA1 5c3436805072956e7a17304f33f1c2231e31724f
- SHA512 c439be0ea1816f6a0beaacf222185fe03c9c4ea11afe6472414c0620a57bfe4ea5ad53d7d23face519feb24d67bd8bea27d739068ca7e357781eb3605a9f0d7e
- SSDEEP 1536:UdKR+w0zFLBMDiwAhSHuEUxXq8VbBXlabPG+3D:s4X01Bfhuuhx68v1abPl
- TLSH T1EB7301DE9DB89FFC6182D67258C344E0A1E8432F58E18D8B15B073AE1E27915C8CE52F
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/Assets/goonav_shield.png
- SHA256 6891653de50f16e2ba1af59f48da68d9da282461ddf2d1c7bd18b68532df130c
- MD5 650922693652a379b0f0f263a332e6a8
- SHA1 92c94fc673e0dd50b26e5f6aceea37c319860d53
- SHA512 ee476ba17da5890f0a8d6900e0f85ed2cfff0ce45cacc6a1873ecc6da3c1f21e63bcface59eb62b1277f9c922e58e213aa645b3a96b1dfff609022d635f67eae
- SSDEEP 12288:Xh7bgdCWfJ7QRIqOMtLrc/v/WUIFuTH+pqe3U1THh8zhBobHfJLjk6aeppbyw3+u:Xh7xUJkyq1qv/pIFsHnt7h8zh6zBjBTT
- TLSH T1EEF433A0158DC185EC7F673C02F09DD68955A2B2D9921CEEAF3E94E04DBAC09754B0FE
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/Assets/goonav_wordmark.png
- SHA256 72c5be6a5ce2013b9a3a25f6fc29356b8966c26ef547d1db72e956506a60aee7
- MD5 ead50da89712193f6f644fc7d33bc359
- SHA1 d3d8f064017385ab06c5d6b922fe5419d4396e13
- SHA512 c92a6ec1cda449240d5dddcb525fcaa410c314b0930db73d909aba66244d400328568849447c7c14c8ca333e64df7f9c323a50c95bc5a5fcc254d0e73824b953
- SSDEEP 1536:aXMmEoViAE3Krgp3sET2gwrpACkHL/gcdeJU7Y0kwLOjskJsnZrZXR0jiV2mYcvB:a8m6MgxH6yCkcJU78AkJsnZ9XRL2mdq8
- TLSH T1A293012D88FAE125DC8745B1A2670F536BB32B2B57E16A15E3003E8D5C65CFE834463E
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/Assets/goonav_wordmark_original.png
- SHA256 a3b66acbe20affe73304f77f998c45dcaa7a2f01aadc72497f74a1b69cae87fc
- MD5 17959f66e1d9ad31ffa4ae99a6920ea1
- SHA1 f24c902a4036dcd97bb804866e4d8368fa223d96
- SHA512 3b541874c011387d108c03d2715b56b6d317be34a7b29b5fc0b0ed1d61bc1a6029873920a125e53f509f486244303775614873aa87f4132e61992d1f813153fd
- SSDEEP 3072:x5vKszttEOweibYzEhyJaSRdfHWJPTtcja3xqHa:x5vttEElhW/3xL
- TLSH T14BB3026D8A3BD7819F6F49346A4B2F13D593B4D284D4A132D6FE970DECF1E0E0982680
- MD5 SHA1 SHA512 SSDEEP TLSH
net8.0-windows/GoonAV.deps.json
- SHA256 5b23129f82791dc1d1786966ac8ffa11c313ccda0443b8a71691e8a22933065d
- MD5 7bcde6a007bc3c02462d798aaaf3e8fb
- SHA1 420d69803e07c78683bbb184beda21a6b7cfd9d3
- SHA512 df4629a920315e57de8d85903a5f80c91ba11a45af2e4e92b3082a19456585e82e4e7560762db03b5c6ef85e6add0b41b6d29656f5212805fabe9d046ecb0d61
- TLSH T1E7516825DA445DEB04B56BAA28348242F231937F50420D8FB9FD505CDF73E8BD264F2A
- MD5 SHA1 SHA512 TLSH
net8.0-windows/GoonAV.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3b65cbc1892a1e6a90a385a2325ee78d9f4551873286ddaad9f5f453613806f9
- MD5 556191b687527b8badd81f2f51ab74f0
- SHA1 5b294e5725ce4c75226537efb307936fa9aa73de
- SHA512 5bcfdbb68bc73f9cb3dcf6f3190351de382da71202d28c7e15fa515765018888a81e415c1942e64b1f176ba935550d7274671fa0f873248a99113c98cec8df17
- SSDEEP 6144:nMLVIqFFSqctQs0dBby6CcdcbvVWb3vobO:MLVIqFY0ZEMbgbO
- TLSH T1CA446C6022F84E2AE2FF5F7865B512244BF27D8FB936DB8C4D9020DE0971B41A925773
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
177698
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/GoonAV.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 96d47b985cb84d81cfe62dbbb974e2509718adee4cade88354f05baab9013ec2
- MD5 55ffabd814da733e5c0b0230e24a7cd8
- SHA1 13575df8cd08a113030d1ff8147f753007a568c4
- SHA512 ac1935350519aacd3465554f478ed4f70c50a751f2eb3b85763fd9bab7aa24f31ba23062f1b517efb7448944c0952b8a90a8f0d81a59b157397c1f1f6807b546
- SSDEEP 3072:KqeXA/4yIg9vkNPNu6H6xCYOiEUE265iJBaX01B3huuhx68v1abPc3:KvgvkNFNaxm0ECJBisDb3vob2
- TLSH T1CD348E07E6A851FDE1A2D679CD924D41FB72781A4BB1A7CF03504AB61F63BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
80KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
net8.0-windows/GoonAV.runtimeconfig.json
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
net8.0-windows/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c5f69a258fc609d42e6d50903e9b4449027f4d332faa8daec04bdc3cb9286d4b
- MD5 bfce986befff53f3270f1476bcb11c54
- SHA1 98f67b72cb9c3943c390ca2c00addfe291f1c25b
- SHA512 8e4a59352284f2fa15b6aa7e3af26314569f70245ab7fd3e347b299719f62fbca712b214e2955f1c50ad80d7e0136f08b3230f7f25f462da0e2b16dfdc956b05
- SSDEEP 768:xtppppIpppp4ppppXSsZPk7kUTAvA3DZUm8CT/1dB8eVE9hoQD1kiSLJKdbYx6/H:xhPknOHCT9xK2QD1xS9ycxyiKzR
- TLSH T15F63A411E7E883FCC9E70671B4F287710E74BAC52D21EE5D2E1A2219286BFC05761E76
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b8:96:b4:54:f5:5f:55:38:b2:6f:02:28:c9:f8:a9:f7:3d:7e:2b:9c:c0:7d:8c:3d:6f:f0:8e:5d:e5:99:31:ed
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 31, 2023
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d3:1d:32:9a:17:3b:40:30:73:00:01:00:00:01:d3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
67318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
net8.0-windows/runtimes/win/lib/net8.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b2d6e7e991dc9ef154b29f4966f04fd8ed4ebb2c1d1242ea1d5f3e90f8ae5143
- MD5 e1422b4c04b923dcfe00a55290dc18a6
- SHA1 0609ecde6bc8a87f88bc32b98d19800ff19529b6
- SHA512 297f54fceeb0cde17745323e7c41fea830a376fe9c3cf92a692c48199c0a05f1533a3045fd9c6d21352d084aa9ccec7b6cf630c7df49b52ed4025ae156509a7c
- SSDEEP 6144:9q4+FutZbJcMFEG3LbPhmlmsUwHdYhJkXUXewcn:j+FutZbJcMFEG3/KmFwHdKIUXmn
- TLSH T19764386033F84645E1BF4BB6A0711491CFB2B72B6A0EDB6C0D617CAD18B175186A733B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
49:77:8d:dc:15:13:5f:8d:f7:74:af:cd:a0:90:66:08:03:f3:bf:ee:4b:1b:24:2b:69:b4:8c:4e:9f:11:64:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 31, 2023
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b7:21:27:1a:07:a2:2a:86:46:00:01:00:00:01:b7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
306366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
291KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ