2b2b03a3d8b76325d33f374538863eecb1d3c9b8ed3f07b240689d97872b2b6c
- SHA256 2b2b03a3d8b76325d33f374538863eecb1d3c9b8ed3f07b240689d97872b2b6c
Overview
overview
5Static
static
5Oversis/Fl...re.dll
windows10-2004-x64
1Oversis/Fl...re.dll
windows11-ltsc_2024-x64
1Oversis/Fl...A3.dll
windows10-2004-x64
1Oversis/Fl...A3.dll
windows11-ltsc_2024-x64
1Oversis/IconLib.dll
windows10-2004-x64
1Oversis/IconLib.dll
windows11-ltsc_2024-x64
1Oversis/In...nt.dll
windows10-2004-x64
1Oversis/In...nt.dll
windows11-ltsc_2024-x64
1Oversis/Ma...pi.dll
windows10-2004-x64
1Oversis/Ma...pi.dll
windows11-ltsc_2024-x64
1Oversis/Mo...ry.dll
windows10-2004-x64
1Oversis/Mo...ry.dll
windows11-ltsc_2024-x64
1Oversis/Oversis.exe
windows10-2004-x64
3Oversis/Oversis.exe
windows11-ltsc_2024-x64
3Oversis/Sh...ut.dll
windows10-2004-x64
1Oversis/Sh...ut.dll
windows11-ltsc_2024-x64
1Oversis/SharpDX.dll
windows10-2004-x64
1Oversis/SharpDX.dll
windows11-ltsc_2024-x64
1Oversis/Tr...fs.dll
windows10-2004-x64
1Oversis/Tr...fs.dll
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Oversis/FlaUI.Core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Oversis/FlaUI.Core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Oversis/FlaUI.UIA3.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Oversis/FlaUI.UIA3.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Oversis/IconLib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Oversis/IconLib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Oversis/Interop.UIAutomationClient.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Oversis/Interop.UIAutomationClient.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Oversis/ManagedWinapi.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Oversis/ManagedWinapi.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Oversis/MoriClassLibrary.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Oversis/MoriClassLibrary.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Oversis/Oversis.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
Oversis/Oversis.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Oversis/SharpDX.RawInput.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Oversis/SharpDX.RawInput.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
Oversis/SharpDX.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
Oversis/SharpDX.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
Oversis/Trinet.Core.IO.Ntfs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
Oversis/Trinet.Core.IO.Ntfs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2b2b03a3d8b76325d33f374538863eecb1d3c9b8ed3f07b240689d97872b2b6c
- Size 599KB
- Sample261018-qq4f3aex3x
- SHA256 2b2b03a3d8b76325d33f374538863eecb1d3c9b8ed3f07b240689d97872b2b6c
- MD5 81603092f1fce5d2c6fa8b84991276f7
- SHA1 979089bffe33c49c1cb0af0c8ce911c3774d6bbb
- SHA512 6869b931759de697e758f1064b7caf825b13f6eeb0b806a296890b779b8207cfd96cae1abbf10efacc63acb31dc0ba1a21e5809a90c6881b9e3953e5780fea6f
- SSDEEP 12288:X1LCLPVXBPzZr7zlEF372Da+7Pl7qlI7TVmLNTjTC+RWWG7luZ:XJYPVVzZBEFqDaEPIqYJvxRWRc
- TLSH T147D4238AF62F2B1B9A7851F061D5809DB360EB83A41B64212C3C0BE574FFB869DD3435
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack001/Oversis/MoriClassLibrary.dll ConfuserEx static1/unpack001/Oversis/Oversis.exe ConfuserEx - Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/Oversis/FlaUI.Core.dll unpack001/Oversis/FlaUI.UIA3.dll unpack001/Oversis/IconLib.dll unpack001/Oversis/Interop.UIAutomationClient.dll unpack001/Oversis/ManagedWinapi.dll unpack001/Oversis/MoriClassLibrary.dll unpack001/Oversis/Oversis.exe unpack001/Oversis/SharpDX.RawInput.dll unpack001/Oversis/SharpDX.dll unpack001/Oversis/Trinet.Core.IO.Ntfs.dll
File Explorer
-
2b2b03a3d8b76325d33f374538863eecb1d3c9b8ed3f07b240689d97872b2b6c.zip 599KB
-
Oversis/FlaUI.Core.dll.dll 249KB
-
Oversis/FlaUI.UIA3.dll.dll 103KB
-
Oversis/IconLib.dll.dll 55KB
-
Oversis/Interop.UIAutomationClient.dll.dll 147KB
-
Oversis/ManagedWinapi.dll.dll 104KB
-
Oversis/MoriClassLibrary.dll.dll 52KB
-
Oversis/Oversis.exe.exe 315KB
-
Oversis/Oversis.exe.Config.xml 332B
-
Oversis/SharpDX.RawInput.dll.dll 24KB
-
Oversis/SharpDX.dll.dll 260KB
-
Oversis/Trinet.Core.IO.Ntfs.dll.dll 19KB
Oversis/FlaUI.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8dc1a4a5e8917b7a08624e4a868ca8ae22ad4e49c10fcc6824a6deebb60e0909
- MD5 dcccc0a6a78397ae4b3898922229f2c5
- SHA1 1012702a80b8b56216a84610dbf5061e136d7614
- SHA512 5a112b7437c351a0fb5ee94a31a2dc96ccdaeb7e0e1b9af616102b533b21be54911465e75cc96101d3dc4aa201704a816d6a2cd8543980aae9a5c59cd6ecb70f
- SSDEEP 6144:DM3R0XKpmhabZ5icmmClEYUz5jgfbi212M2:DMh0apmI9C2Yojgu2b
- TLSH T11C447D05B7B8472ACEFF0B7FF460442893F8E98BB491E7596918BDAA1597B400D413B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
261082
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\flaui\src\FlaUI.Core\obj\Release\net45\FlaUI.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
247KB
Virtual Size
246KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/FlaUI.UIA3.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 610606b20216c11956f957d7d805dc60746773ef6797c2b29e691ccf7e22f01c
- MD5 42332383ef7a23377e95a80bf6127896
- SHA1 0e40325d859d5cb6cc619289de729f5f887a8fe8
- SHA512 9a02b13d74be4d2a67b70f02572780611478aad8c8a18e6149e1e0ddac68475797ef70b1c4954962b5049a3385c2283a3e1cb80d3eb001561a1bc40a807ca4b3
- SSDEEP 3072:cRBpUrQ/0TI/wpETlcIhqCc590ML3Kcm:cRzU04Kc3Cc5qML6
- TLSH T133A31A4AB3945F36C7DF667F68702441CB74A78B2EB1860BBF506AEB146374006827B7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
111358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\flaui\src\FlaUI.UIA3\obj\Release\net45\FlaUI.UIA3.pdb
mscoree
_CorDllMain
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/IconLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cc7f8bacc612ab773ef486586812069693e25749e7f9042bfa1afb4b1fe12e9d
- MD5 bcfdded0e41e51d7821367a45126d2db
- SHA1 1bfccfd293995fede64a577298830ff85bc818a1
- SHA512 763c832ce00b3f601604c7c1792097fe05e8dc1a4f394c00d5821e349663c4a3f859b72ef68eea6523e1a6a3fa11384dd32d4109279b755c53bf46179ca34f8f
- SSDEEP 1536:G0UzWzkg0K0KGluC2Ekze7JVYPi1Q8sbQW1yk:KQvGluC2ne708QJck
- TLSH T12B436C1977ACA73AE87E4B7A79F5085503B2E5653923C34E5D88A0FA1D273C44B10FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\1.Codes\Morisis\IconLib\obj\Release\IconLib.pdb
mscoree
_CorDllMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/Interop.UIAutomationClient.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2c5e496784cff013a19ead6f601abfe11ba9ddf6ff54c3e0ae888c577bec8d0c
- MD5 df9d0d41a8c98a9c2e796c3d2a2ea3b0
- SHA1 336605401efb8e4b54fd94b8368b834bf6886d4f
- SHA512 b06b438b6033d07402d8e2bd2b9d20c3d0886c1e320a389ea53c71eef854e7e884732118639499c7ab090dfbcdd5d3867ae19898e30fa9537b7fa56eef5e1aa2
- SSDEEP 3072:qNDaGRI6Y6Y6l6P6B6x6X6l6P6B6x6pPPPPPLkrPJC1IMD7WJdIdJD9/g:sWkrPw1IZIJDV
- TLSH T1E3E396B3710D4814F95B037F59D2AF6052F69A852872CD42061DAF39DF136888FCA7BA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
156910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
145KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/ManagedWinapi.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2adebbee31f769a7df83f20cdbda1e3ff34fb908a2fad7d5ebf187c782d991f0
- MD5 6ec2748357576550dec073f1118f7727
- SHA1 976cfdfec2ec1c01d7060e7a7522b2a77612b3ea
- SHA512 48ca22ca9a18ab92055378a69384138263fa4b36bccfb51b8b3601dbc9622e3091347f136b55c65ddac234a40d58b55f27f40074a66c40628d36279ae2c96bdc
- SSDEEP 1536:otEc6ozJXLy8/4iPsrkpGlDrrSh9IrBkC50u7C8GfxYMk48TGhYn/3o7V8:fc0NiUrkGrmIV5R7CNfxYMk48Tdnv68
- TLSH T110A37C6C7BE45A5CD4AF47BEF06162114770E112660FF39B0ACDA4F539B33B089522A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
112574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\1.Codes\managedwinapi-src-0.3\ManagedWinapi\obj\Debug\ManagedWinapi.pdb
mscoree
_CorDllMain
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/MoriClassLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4e73bcf4dcb7c3968202e5f3006d3132e7ef9ed37a6d024ebdf73be60cc55876
- MD5 d19f66c3ab3d0bacae8104e25c566270
- SHA1 bb199cb0a379d6a87c123e4435460d96eb6a6a69
- SHA512 d746ca03d8936fd0e85596f2abc283b820d8e3b3dce88837cfeae21800aa22c0201de0a5de91d1503a8ca99ee9849fb5a53e650d9e46d78806921b0fa2864b73
- SSDEEP 768:ntRZl74V0KzxHsd0jcSiV6QcOAQrPU/ZgANpdkDj/SB9Yl:X34m8Hsd0gSiV6GFrPU/XAa8l
- TLSH T17A33639C722072DFD867C472DEA82CA8EA60747B971F9217942715ED9E0D88BDF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
MoriClassLibrary.pdb
mscoree
_CorDllMain
Name
hh=C]
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
948B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/Oversis.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b87b737f0693272e8af27d34f7939b2215669d621c982c3b998221c5e0819253
- MD5 835e170785598c438831bbf8d300ff09
- SHA1 3b6b8d0962ba6ffbade4cb7293ee973455d0d4c6
- SHA512 ce350f99d9362cb0b054975ef7adee24cf502f9c1628411a52303ad4f8525b80c7d97a44d3f470b56ce8533e3455d500efd9e308e59b06d669618270275b997c
- SSDEEP 6144:XZ7BFEXlX2rYSR7WMVIih/EhYX62ttWQzQ3h6HhRlxqQaojo9nCwyj5zqyrwaT4r:XZ7BF6lI7TV5xX6gAQzQ3h6HhRlxqQar
- TLSH T15664FD9C725072EFC857C472DEA85C68EB5078BB931B4203A42725AEEE5D897CF150F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
335882
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Oversis.pdb
mscoree
_CorExeMain
Name
9 q42
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
159KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/Oversis.exe.Config
- SHA256 4ee118a580b37b555104ec19c578d888364c5a77ad29cd57cf4707666b9a86e5
- MD5 7d3d24cfe648a3807da8625c88b71695
- SHA1 d96ca7694a2cae252604fb7cfd8d0657c504a2b3
- SHA512 eb1e5baa745b6593c8b257ef48495bab8cfd5216523eef957dc4aa3fc7119aa49aec8be393a1c3fcf8c5b90ba78d6dd6e87852ab07212e25833e78dbbdf1f52e
- TLSH T1AAE0C21949E4BC57CD324B1BA6318B14DF7425E3305105ACF03E92F64F3248906033A6
- MD5 SHA1 SHA512 TLSH
Oversis/SharpDX.RawInput.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 727e4f5e311b1f582bc89ae9e2c3cd585b7952c433b6e7656521bac05811f651
- MD5 c424d62f5045d6e2800c7fdef5f1697d
- SHA1 434e533928d6da0da41201d6e4b0baa97ac93b91
- SHA512 0e5a564d9de35eb3747350c4ff7e456cd8b544f89641c7bc7df03008c30ff0eae53b3d5c5744fc736fe9aab27d638455ad221499a2b13f2084cfb602f13fc114
- SSDEEP 384:ZhKC1mOM4dsQuwfx6p4QEeAMZAdikp2VRjHso24Fm/tLjyCzIeuXcJK97:ZhKCUx4tdxy7EeIpazsoMlLufl1
- TLSH T165B23A72CB4C807BEA7D0375F85313120672E1482583FB8F6A5A20D6BE57B895B127F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\sharpdx\Bin\Desktop\SharpDX.RawInput.pdb
mscoree
_CorDllMain
Name
.text
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/SharpDX.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 28437b8f6036224b187f6ec324af9cd8f20dc5e363b0341f86869e4172f07909
- MD5 6fabeaa1c8ea15e787f2e3b487ab434d
- SHA1 c2091f69192903676ed6b181bbf8346b819c43a2
- SHA512 076bccbb7ddd4bb7b785bc70dfcaa920c080af30172ce1dcc49594a96f96133d0322db73362c47d8b4d2afa69e0ee0c78a3b423aa4886478080529f864bf1739
- SSDEEP 6144:Kz8yewswWWdEOIHnlS2TGFf/xJkYTM3mCf6Y:rws62zSVxJZ4
- TLSH T1D4446C26FB040A33D84F77BEBD95612203B0D10125569B8FB9B971AD2ECB7886D123D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
272542
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\sharpdx\Bin\Desktop\SharpDX.pdb
mscoree
_CorDllMain
Name
.text
Size
258KB
Virtual Size
258KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Oversis/Trinet.Core.IO.Ntfs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2c06cd4fa6350dd4e5644e6931f76a8f442ed922eeaf391999c4d8058cd65a0a
- MD5 757bfac5093a518db47932a09dd21fc8
- SHA1 7aaba9c31541bfe851f556f8ec9015741a7fbc31
- SHA512 bc6ac21f2a67a7f92cc2ee82745414e534bfc911d88e5dd17dc160030a1781a3269b3425cc0f63f7c976b8cf044255ec8a65d4c436d1328957ae9c8bd6eacea2
- SSDEEP 384:s3gMD9oQTlCq4D4R2OLLOBZFlQhG0z26qtT70P0OlhErpv82kSGp30ibcxh9NBI:sF97ZC7D7L1Qh66YuhIZIpbcb9NBI
- TLSH T139922A40E3EC8377CAEE1B74687103000371F555BD72DB1F9A6890962D1BBE84AB2B97
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Richard\Documents\GitHub\NTFS-Streams\ntfsstreams\Trinet.Core.IO.Ntfs\obj\Release\net462\Trinet.Core.IO.Ntfs.pdb
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ