2026-09-30_876172c5414ca4e4c2da9c506284a6bb_icedid_luca-stealer_njrat_remcos_stealc_vidar

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

resource	yara_rule
sample	vmprotect

resource
2026-09-30_876172c5414ca4e4c2da9c506284a6bb_icedid_luca-stealer_njrat_remcos_stealc_vidar
unpack001/colorwheel.controls.dll
unpack001/colorwheel.core.dll
unpack001/costura.dll
unpack001/discordrpc.dll
unpack001/gma.system.mousekeyhook.dll
unpack001/qrcoder.dll

resource
unpack001/guna.ui2.dll

SHA256 2121d5c858aeccff1f1655c5b8d4ff1074f15bead0ce4147cf0b087fd7083771
MD5 876172c5414ca4e4c2da9c506284a6bb
SHA1 ccd89a394e9ab2f140c18bc2265dca5f1acea777
SHA512 1b1bf3d1961d3072d6b92978ac7ab86e5c9f688a164ad8080a9b4be6f19cdf89d108729bee1b2f290a1865a54dfd3438311b385d4aa4b08164217853a04738e3
SSDEEP 786432:yvrbThyBqLt3ZYf5iy4aoOEKezs/9Fv6ttqjTFqZPK5AAeRkjgDVQjNBNA2M2J/e:yfNVLJcf3eMf
TLSH
T1EA974B83F6EAB955DA03A5FD8B1253DA97DA9C250360C3C68EE93D300EF6D4B4C48953
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

colorwheel.controls.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1bd1d3205434dadc2b842a422f4c4ca01591385800541ad8a51c7ab334785a47
MD5 84fa20d103de97f08c96dfb4d798e869
SHA1 ac956481a64db7f12f3a8503d7cba4fd2efa11a8
SHA512 d38e5a997b49ef79393fb2a98c1ed282c7a2583983fb9bd674c96c1ced0b16165be82aac0296f0654e5fe1600483c465aebb0e8b422192a934f315af9373814b
SSDEEP 1536:l//gyccDNXwCLguUN7lqGb7hEDlSpnaKdgtxdE:l//gYDNXwCL7GxE+nhad
TLSH
T12E53174667B98635D9BE0B3E58344110933E6247AF13C3087EED25E92BE33DB4A4179B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

66990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\local\asyrov\codeplex\color\Main\ColorWheel.Controls\ColorWheel.Win.Controls\obj\Debug\ColorWheel.Controls.pdb

colorwheel.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e75333f88bbfcc2b7ae3b12dc4b59ec8c9261c5332c4822b7a673bf58a149042
MD5 fb7faf8c6b5429dfc2b7eccf6dc00e98
SHA1 47dde2b7cc0aa405344042ce9dd6f6e4539dde7c
SHA512 4f7d4f355403656d6b2a40fe1e4234658c99d2ee48f0ea6f31f6f7c27862ffe3b4eb96370725518b33d1d28b5fb0908671a516eba49d3e5cd3459fca8af66f3b
SSDEEP 6144:2ESznJQCxJ8R+eSQMxbgyI4y9yVFhbu0jEQv/hvN2k2l:2ESznsbMJ7I4y9UFpPvNw
TLSH
T19944F14C8FF89579CDBD467C846119245BB0A2BAB603E32A1BD921F21F733E54D8B583
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

259454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\local\asyrov\codeplex\color\Main\ColorWheel.Core\ColorWheel.Win.Core\obj\Debug\ColorWheel.Core.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
MD5 dd3394a0ba6f7158d029e1c3a31b7a85
SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
TLSH
T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

cyotek.windows.forms.colorpicker.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a179f7e8dace0583e3df45468d3a9cda93e051b16aee3e074d1f123e49437761
MD5 9942a12a3ec98524241154bb42a95589
SHA1 e7d76ffcb36d9aed90cb044ac9dcacb1a2088d15
SHA512 265c6c2c001d6a8b6ec842015105e1bcedfa7f1f64297aa79bdbe97cad11f2ee07a738c6333fa17a580748dd752a819b20504d63c33c8933ad0176a5dac5e830
SSDEEP 3072:FMeqVPk6e2zIIGl+7CsvMjuwL1Jaj5ej5a:NqVFmBqM6S1U5G5a
TLSH
T127E3F9702B1CB517ED9F44795B3AB58843F1A4E2F761E3662FF096DD888330A274A247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Digest

27:05:65:07:c0:b6:65:50:20:ad:22:bf:e4:5e:e4:11:cb:58:c7:b7:87:bd:d5:a8:78:df:fa:2c:ed:47:8f:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Cyotek Ltd,O=Cyotek Ltd,POSTALCODE=NE37 1QA,STREET=53 Saddleback,L=Washington,ST=Tyne and Wear,C=GB,2.5.4.18=#13084e45333720315141

Chains

Dec 3, 2017

CN=Cyotek Ltd,O=Cyotek Ltd,POSTALCODE=NE37 1QA,STREET=53 Saddleback,L=Washington,ST=Tyne and Wear,C=GB,2.5.4.18=#13084e45333720315141

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

7b:e8:69:08:d2:eb:55:55:4d:d2:0a:c3:b4:a4:3e:b8:72:f6:16:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Cyotek Ltd,O=Cyotek Ltd,POSTALCODE=NE37 1QA,STREET=53 Saddleback,L=Washington,ST=Tyne and Wear,C=GB,2.5.4.18=#13084e45333720315141

Chains

Dec 3, 2017

CN=Cyotek Ltd,O=Cyotek Ltd,POSTALCODE=NE37 1QA,STREET=53 Saddleback,L=Washington,ST=Tyne and Wear,C=GB,2.5.4.18=#13084e45333720315141

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Cyotek Ltd,O=Cyotek Ltd,POSTALCODE=NE37 1QA,STREET=53 Saddleback,L=Washington,ST=Tyne and Wear,C=GB,2.5.4.18=#13084e45333720315141

Serial Number

82:e3:57:5d:49:1a:06:0d:54:45:3b:7b:0a:b1:ab:01

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2017 - Jan 5, 2018

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

0

Major OS version

4

Entry point

142510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Checkout\cyotek\source\Libraries\Cyotek.Windows.Forms.ColorPicker\Cyotek.Windows.Forms.ColorPicker\obj\Release\Cyotek.Windows.Forms.ColorPicker.pdb

discordrpc.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 984b1765dc6698dd3e2a5f9ec55ce0559e2fda60da4da089b0c36f07fb8dfe9c
MD5 76a0e138a76cca167736dcb6d48acf62
SHA1 79f3796dc697aa3f966522a1f45d4988d8d3cb4d
SHA512 c44b4a7ee3d27da194f24eaf2a3097cac69597725259eab5da596f52bd4b344f339b21f5562c5a4425058e3cc009ec95b1a23d63c3c7d8b8b0b21c6183d4d8a1
SSDEEP 1536:Tp45EBCD+50zqeA1pfEI8FslWtDGt1PMnD+msxpSN5:TW52C6iiEI8VtDIGnD+mt5
TLSH
T14983087563FC825DE5BF2B34F0B412114BF6B949B935EB9E5A4420CE2E43B814A613B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

91666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/discord-rpc-csharp/discord-rpc-csharp/DiscordRPC/obj/Release/net45/DiscordRPC.pdb

discordrpc.pdb

SHA256 00e6da8e80ab93bb2f133d6279b1f36155566be31e4b1159e51da49edc4ac92a
MD5 37c49c50bb14b1062fe8b88dab13616b
SHA1 9382e612d65f1faae4cf99c78f82f572c21497a6
SHA512 d18e9de9a9fab0b94bd451b466790a74e8cd5487fcf626f90ceefb4fba512d7a4666546a6569895d269802173391edca61ec2ccac8c276bd441beba8e61d9cd7
SSDEEP 768:+yiTw6QkWHhtrUYAMte1xJJvNp/ffJUHQUl:JiutKXRFp/YN
TLSH
T1C9C2D60FD3558A1BC2DA55B71073032633B8D121EE47DB070BA8BB75EC853681E5B2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

gma.system.mousekeyhook.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 38395717f48e1e64bd29c6cb5df11349f011cae5f9fce0264b53252d60cdd191
MD5 38be3b238310387bb5fa85a999326277
SHA1 b927071b902b777cda7e52a6f79af9cba1c62fdc
SHA512 d83baa0e86b75d9720073fa88109c182bc6d10af617d559ddc16f448e5c507f702256f4715d817250cf78362388bdd3ce109c6e9d11254ec57727a58dfddc659
SSDEEP 768:o/t9KqQ6Un424sqnaxTRLTxT2Wjq7oEs+hfQ9X5xXK:olgh6a424sT7v93ji/sQY9Xi
TLSH
T11E436C24835C0337CBDD8B7FA476412A87B1D7863953EBB7AB9881F02863B541929377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

52850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
MD5 b464fc896b14bfa34f608da53856e999
SHA1 55568eecc97895cad49a42bffe757e3588c5313c
SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
TLSH
T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ef:ea:da:1b:68:34:55:c7:9d:54:32:02:aa:3a:3b:97:1e:fa:ea:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Feb 18, 2025

CN=Sobatdata Software

Minor OS version

0

Major OS version

4

Entry point

2188926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 8, 2023

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2021 - Oct 29, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

704578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

qrcoder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5ae2792c76262943a4e34140bbd64b2aa7d9ed5c5822680c00d9eaa322412680
MD5 4885a17363679aab6211d5960bb2bf72
SHA1 620c11c5c464c10eb7675b6c4b873560e8026551
SHA512 eef8683fe19b35262cd93e75e6bf0f17ba4e5dbc158aaa093c80192ee33a39b383a5c8b1eda027596b4c9b98c293ac922f6f6f6ec99d969a95e66da85c32c37d
SSDEEP 3072:xV2CN+YEkkcZne94i2TYD0iljyBmqTAPh+QYQUIkL5a3wX2oM:xV2CNRn04i2cD0cjMmNmIkMG
TLSH
T12BE35A2977E8CF06E6BF2B79E8B010404B75F456BA36D75F0DC8A69D2592B8088107F7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables manipulated with Fody
Detects executables packed with VMProtect.
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

148474

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\QRCoder\QRCoder\QRCoder\obj\Release\net40\QRCoder.pdb