quasar | Windows Security Health Service[.]exe

resource	yara_rule
static1/unpack001/pulsar.common.dll	pulsarat_module

resource	yara_rule
sample	family_quasar

resource
Windows Security Health Service.exe
unpack001/aforge.dll
unpack001/aforge.video.directshow.dll
unpack001/aforge.video.dll
unpack001/gma.system.mousekeyhook.dll
unpack001/naudio.core.dll
unpack001/naudio.wasapi.dll
unpack001/naudio.winforms.dll
unpack001/naudio.winmm.dll
unpack001/protobuf-net.core.dll
unpack001/protobuf-net.dll
unpack001/pulsar.common.dll
unpack001/sharpdx.d3dcompiler.dll
unpack001/sharpdx.direct2d1.dll
unpack001/sharpdx.direct3d11.dll
unpack001/sharpdx.dll
unpack001/sharpdx.dxgi.dll
unpack001/sharpdx.mathematics.dll

Windows Security Health Service.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6cce95ac0f8bb78b51231045897b8cc751b8749e776c99b1dbf61cde5bb684c1
MD5 052a9eafed81cc8877b32c6564aa8c4e
SHA1 d903112973b8959936e1cac8ba26e6338345c1a8
SHA512 9d165e173d51396cc61a59a72a4d12a69d6fecf884cba51595f223ceca48dee1e2505b1822258be4fbb252210c257ae03df945b4219fdb3ea4514b0ffb81646b
SSDEEP 49152:TPu6NLixi8/N+ZZXZQOLHM7wRPirm2NnPTKKm77LrwCB6uanP:7u6t0i8VIxpL7oZNn2Km77LrwkFWP
TLSH
T170C50110B3F9410AF3BF5BB9ABB6148D1B77B903DA79D39E1848409E0EA33509E51763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2722158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aforge.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Core\obj\Release\AForge.pdb

aforge.video.directshow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

67246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb

aforge.video.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb

gma.system.mousekeyhook.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9736bed57d137a0bd4a454a70436020312db5a365bdd243037e766695c18ccd
MD5 41b34eab1585d5381c56730b93dd1310
SHA1 510b640517342dbcc40c81b63db23fa1444a71ed
SHA512 14abe45c04c9620a0f1c4a5ea3882f8388d0d73f497b84020033ce9d3f8d49922694580aedea5e75652101df3c98818f3ebc4ce2865d75e77fdaf3b18b3c354a
SSDEEP 768:I/t9KqM6Un424sqnGxnRLTxT2Wjq7oEs+DfQ9n5xXK:Ilgl6a424sHXv93ji/siY9ni
TLSH
T169436B24835C0337CBDD8B3FA476412A87B1D7863953EBB7AB9881F02867B541929377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

52854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

naudio.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
MD5 48867f392b8e77dc06c062638c6fbd36
SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
TLSH
T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

190890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb

naudio.wasapi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
MD5 278ebb79da14ecf8e0559530c2fda076
SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
TLSH
T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

185178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb

naudio.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
MD5 be8205f435b2afbfd178960c46310c17
SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
TLSH
T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

46878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb

naudio.winmm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
MD5 faf1ba532964984a34d60674fbc7a5a7
SHA1 0999178949de510a47d87de3b8a117a003c572ee
SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
TLSH
T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

63254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb

protobuf-net.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5012d7cab74e4d5bd9fdd298d05ae5d51442e66d426e5859beb9a513ad1acae4
MD5 79331ea5a83291a3f45014f126c5176f
SHA1 d60daf9acaacbeb3def349c76f236df1460a4797
SHA512 dc6803cc2dd7cf86b0c7ff131209581134972e8287d2034211dfeb72ac741c9d129a6e3d3bf7ad2cb92c8b0ff69e8b5abffe1354b4aaa280da256e95b069b443
SSDEEP 6144:3uNYIR61/C7ghM9neG22dS6/ypOl20i3gFHZzZ9:5IRPh9wt+5z
TLSH
T169544D141BDC8E25C8FE6DB478B085CD1BFDE602F49BD785609492F7A8C23D64A206BD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

294926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

protobuf-net.Core.pdb

protobuf-net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ceed689891874eed41295189b2db3c187aabcfc90add5a1d2af96f078bcb4811
MD5 026a5bafe4ac686c01e9d56e00a87ab1
SHA1 a6ff2228e8114a2b4040d0ca137c4b544ff034f4
SHA512 7ae831e71f986eb35b562229810af089515f1843fa26d3115d4e0f1ea8dedb5eb9a966d45b76a582b2e0d547ce842d159c7a2f1c9dfb62a5033b2743e865ee22
SSDEEP 6144:JNGRjpUTk2EHDKvNvDMYRckrywJFKkMR:mRjnDODMiywJFKkMR
TLSH
T1AC446B2463EC4A26E6BF6E35B874908046F6FD1BF8A6F78D8D4095FD1C52B805E107A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

283130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

protobuf-net.pdb

pulsar.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 664010a92d91b81a36777b617d40d15e7b05d3cdbe796c0d95131eef3f3fcfe4
MD5 8d08ec80b7d5fa3fc342cde3573b7919
SHA1 0a09b7af99ebf865b6edd3796a26d89352976b5a
SHA512 ea751ccf0c3371d01471e64dd16dba1476ee224bafdd6901e8c14a4134e1fbd3cd173b3a061c1796f4a435391b6d2651c5769126e13592fd67c82e60a4c08b8d
SSDEEP 1536:e1ivjrJmTgz8N0Jh824GpBlRvXVKr5m0kR1mN7aDFfT7sUHrU2:epTa8N0AOvltVcfAQcxnsT2
TLSH
T16093C35053A8836EC6DD0B39F0A646F6CF71A50870D0E6B6CF42F8D93D17782694A9F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

PulsaRAT library module

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

101526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

sharpdx.d3dcompiler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 268b44a78354f7a225e5b1567223179c7b73453c0a27eb4bf18bb57d7a8e08d9
MD5 66aeaaba0629daf8544afc8008079386
SHA1 1e09e5d24e1aa3d1700b265c6ff94b7524813f4d
SHA512 dd2cd1df484600e6cc3e686e64559c3447f255f723b5f57cd51f76a838a79416bf68b7a7b380467bce172fc3ec868eb54a0d754108926782d31bb0cbd66f5a54
SSDEEP 768:VbFZAPoGIjmU9ZMPVNOhTJCj+775suxTvJREFhtK4shNeYJub4h8ZGdwv1PmQYEQ:Vm9SXGunREFhtKhNeA+4h8Md81VYExO
TLSH
T1E4434D21E7486256F68E0BFDB0264F064331F2467417E78BB9CC98E52D97354EB1A3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

64302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.D3DCompiler.pdb

sharpdx.d3dcompiler.pdb

SHA256 226f82b448c2f8700ca5c9f3658a0808a251f98d8543753e6231bc41b2a2053c
MD5 3c7ce2802daee6dba9e39970995c4069
SHA1 4fb7a312cc269cb44487b0fee6b94695024a6b0b
SHA512 203b5f374ae63ad4f9a3f926d8d0afd351f2886d6b3a1ff6d0356c080980e850b9934b875b34accab8eb0382a69b168c3497484bd2ce9f2f4b23b5230d751ac6
SSDEEP 384:OXwP73y8HB6AreJkS9RBbwX/QreSLG1UI43I6Y3Ix:OXmyiB6hkSVsoFI60Ix
TLSH
T1ABA29415E3E0AD3DDB833A3760636327837DD04886CB8F0712ECD7BABD997044666A59
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.direct2d1.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f4b5e240cb42ce903082f81633bba0c781c1e684fd5903bc3915e3805b5e83e
MD5 b992dfabf27b4c32c57d5cc2960cd8e3
SHA1 b012190d4cefbca3c63218f8fcd6e7211de40913
SHA512 f6d86cb73cb44c2d0ced4585f628f953ff604adde07da724f64122c6d07536985c4052a4aadfabee69f16a47797ef87f48e46eb5ff9601d0d3564aa4979f9467
SSDEEP 6144:90MJT4AfGTJX022MfHZJo/AuiEqQvWW9mArUXCxfBRh2O4OFr77:l4BJECZSxBW6mvS7RhQ8r
TLSH
T1B8B44B1127D84B2BD98D5EF7D171861892F8D10BB227EB4B398691794DC33214E0EBEE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

500894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct2D1.pdb

sharpdx.direct2d1.pdb

SHA256 c85d2fd579c5ddc47d6c7f9a399558931447c66cc878218fdf78708103a4c5ab
MD5 b7e9ec399d002f3c92a80d73296b8fee
SHA1 44e30b6f808b43a07716f804cf694f95ebeeaac5
SHA512 68222884e0dd0b4d9552717efa64ddbcaad8f12c83f8bf6e32f6b2d2699021ec73f005c21a981857a723f862aac58e09ba819958a3736a45c75930011158af30
SSDEEP 3072:DSaGja/imizEYq7wlvNqrrFdnW7SXuIC8MsjjHtZRRftTFZ2aOO:x6ev4EYq7SvNqVdncIC8Ms7RjTFZrL
TLSH
T1E824D70AEA58831DCB368A3515A7D2162370D288DC4FDB4FB6ECA7391C5B78A04B357D
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.direct3d11.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 56f525e33494f4cd2a560a71cdf237303a3fb54a8fa44e1693eba35c9245c60a
MD5 07137e5cc4d5ecc95ca267c9dce042d4
SHA1 d82f5e3d718bc9172fcfe0e8c50cb20251762058
SHA512 9d1d6eb2887653260b62a24d3ab2c358bf15b89f68a1a3a1104f1eb5362725eb535218b9a53211f9cdb67d7793ce346c520a289d66c3edf786b0da5db7c39f0c
SSDEEP 3072:zTlyoOCGOd8DxSEjnhkHTI4A2j4xBJz+gM5w9HDAVvbLvm5KhgeeCjDrgvmjG0Wz:N3n2lB+xQyUeklXAknj1ur
TLSH
T16254F911EA084E8BC98E55FEBC12F90782F98C15004AF7A7E84DC59B1ED23D9D91E7C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

288270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct3D11.pdb

sharpdx.direct3d11.pdb

SHA256 bba95514fb062788c9aec9cd7bc553cf47843c42ca5eb572814ff4b7c82ce7fd
MD5 1600d8adb3e99f85c1e9719e59828559
SHA1 a2259a45ea284247b3aa65ec9c1dbebd47fe208f
SHA512 dd967ab0f86d77fef2e09830c00f318020b519205dd6f8be70fb5d07fd5f6b988ace83487b56ee49973216b385dcaf802408223aa0fd6d9f6203dac6066bcc00
SSDEEP 1536:CpHzmX5+N9aIcSyP6JFzIocUNX290MKc7P9tOaZQTZH:CpyTmyiJFzvNX29frPaTZH
TLSH
T16173E90BEA84AF2ADF574D30586391067374A148DB8FDF47A6DCA33B9C9B794486390C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a0af255ea4b09a8cdb995b8c6fd1075e46f098e23c2351c974e6ded9b8b620cf
MD5 c52a44933d17d576d4c97b4cb0545841
SHA1 092696fdcc034910aa02c94a5c93f4e1e86e0c50
SHA512 8273ddb86a54c4834d469bbc856d1793c86f2577e21411f30083d4e597427170fd9ca38da2e86f081d284043d5ea4a6d3330037eededd17e37aa885927d0a76d
SSDEEP 6144:IyfsmUCs3Zchh2UBSFKu033XbEUsHBEAT0C:Iy7UCs3Z22UXuwbkHBX
TLSH
T118446D36FF0C1A93CD8E46BAAD63951303B098102552D64FB944A6AD2DCF7847F267E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

280462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.pdb

sharpdx.dxgi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bc0243134c93c55ea105d0e9c2a43b6030e973290d0a061cf3a61986a2268a88
MD5 d2edde626c241549eab636aa87fb5d38
SHA1 8d836febd477b3ec44cc37f4f0aecdaa1d7db788
SHA512 490878e20ed764e81e42b8f43faf2adc0810dcd2f65d36f6d6980411617fae9543f0d7b6f110e5363be494097ba3b30dcf3695aea41314fbe19c6a59a55538d1
SSDEEP 1536:x/xP0dmNHRIfvXyTjUxk0+8shTbRqpzMA1JhkrIAcFpZMD9hVRg5bT+02nBJdbea:x/OSSfP60kpVxbUuZKq/4qaTXc
TLSH
T1CDE321826D7483B4E9CF7FBEE695B92A5523F1110481B64612E27A004BC52438F9FFDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

153678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.DXGI.pdb

sharpdx.dxgi.pdb

SHA256 adc6991011da455e001f537db1970b2208d960ba7e66d4d4a534d293235b4463
MD5 44e3cf00d4eda7f4aa38044d578aa537
SHA1 d73e59804e3ee494a4612185771f7f67b2fd64ae
SHA512 b83080b7968e5b32dd7b1be70eb7f9bde797de248a5b4c5c94eea6ec0342ad8fa78b4ff46e63835edca340c3f3b254044f0348bc84f728edd37db1ec223030dd
SSDEEP 384:JNne+E628lTYV+5Puni3MKW6kqQ9aRrwytEc8nl0FXGwxXl3kKjF2kCkB72KRleh:je+E628lv5Gi3MKWNqR928ksF2t4lg
TLSH
T151F2604AEFA4931EC3239B7594A3A32303749149CFDB471B13DDB7296C4A3E84DA295C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.mathematics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4c9615496970ea84320e2a6e99f8fb828e3c7790384df5585d93fc368885d94e
MD5 50e6524b7ee9c2c93f5210b63cb1ca54
SHA1 3e296ec3bb24750833ea80515e6fb4c73874c91a
SHA512 f9d3b296e14d72f4bff727acfdcfb520ae1436ba5ded03be04a559f493d4a8f9f915c0a2f498214309d0b84d6b3ae29750186615ae3250ad218aeb09dd7175ab
SSDEEP 3072:BW+i1u3AZ2YRCPJ4e3qHKSOZ53ZSOUE5Cgil7MEcR5hpGO5wZ+iEZUn1Bt+ZknSB:BdAZDCziyEs5Pib+ZknSTpc
TLSH
T14324E75CCFEB4576CBAACAF9F01D0EDB67295158122FEF1AB19894FA0803369D1012D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

221054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Mathematics.pdb

sharpdx.mathematics.pdb

SHA256 ca3492f46e271c70182d04783b4731c6a6ead3659ffa22ec02a758b3905e8508
MD5 2056464074215066d3d06abbba1a0519
SHA1 c2d459a790cb21aa1c8fa92f55b96804aefb78aa
SHA512 eedef1f1dcead2f15928d24028c62b518f7f6b89a4e739b64c3c1fae0b1123dc9c1a6ce024187cf2656cf5620ca670858435ab6d9c34ef9a99e283b1c14bcdf9
SSDEEP 1536:1ernxRpKZkJklUHHIWNVXVxYGGGGGGGjQYXHEmM7F7MlXZE747fBL/zdx:cbKK1NVXJTXkt7F78e747fBLJx
TLSH
T179938327CA888606CD06A9778972072533B9D0A8974D9F4663DDF379FCA3B50A9D334C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.pdb

SHA256 4109cfff6e17d9bd2efdc7fd52a4f544b5c66c9743c9e8ccf7d8a2f6cfc23eb7
MD5 2883c3a35927e62ebe1871c130e93f31
SHA1 1a7c10aa582cceebffd9bc77a11353aaae6417e9
SHA512 9bc6cdae59163756f9110867353e513cf53003a2c171e9458d920d83a8d025ab9dcffc3278309223e9ba257b88cdb3f7f5c23ba78bb8ca4168b74f91dace8658
SSDEEP 768:wIla9Y6ZBiygU1v+cALYbshPln6wWxwAU/fHKcnLQ8:CO0zWcQEIlnxF66
TLSH
T10213C506D9A68B2BCA56163E4F3347155B30E28CEA06CB0713EDF7B5AC5BB040DA356C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.collections.immutable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d168af8e4a1263b5844180b1b371c5879b21b5b666feef7ca749b10192688006
MD5 7b2a749a73990140bb21395e2c786f0c
SHA1 2f1ebb67e21b33c74c4c6cf217ac1f797959f18b
SHA512 aefaa2ea20766775581da160291c234f5aef3a81a356ece2af4051f6c453c213cde2ebcae1986f9ca113d27aced45e50237fde3e1af8b2a1537e2098cb65abd4
SSDEEP 3072:EWXnUaec5PO4MJJEUjYeasDs4fGBvSj2bgtZV1HJ7IMt7RMjODTAkzcKb:EWEaVPO4gJNSsDsowvSj2bgtn1CXDkA2
TLSH
T183142900B38C5B33CEBF5DB3B962949B4A32C647A196F79E60DDFBB440833648C94529
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

6f:82:f5:ad:ca:82:31:07:87:f6:40:56:2c:9e:58:31:13:9e:24:b2:bc:cb:74:25:83:ec:34:2b:88:de:1f:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

192858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Collections.Immutable/Release/net462/System.Collections.Immutable.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 8, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

136114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload

Digest

e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Windows Security Health Service.exe

mscoree

dotnet

aforge.dll

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

gma.system.mousekeyhook.dll

mscoree

dotnet

naudio.core.dll

mscoree

dotnet

naudio.wasapi.dll

mscoree

dotnet

naudio.winforms.dll

mscoree

dotnet

naudio.winmm.dll

mscoree

dotnet

protobuf-net.core.dll

mscoree

dotnet

protobuf-net.dll

mscoree

dotnet

pulsar.common.dll

mscoree

dotnet

sharpdx.d3dcompiler.dll

mscoree

dotnet

sharpdx.d3dcompiler.pdb

sharpdx.direct2d1.dll

mscoree

dotnet

sharpdx.direct2d1.pdb

sharpdx.direct3d11.dll

mscoree

dotnet

sharpdx.direct3d11.pdb

sharpdx.dll

mscoree

dotnet

sharpdx.dxgi.dll

mscoree

dotnet

sharpdx.dxgi.pdb

sharpdx.mathematics.dll

mscoree

dotnet

sharpdx.mathematics.pdb

sharpdx.pdb

system.buffers.dll

mscoree

dotnet

system.collections.immutable.dll

mscoree

dotnet

system.memory.dll

mscoree

dotnet

system.numerics.vectors.dll

PE Signature issue

mscoree

dotnet

system.runtime.compilerservices.unsafe.dll