MatrixTweak.rar
- SHA256 0d625c40efa527a5b31e4b37bb23aa18a9c4416ab779e52f09050ffd758a9129
Static task
static1
2 signatures
General
- Target MatrixTweak.rar
- Size 84KB
- Sample260925-pvfp5asthy
- SHA256 0d625c40efa527a5b31e4b37bb23aa18a9c4416ab779e52f09050ffd758a9129
- MD5 05cb8562374b9b0b052063c1e32e1838
- SHA1 bf078d4ef039209709d234314dbadc75d31bccef
- SHA512 8aa724bbef025c2bd90e139491b55331cb94c521aac0dfa2534478cfc33604d31a6c37437100201b9bda6edc1139c6020c129e32f7ad2470223f91982ff4b9a2
- SSDEEP 1536:1H7TADvWlKlc7Ps23psF5zUh8JjyaifhTuwE5r0tIweMiGEli618fun:1HnADvKK27KRpyzJTO5YHElie8fun
- TLSH T1108302CE62273ECE0B081BC640795D68D26F52AF4124CDAC032E7B565F59CAFDB148E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/MatrixTweak/MatrixTweak.exe disable_win_def - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MatrixTweak/MatrixTweak.exe
File Explorer
-
MatrixTweak.rar.rar 84KB
-
MatrixTweak/MatrixTweak.exe.exe 320KB
-
MatrixTweak/MatrixTweak.exe.config.xml 174B
-
MatrixTweak/MatrixTweak.pdb14KB
-
MatrixTweak/System.CodeDom.dll.dll 30KB
-
MatrixTweak/System.Drawing.Common.dll.dll 48KB
MatrixTweak/MatrixTweak.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0839ac9122bb64d8f9356414693f92d048b03f6106371620f8b6b10493ee0142
- MD5 d59148e5aed8b5dfb2807621a89be21b
- SHA1 6588c2f420ee8a52bb84cedbdab09ea45a1f7971
- SHA512 d77fd9bc16efd8a003e775459a4473f511b843e62e9d08a1eb4e15135fd13ccb41537141c1ec7060521f2ab4b8fe744b8f78a50d428c71b7f31bb2b982b59456
- SSDEEP 3072:uh0QOVbCaa1UIc4edOWy3yuDoosDJircy0cRHPHurM/AN7u:uh0QOVbG6uDfv
- TLSH T1B56401406BEC2504F6FB6B686EBD9545493BBC926D7AC20D01AD884E1BB3E50CCB1737
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
323902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\3lisenpai\Desktop\OPSzFreeTweaks\obj\Release\net48\OPSzFreeTweaks.pdb
mscoree
_CorExeMain
Name
.text
Size
308KB
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MatrixTweak/MatrixTweak.exe.config
- SHA256 051099983b896673909e01a1f631b6652abb88da95c9f06f3efef4be033091fa
- MD5 2a2df45a07478a1c77d5834c21f3d7fd
- SHA1 f949e331f0d75ba38d33a072f74e2327c870d916
- SHA512 1a6dd48f92ea6b68ee23b86ba297cd1559f795946ecda17ade68aea3dda188869bba380e3ea3472e08993f4ae574c528b34c3e25503ee6119fd4f998835e09d7
- TLSH T101C08C1940E8BD278D328F27A352C926EBB0B2A6A064080CF02FA9670B3108D8247326
- MD5 SHA1 SHA512 TLSH
MatrixTweak/MatrixTweak.pdb
- SHA256 b73ea79080fb1ff0da4f047efe66bdf50558b17a5f59641ab638e844ce1eaa35
- MD5 6bcd21945010c4d842ae1eb5aa72a5a9
- SHA1 7850272a2e123a8ecfa62d6f3ae08a5280f6123b
- SHA512 f34b4f8ca878001f2ebe433e4d5a6a7d9c0fed729235820ea3c51a20e8ffa39804c05ac5e4202ea826c96d131ac0b345697c97b24755a4d2974cb2e04cac30aa
- SSDEEP 384:easvevjGpc9MDxTAqWlDWd3JGRNZIUA9RS7KJ8ZZfJwFzCXrl+Z:hsvevlMDlAtlDWd3JGRNZIUA9RS7K67M
- TLSH T17E62EF57A14CD726CD47333AD0F153A0773E835CEB254A716EE46BA9282BF10C9B2A71
- MD5 SHA1 SHA512 SSDEEP TLSH
MatrixTweak/System.CodeDom.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e8c88b0448083663910587efeacb6a1977749fe3ffe83b263fc01f7b63d7dfd2
- MD5 59c830ac0d99f8c906292de85f804b84
- SHA1 68b6740e6ce97de8b1398f3a6e320940a0e16458
- SHA512 4028fa6b68eb3a48bb9625e6755c8e3022283694bb603905af3db54c31bc2f7291aec11f7c42a033703f84c3ff265a19416eb8798058cc42ee3c14c633e9588f
- SSDEEP 384:FuE8ujCiLMTPji3h8241EEqYC0iIcwBxehzsCtZ7U6r1fDMqyt5/WduWTTb2HRNq:FDBCi4TWaveEqYChzZpgRoj/iP9zgBV
- TLSH T1AED22A6262E84A7AEEFB0B7475B7C1D21FF5B2D32825C71E1548A0091AD2FD05632B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
87:e1:77:0b:a1:e0:aa:d7:46:49:65:d7:07:3c:14:3f:a3:84:a8:14:c6:a8:32:6f:ce:06:e0:61:56:a3:c7:e7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 31, 2023
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8900-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:d3:1d:32:9a:17:3b:40:30:73:00:01:00:00:01:d3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
25326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.CodeDom/Release/net462/System.CodeDom.pdb
mscoree
_CorDllMain
Name
.text
Size
17KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MatrixTweak/System.Drawing.Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a71f27372a855b0f0f2be71620a864786d09a62ccb5b684d0116da783ad694f6
- MD5 ad511a236423b41d3d1971f7a4fc0750
- SHA1 c90a484298ed989620eab3dcb32a0f7529c89d66
- SHA512 39eb0300116a6210ddf959a28ba4b6e028da003dc53495f8be5ec09c83418094e666150bbe4797860307c7cf3a1952575f125ebdc3bfd61514c2e6a2cccd3257
- SSDEEP 1536:3C+Pt9htfRYME5O/QKzLHRgkXeC8SwRdkis5hzUZ:3PhtfR5E5O/QKz7RaCWdAhYZ
- TLSH T19D23E702B3FC460DFAF70BB079BA85155FBF7BE22A62C79D1414400D25A2F9495B2B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9e:d5:85:b7:ef:d1:08:d4:10:c7:92:36:b2:98:95:c0:a2:72:70:9f:57:6c:a0:90:58:2e:6c:0b:07:f0:1f:eb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 31, 2023
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b3:fe:25:ce:29:1b:1b:8a:1c:00:01:00:00:01:b3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
44930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Drawing.Common/Release/net462/System.Drawing.Common.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ