baaeae88bbd6bb093f42b7c431f5605e9a09fc6f372f4aa2234a1cd2ccc21882.bin
- SHA256 baaeae88bbd6bb093f42b7c431f5605e9a09fc6f372f4aa2234a1cd2ccc21882
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Newtonsoft.Json.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SevenZip.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
SevenZip.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target baaeae88bbd6bb093f42b7c431f5605e9a09fc6f372f4aa2234a1cd2ccc21882.bin
- Size 1.4MB
- Sample261013-3dznkadf93
- SHA256 baaeae88bbd6bb093f42b7c431f5605e9a09fc6f372f4aa2234a1cd2ccc21882
- MD5 c092449398e1db8e5bb07a3b3587a41b
- SHA1 4a2239ae66066c5b193e5e58d9ada874b070f9f7
- SHA512 fab1831acbfe94616b1ce6116358c22ee27d4daef30998a2d169b53a0c9e10b401e645c873c76c1965164f8d935c257c18420c529a08ef321c1a8881ea61c6d1
- SSDEEP 24576:GQal3Q1P5swgS3DH3wqpkt2x3GWQTHijMSiu9JPMA2lwGSwCAVti:klAHZ3wAkt2x2lTHiM8ulwYCiM
- TLSH T1A165334B287166D84D1AC88DF2BE3344BC4B96A1DDD5C4F8ED920E70D946F8D26B6CB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SevenZip.dll
File Explorer
-
baaeae88bbd6bb093f42b7c431f5605e9a09fc6f372f4aa2234a1cd2ccc21882.bin.zip 1.4MB
-
Newtonsoft.Json.dll.dll 653KB
-
Readme.txt305B
-
SevenZip.dll.dll 49KB
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b9b4e633ea6c728bad5f7cbbef7f8b842f7e10181731dbe5ec3cd995a6f60287
- MD5 1f478e39a4c06ea7c6dce92238f23ec1
- SHA1 c1ceafe3fa14e099c9782058cf598686361902fd
- SHA512 a192e7b5b67259128cf7a901e549722903230618c0e10215f802e22fe9362339f8ce5482b729a28fc284670d984b2b79fc4d5f10e37a2e734a61200dbcffe859
- SSDEEP 12288:Tu3gQBr2P1KUhOOsQG0axSU+8B5MABJjlE5i:T0g42sqOOsf5+mZBJjlKi
- TLSH T199E44A1527F88A1AE5EF5375B4708A198BF1F916E2B6EB4F8904D5FD2C537908C007A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
48:3d:d4:e3:65:21:ad:29:99:64:6a:37:dd:3d:da:ca:a2:e8:1a:fb:2e:1c:59:9c:30:00:c7:19:4d:d8:3d:65
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Apr 22, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
666198
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/netstandard2.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
643KB
Virtual Size
643KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Readme.txt
- SHA256 ce67fdb3d3d5cc7a8dfd9ab606b6de0e089ca208d3725e886714395611398cb3
- MD5 9e0b3ff70544378125a74342a49dae6a
- SHA1 e2930fba50de5cb1903ba713c7927bdf1f7e44e6
- SHA512 1aadc45b3bab5621c974eb9cef3556b0f29244ef13cafdf1f4694c9185df633d0a40f4fcd6c8f93e1e337c06e61adbd9de6ada228ea74ae31b4c505f3af6c2b1
- TLSH T11BE08C992587B16130D083E2522388817A10090A829BA48BB2689864301EF810EE2243
- MD5 SHA1 SHA512 TLSH
SevenZip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f80c92ce064a19d514cdaaf1838244f203c188462d26119df7b408291d68f8b8
- MD5 11eb138db53f5896f3cf95144d04132a
- SHA1 204fd914b84630366c3a656254f39a99a884d8d4
- SHA512 da60124b8c95e6bc7d123def35e61041f567df57401737ad3fdaeef12140d2a6410eedf6cd29889f401cae4cff7b6c0bdd71507b2885e06cb39d75da42bd63d5
- SSDEEP 1536:Pyl9DERHUxDiJrVPpO+KeH8Ie1sGvLq4WMn:Kl9DGHUxDiJrRcIcsYV
- TLSH T17C332B199ECDC713DF1E82FEE0E2594643B2A036A7B7D79ABC00B8E518073D4451A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
55938
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Projects\LZMA-SDK\src\SevenZip-NetStandard\obj\Release\netstandard2.0\SevenZip.pdb
mscoree
_CorDllMain
Name
.text
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ