MCDownloader.zip
- SHA256 04846a6858bd95adbde295dfe103b83b3d9840a33104ddb06ac5b6b059dbf04f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MCDownloader/MCDownloader.exe
Resource
win11-20260911-en
windows11-21h2-x64
14 signatures
900 seconds
Behavioral task
behavioral2
Sample
MCDownloader/Newtonsoft.Json.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
MCDownloader/WUTokenHelper.dll
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
General
- Target MCDownloader.zip
- Size 298KB
- Sample260929-z5hycasbme
- SHA256 04846a6858bd95adbde295dfe103b83b3d9840a33104ddb06ac5b6b059dbf04f
- MD5 80b4225554b102e33a8ccd746a7ef1ec
- SHA1 071039c50bd215093fc2e9cff48aba530e71b053
- SHA512 a048fe3f3f7a23efee06b13d4189a8e39941f1c90339c196b1cf11c04f185efd2c48bb273dc4d16a22cd67eece5a367623df465a450c856e586fbe245450c7de
- SSDEEP 6144:5N5XYJ9nIwEAA4XXUzmJ5B1iZ5G2r1Npv/xYizPso8p2MQPusS3gS6:VILjAMwOiZ5G41vv/xYgPsB2MsubD6
- TLSH T180542395F2433DD1CBE690B46F8BC8F931678BA229B7818E776941C0DF6B2B0853D512
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/MCDownloader/MCDownloader.exe unpack001/MCDownloader/WUTokenHelper.dll
File Explorer
-
MCDownloader.zip.zip 298KB
-
MCDownloader/MCDownloader.exe.exe 54KB
-
MCDownloader/Newtonsoft.Json.dll.dll 695KB
-
MCDownloader/WUTokenHelper.dll.dll 36KB
MCDownloader/MCDownloader.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7f0d469c107d695cf9d106ae61c5b7c5c0b4d6809fca1f5e209e3d8af91abae3
- MD5 753968f95398e79c0b530f46793d77cb
- SHA1 1daa304ea88b91365d456f358e64d9a165a275bc
- SHA512 7806ad07adb5c183bc0911f27c33c1ac267ef3025534c8a5d5a180c95506cea722ba90edffa134ed3284d64dc578ba6d7c0f509c4dababfaff2e2ca6b6d47794
- SSDEEP 1536:v2VZ55+w0n6GA0Ox6pQ+Mpx5HbTTgxVcl:v2VX0wxGA0OwpQ+gzgbY
- TLSH T186433A0533EC8226E6FB0B7DA47902504B72BE47B412E79E289C60CD2FB27518D66777
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
58054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\edshh\source\repos\mc-w10-downloader\MCLauncher\obj\Release\MCDownloader.pdb
mscoree
_CorExeMain
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MCDownloader/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
704578
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
680KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MCDownloader/WUTokenHelper.dll
- IMPHASH e7dcda8b49c601567cff5a8685df8fd0
- SHA256 32a940f209c3956e9f50d33bf69c6cf18bd2995f59869ff4cf6ddbb639911fcd
- MD5 152695e963900f04fd74df5b9a7c379e
- SHA1 d7b112b00fd344c77b1a5b3171333f4b570841c4
- SHA512 2895aaa5139d16b14ec787eb75941eb4d9a8dea10d7f1a9d4201b5f3f3d6919905d2b9338f88568824cbb4e87589c5b49a7c112c84860b921b4ed93247be0714
- SSDEEP 768:ZEE4ESqfesOISFZLGyozr+pi6AfejMoApsl02A+YCCE:ZzhHIIMozr+pi6AfejMoApsl02A+YCC
- TLSH T174F21A91B7F507A4E86BC23CCD671B1DC931B866472182CB1322032F1E367D29EBE985
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
15084
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\edshh\source\repos\mc-w10-downloader\x64\Release\WUTokenHelper.pdb
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
memset
__std_exception_destroy
__std_exception_copy
__std_type_info_destroy_list
memcpy
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_cexit
terminate
_execute_onexit_table
_register_onexit_function
_initterm
_initterm_e
_crt_atexit
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfwprintf
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
kernel32
GetModuleHandleW
GetProcAddress
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
RtlLookupFunctionEntry
RtlVirtualUnwind
WakeConditionVariable
SleepConditionVariableSRW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InterlockedPushEntrySList
UnhandledExceptionFilter
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
RtlCaptureContext
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
oleaut32
SysFreeString
api-ms-win-core-winrt-error-l1-1-0
GetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
WindowsGetStringLen
WindowsDeleteString
WindowsGetStringRawBuffer
GetWUToken
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
208B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=257, version=31823,
count=8, id=260, version=31823,
count=3, id=259, version=31823,
count=22, id=261, version=31823,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26715,
count=77, id=1, productName=Unmarked objects,
count=2, id=265, version=31937,
count=1, id=256, version=31937,
count=1, id=255, version=31937,
count=1, id=258, version=31937,