builder[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
builder.exe
Size 1.3MB
Sample261024-1ld1qaet4m
SHA256 c204f426197d1ce93bcc17e8da08b35037ccd9aed26ced679486143ce91b1fca
MD5 56f878e7c5ef9796da8ed9e1aa4cc79f
SHA1 ee63227703ce5e6de454029b91580e0229f1006e
SHA512 a4ab401b4fc67b7981593a6fb3a763949c74112433aa2019fa1b071f4ce8617227654b89343557c867db8d7fa17cbf829b0326754fdae6b4a347aebaf53392bd
SSDEEP 24576:QrUmmtav1YlL2ii7vzOMVo+50SHgbuO0MjdM8yfAPnqOTmciow1PmW:QwUtYp0vzhaglH20MjmfeqOTmcNwdm
TLSH
T1DE55231AA60C5C18DE3E3DFA8568D43EB3B11E431D31DB1AA8F48C97FAD53471E22499
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

costura packer

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
builder.exe
unpack001/costura.dll
unpack001/dnlib.dll
unpack001/windowsinput.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/guna.ui2.dll

File Explorer

builder.exe

.exe 1.3MB
costura.dll

.dll 5KB
costura.pdb

7KB
dnlib.dll

.dll 1.1MB
guna.ui2.dll

.dll 2.1MB
windowsinput.dll

.dll 105KB

builder.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c204f426197d1ce93bcc17e8da08b35037ccd9aed26ced679486143ce91b1fca
MD5 56f878e7c5ef9796da8ed9e1aa4cc79f
SHA1 ee63227703ce5e6de454029b91580e0229f1006e
SHA512 a4ab401b4fc67b7981593a6fb3a763949c74112433aa2019fa1b071f4ce8617227654b89343557c867db8d7fa17cbf829b0326754fdae6b4a347aebaf53392bd
SSDEEP 24576:QrUmmtav1YlL2ii7vzOMVo+50SHgbuO0MjdM8yfAPnqOTmciow1PmW:QwUtYp0vzhaglH20MjmfeqOTmcNwdm
TLSH
T1DE55231AA60C5C18DE3E3DFA8568D43EB3B11E431D31DB1AA8F48C97FAD53471E22499
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1352814

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\rudik\source\repos\autoclicker\autoclicker\obj\Debug\builder.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

dnlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
MD5 c087c70deb98db9d0b046d0a3d0e582a
SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
TLSH
T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1183806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/obj/Release/net45/dnlib.pdb

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
MD5 58459aefb74d5ff786b9efb982d44eab
SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
TLSH
T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0c:8b:14:20:bc:10:db:d0:29:b9:4e:67:9d:b2:a6:c7:df:c3:b3:87

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Sobatdata Software

Chains

Feb 18, 2025

CN=Sobatdata Software

Minor OS version

Major OS version

Entry point

2188846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

windowsinput.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3db898ec441a720b09db7d79cc862f509c073d904f69eab942c27f1b8d84c43f
MD5 28daa90e93cdf2db4ad13af709fa92d6
SHA1 3848ee2852b8e3afce6a914b57f6d7e44ed00776
SHA512 80b70626b3c7a19edcac4a8ae6d71543dce70c2385349047d5941bc92fe71d3703d4e1614b86416c09f30fdd8d518ca4497a6dacc91cddaa5c6f11dac52ee8be
SSDEEP 3072:xH1toxm1f2xfalpyyHz83XkH0nmJptILPaXq3:xH3+YlV8c4+X
TLSH
T159B34A211BBC423AEE7EA73AE2A14401C7B1EA4A745EF74E1E04FCB12C9336155553EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

113566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\source\repos\MediatedCommunications\WindowsInput\WindowsInput\obj\Release\net461\WindowsInput.pdb

builder.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

dnlib.dll

mscoree

dotnet

guna.ui2.dll

PE Signature issue

mscoree

dotnet

windowsinput.dll

mscoree

dotnet