New folder (4).zip
- SHA256 6e0b67dc7bd341b7bad498566af86df0bc6ad4d75245df7e4c009d90c2d91211
Overview
overview
3Static
static
3New folder (4).zip
windows10-2004-x64
1New folder (4).zip
windows11-ltsc_2024-x64
1New folder...AT.exe
windows10-2004-x64
1New folder...AT.exe
windows11-ltsc_2024-x64
1bouncycast...to.dll
windows10-2004-x64
1bouncycast...to.dll
windows11-ltsc_2024-x64
1cgeoip.dll
windows10-2004-x64
1cgeoip.dll
windows11-ltsc_2024-x64
1costura.dll
windows10-2004-x64
1costura.dll
windows11-ltsc_2024-x64
1dnlib.dll
windows10-2004-x64
1dnlib.dll
windows11-ltsc_2024-x64
1fastcolore...ox.dll
windows10-2004-x64
1fastcolore...ox.dll
windows11-ltsc_2024-x64
1iconextractor.dll
windows10-2004-x64
1iconextractor.dll
windows11-ltsc_2024-x64
1vestris.re...ib.dll
windows10-2004-x64
1vestris.re...ib.dll
windows11-ltsc_2024-x64
1New folder...xe.xml
windows10-2004-x64
3New folder...xe.xml
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New folder (4).zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
New folder (4).zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
New folder (4)/AsyncRAT.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
New folder (4)/AsyncRAT.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
bouncycastle.crypto.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
bouncycastle.crypto.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
cgeoip.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
cgeoip.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
costura.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
costura.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
dnlib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
dnlib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
fastcoloredtextbox.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
fastcoloredtextbox.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
iconextractor.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
iconextractor.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
vestris.resourcelib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
vestris.resourcelib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
New folder (4)/AsyncRAT.exe.xml
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
New folder (4)/AsyncRAT.exe.xml
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target New folder (4).zip
- Size 4.5MB
- Sample260930-2hecra1yhs
- SHA256 6e0b67dc7bd341b7bad498566af86df0bc6ad4d75245df7e4c009d90c2d91211
- MD5 315384853141b0163d29db718b8d9662
- SHA1 d872cd36d5daa2ac3878497ce12c301233ca9d23
- SHA512 e0554fcdb3f659e18abef43adfb19fb0789f2ded249b48c7112f1e1f92bb313b38bcef8ac713ba2ba87fca135364a4682b4a46e2a34c2793ca03e8c757c4c01f
- SSDEEP 98304:jK8ZB9hnk5881wmNB1YuM4KyLq/K0usM+Wx9C:jxhMImDM+Lqi0usTCC
- TLSH T1C02633D6549C604F487B087285C64134FD9B8C7CA10F839CD28BEABD5DB891D62BFB68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/New folder (4)/AsyncRAT.exe unpack002/bouncycastle.crypto.dll unpack002/cgeoip.dll unpack002/costura.dll unpack002/dnlib.dll unpack002/fastcoloredtextbox.dll unpack002/iconextractor.dll unpack002/vestris.resourcelib.dll
File Explorer
-
New folder (4).zip.zip 4.5MB
-
New folder (4)/AsyncRAT.exe.exe 6.4MB
-
bouncycastle.crypto.dll.dll 2.5MB
-
cgeoip.dll.dll 2.3MB
-
costura.dll.dll 4KB
-
dnlib.dll.dll 1.1MB
-
fastcoloredtextbox.dll.dll 323KB
-
iconextractor.dll.dll 10KB
-
vestris.resourcelib.dll.dll 76KB
-
New folder (4)/AsyncRAT.exe.config.xml 5KB
New folder (4)/AsyncRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 06899071233d61009a64c726a4523aa13d81c2517a0486cc99ac5931837008e5
- MD5 97a429c4b6a2cb95ece0ddb24c3c2152
- SHA1 6fcc26793dd474c0c7113b3360ff29240d9a9020
- SHA512 524a63f39e472bd052a258a313ff4f2005041b31f11da4774d3d97f72773f3edb40df316fa9cc2a0f51ea5d8ac404cfdd486bab6718bae60f0d860e98e533f89
- SSDEEP 98304:+bPmDVa3VxobFwUN5xXhAqin1MNuSZTKA0t9FFPEG6xJJ33Je2PsBpCz6Ry:+7aIXUN5htin2bk9fcPHJDE7Cz60
- TLSH T1D166BE32B5E08268F062C874F09176B5EE723C764F28F9C7CD44BA692E376A58535F21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6681982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bouncycastle.crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
- MD5 f0b3e112ce4807a28e2b5d66a840ed7f
- SHA1 54a6743781fd4ceb720331fce92f16186931192d
- SHA512 dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190
- SSDEEP 49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr
- TLSH T132C53A1877F40613D6BAE7B595F09021A3F0F46EB393FB0B6591A7B50C13BA24C816A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2603454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
cgeoip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- MD5 6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1 b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA512 35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP 24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
- TLSH T1A2B53982AE8940DA343438DB75A15FAC49149FBD7F112F3D31A937886DF530A788EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2411650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
- MD5 d075a47a551e53e27889f83670a581e1
- SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
- SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
- TLSH T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\costura\Costura\obj\Release\net40\Costura.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2973d485556d8cd7a3d1f1a3a91cfb1f8d8e3492d2cb3beda529cde235023521
- MD5 17107a331c2bf9583231df0414b03089
- SHA1 4ccf5668d661262b65fa240faa8cc47a4205b9c6
- SHA512 f1baf7b0b3fdc0c0ef8530b2cc24a2bd47843b9d707b636fcbd7fc5052d2868c450efc2df6b4f1907eebd17f96fb4ce42fe15a0194a0124c05a62cca936b701f
- SSDEEP 24576:cgW20arTgWkk7z2B3KqW4x9TuJsj4F9Iv7fGNGPz:RC3x9H47
- TLSH T11A455C1177ED9B77E0BE8336E872095407F2D9066693EB0F1610EBA96C933985D013BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1182574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
fastcoloredtextbox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- TLSH T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
336350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
320KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
iconextractor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\HMJ\Desktop\IconExtractor-master\IconExtractor\obj\Release\IconExtractor.pdb
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
vestris.resourcelib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- TLSH T13B731C1C977C8BE6C2FE06B9B422190667F0C706F22FE75EDDC8A4E97C957920612193
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
New folder (4)/AsyncRAT.exe.config
- SHA256 58f956abe9d717683f4a1cfa6f70e256c80461315a8d47b6456116b3d3075372
- MD5 cb1f2dcfeb5cbb5af8efa7ea40b8e908
- SHA1 ceb040761554040cac2fc7ca18623498d3bfc7ce
- SHA512 f0d805bb7983a111b7083e08d5e53c30dd78a0a5fa2baa2af6c5d3395475a3399fd085d151cc8cce312c7eb3e11ac7c2cc78c49ff8a9bfba4b6ad6585caeaeea
- SSDEEP 96:ur71Y7KY7KPrv0bGiver/apdgaRzV6RnwhXIJ0bGiveLapdgaRzV6RQyYKS4Ypy1:ur7S7L7OrTbCyYKS/pvrsJ+J/qJvr
- TLSH T130B1E508A5C19EDA02362B32EB3052D5EDA006631176B4F478ED31679F71CDA5BB33B6
- MD5 SHA1 SHA512 SSDEEP TLSH