2026-09-30_c455e585bba42c8b87ceaf9bbdf4d29e_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

resource	yara_rule
sample	costura

resource
2026-09-30_c455e585bba42c8b87ceaf9bbdf4d29e_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat
unpack001/costura.dll
unpack001/discordrpc.dll
unpack001/dotnetzip.dll
unpack001/sevenzipsharp.dll
unpack001/stfu.dll
unpack001/wpfanimatedgif.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a3f6931ee7d0ee3b1367970d6b1718064a2d78eacc82ffd3bdf86f237a691f40
MD5 c455e585bba42c8b87ceaf9bbdf4d29e
SHA1 b1204e318010f6764b97ea2208895715f9d86057
SHA512 38d975ca545a3fdecded39cc9b9158037b2f37b6a123d02a0b84d56ffca5b5f01c88c205c843490e44f287ba2f0a7ae4dac9ce74e114bed90555f2134ac8bd53
SSDEEP 393216:zAIwXTqMCZhxR21z0wGQUJ+ci6WCmuuHkZUa+AASnUKF2cOnpF+ra5:sHWP01z0TJJKOmuuHkZcAj7tkpl
TLSH
T128272212F7A64436C46F423897ABAA9563367003A720DBCF7B8C92290F177E1CD36B55
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22070862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
MD5 dd3394a0ba6f7158d029e1c3a31b7a85
SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
TLSH
T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

discordrpc.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
MD5 9f747cc51687d853f92f70a537ff6ca6
SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
TLSH
T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

98314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/DiscordRPC/obj/Release/net45/DiscordRPC.pdb

discordrpc.pdb

SHA256 2fd5f1944f3139517141f8608340bf9747af6f80856fe030b0b0f1ea1114625f
MD5 0c1cf03431012945aba35f05c7cd56c1
SHA1 df8a7de40e43fcb70b944f4bad52cb20e03cb3fc
SHA512 4ea2eca8ba11318a5db94a9286fd7f9bfda15ae944bec55695e2c165879f9533613ae255dd96660540a5e3b980cc61bbcdaa79345df227356b5a8b58f895eff3
SSDEEP 768:msPyDQfepHiz7WMLHvTDpufyJ/PePYiLUDlOp:m8yBpHDvy1PegYp
TLSH
T1AED2F50AD3440B3EC6E651B7653353679338E045EE878B0B4B98B739AD053A85E633ED
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

dotnetzip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3
MD5 a999d7f3807564cc816c16f862a60bbe
SHA1 1ee724daaf70c6b0083bf589674b6f6d8427544f
SHA512 6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414
SSDEEP 6144:DuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnse6OVxLV/W:3QL32ikCaUS4csRBse6sfW
TLSH
T180A4AE0427EC4B57E1EF5BB5D0B2A5A2C3B1B462693EEB8F5D4024EE2C17354C911BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

465934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb

dotnetzip.pdb

SHA256 d4dbeedef2dcdeaa715b88d01c2892d7a5be368908013267958263cf9cdf6055
MD5 99eb341a214403693aa20cd8b97d54e7
SHA1 565babcbcd978af66fe1150cc58fdeafc9815822
SHA512 e797ef990c0a60951ba4ad49467b24173192e71ae5cafbf006cd0e746b63a6f709b3ef70a6f46de3a849c8f5688910b0eced4b26b4f7879e1e53a4c2c5b72ebc
SSDEEP 6144:rnuVJlDsS91SYAxY5MC/pWNue00vLpkQVHvCJ/lszBn/vPz2G:KQeMRtkJKBn/v
TLSH
T12BD47257BBC0CA33D429857866EB4F2E43B8D1C85B42D79F9385A06C3ED335A2D4A394
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

microsoft.web.webview2.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4b50632e5ddfb83b185ebddeb5e1fb233a05aeeda9cfdec96bee269e11c5b49d
MD5 cf1c8f8768ca48645bd043896f5ce21a
SHA1 dd40da395c7dc79995df8ec1fc46da717e81d283
SHA512 b7e2db6481afa9f8993c2dbbe611d7089647b3c52527fb917ed0701ec9dc951c9f720a5de4457107bacd0cf11328e706fd116e3ee55e83fdd2571805df41dca5
SSDEEP 12288:0BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4xrpsR7rP322v:8Qcl4tO5
TLSH
T10DD4522223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ee:e7:a6:d9:b5:e5:4f:a0:54:19:cf:f1:4a:cb:4c:29:a5:8f:dc:d6:3e:48:2d:c7:c1:d0:3b:c2:5f:e4:08:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 8, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:10:ab:cd:e4:16:18:ef:39:b0:00:01:00:00:02:10

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

645526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb

microsoft.web.webview2.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6ac2725b90837eba6cb3aab84c57f8927aa43dabdcdb00d1701b29aa1bbca50d
MD5 cee40e7ec2d5ca765a1288a5bde39afa
SHA1 27038333df7b42de09a6e23df6d3582e414d82ca
SHA512 e5d83b1139d3549dbd5661ac255718d10c106a0351291e50c0d82cac54b7d0bf0657e2fd22ea1ad2f839e18b8b3b8013d6fab3e9635f5517fa7be6821c54276e
SSDEEP 768:dWQNb2vIYymJ22Mss+5xQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxO:dpb2vLbxQ+ZDgcEST3p4JjrjaeFSUyai
TLSH
T13F033B4083ECC917E6EB1F78A5B4916107BABEC37DA1D3A84D84F2DA0D73B9055143AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9d:e9:92:d1:85:58:81:68:72:f1:ff:5f:9a:30:59:04:0b:c0:e6:8f:0d:56:28:c5:57:b8:2b:7a:92:c8:1b:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 8, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:12:d1:08:06:3c:ca:18:4f:aa:00:01:00:00:02:12

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

34142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\net462\Microsoft.Web.WebView2.WinForms.pdb

microsoft.web.webview2.wpf.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f26f3cd7cc1a24d297d5d414f122c4e22d493c461c023838ad8671fa7899e967
MD5 5f584d541f9e7e2e62d24a965ddb26da
SHA1 7889c896bf5d83968af1ab3bedce029058c34bfb
SHA512 0083f664a89f8e6c13905a2abc7e0d94ba551ad4a9040f3ac8744338b441e2e859e43d93a84605836ad93bbbb02bde60684918bfce21afdbf74e2e7b961838be
SSDEEP 1536:OU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udM:Vs+vLqrThx6spa8+DHfFy30bpc4Jjr4a
TLSH
T1D2836C8193AC8923CAEF1FFD786050140FB8FA83B652D7991DC5B5EC0DA379119297A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b7:8c:30:8d:f2:79:82:f5:ec:9b:bc:2e:dd:a7:e3:be:5a:52:62:a2:34:57:e9:e2:a6:ef:6b:74:6d:4a:2e:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 8, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:7e:ac:fa:0a:41:ff:7e:13:f5:00:00:00:00:04:7e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6B05-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:11:45:18:39:9b:43:cf:fc:6c:00:01:00:00:02:11

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

78150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\net462\Microsoft.Web.WebView2.Wpf.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
MD5 24704261e701b49b51e40c1292ed149e
SHA1 db8ce5e0b7d8c14920bc9c4eebe51bdf706e3fc6
SHA512 8ef6a6196044862a9d8d53c6a88e68d9591edf244385bc4888cb9c16c942eeb4a1689c49245d6cf80d619e95f0745898513ed2b67a6fc4c65fbc06b872f72184
SSDEEP 12288:65RsO50fsVuW3icGomHAQ/DUHIdGFRrDTOAPKfhUUNSUmTIcvABXyoJl8fCfB5qm:om2VuaOKdKSUNz0IpBXyov8fC3
TLSH
T178E45B2177FC8E16D9EF2375B430D9181BF1F956A2BAE78FA504D9A51C837918C203A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

08:39:56:e4:21:43:4f:90:03:ee:08:ba:76:09:c5:58:d4:a5:2a:73:28:78:a1:5f:f6:46:d6:59:61:a9:2a:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 16, 2025

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 4, 2024 - Nov 3, 2027

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 26, 2024 - Nov 19, 2025

Minor OS version

0

Major OS version

4

Entry point

713798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

sevenzipsharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 49284b31f28d0a62d797cfcf17f464c8c2b22b29d0e8ab7c15c94724d83e595c
MD5 05c9849856abc683bcbc5c8d7921c146
SHA1 ad8ec49116b026eee2dd04d6434ede7ddce9734d
SHA512 c0bfb5d987fe06eba3a7b0f0c73e24cc74935a8d1efd8a79d64b36c56d498532e453049715fb8c1509eda50a0a2f1213ce67d1edaf6bfcb200e0be58af67ea5e
SSDEEP 3072:auMYWaB5+DBS4+aYX/PzJiXyjdZXUtd6uEhd/yZcvdUCG:auMYD7gJY1iXyjb
TLSH
T12FE35C2527D98B13F2FF5639F1A006120771B256763BD78EB9481AFD5B03390C852BAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

156446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\Misc\7zip\CS\SevenZipSharp\SevenZip\obj\Release\SevenZipSharp.pdb

stfu.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9c7ff71ca99f8b6e30b17cb17f085e3331075e46a2ad0e9bc650b79805d2e6d7
MD5 b9584592101022537db3e22b1a4be123
SHA1 7db90ee3cf98bb2c97b71516c2108635dc0fa3c3
SHA512 2bf64a63dd97873b3da185b320be248346da0960e538512f37abc785d6389ec7cc419f1c00e1c6e2298572b3afc0cbee45284ba073ae1cf666ca0744110f547a
SSDEEP 384:QIp1q3spPldNvvs+6ZfT7T75DHR5M925ybxrkN+H0mGDVrzI/8urOlgq0ckzAMjc:NFvL3s+sfT7T7hx5MTb1GuzOljC5PyJV
TLSH
T151B21A08379C8333CAAE4BB97CF1919213B1D7557112CF1D29CCA3ABAC53B251A51B6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

29958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\s.hocevar\stfu\Stfu\obj\Release\net40\Stfu.pdb

wpfanimatedgif.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b4c69be213ba3dd40e6bc819b7bfc13ab03d06d5f3efa0e4643b1b55e5a529f9
MD5 47d729b6841f1e0e510bbc7d74454b73
SHA1 bb7a519a2bf2dbfa8aef238241d6dd5c62aeed77
SHA512 f5ecd0cca56306273685c12ccb5af8f540161e2cffe3f639a2fa1f9de29cfebb2f6d8f8ba4ad43e02a721da30dd8e3cc911e46e4237578e026a5ba8c059429af
SSDEEP 768:H0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkch:UqQpZTsooEah0sqU/by4UZzh
TLSH
T135135C2403BD836AC75E06FBB4F0402442B6F3867512DBE96EA4E16FAD6739107147B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

48030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb

wpfanimatedgif.pdb

SHA256 afa73a32b976ffe3926c21b06cf8cc25b72ece16aec7e546dcadc6596fd4932c
MD5 81b1ed5a70f7cd884555bd43ea2cedbb
SHA1 5b5038cc52a18db1581ac9dc75a6a8612a310b0e
SHA512 f55e04663ffa9e65dd030743a98644f8145d4ca2b982cdc8c16315c8482e7e2fe5a83249ef835dbef9931db99f94f54fcbea1b756ab5aef961c7739c95cdbfda
SSDEEP 192:xweyh7FAuKjOP60wMD7wiBXndS0VTYJAkzIDC9vBkT5hcO5FLm:x9yh7FAhX0wUwitw5JAkmCQRLm
TLSH
T14372FA265694CF2DCBA84976EA7353366BB0C104FE078F27A184B77B9CD67504F231A8
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer