Phantom-main.zip
- SHA256 8fa1216867aa71b2b8afe95581221335a48323c0c810ed39816b6eec1572159e
Overview
overview
10Static
static
10Phantom-ma...on.pdf
windows10-2004-x64
3Phantom-ma...on.pdf
windows11-ltsc_2024-x64
3Phantom-ma...Gen.js
windows10-2004-x64
3Phantom-ma...Gen.js
windows11-ltsc_2024-x64
3Phantom-ma...in.ps1
windows10-2004-x64
3Phantom-ma...in.ps1
windows11-ltsc_2024-x64
3Phantom-ma...in.vbs
windows10-2004-x64
5Phantom-ma...in.vbs
windows11-ltsc_2024-x64
5Phantom-ma...er.vbs
windows10-2004-x64
5Phantom-ma...er.vbs
windows11-ltsc_2024-x64
5Phantom-ma...es.vbs
windows10-2004-x64
5Phantom-ma...es.vbs
windows11-ltsc_2024-x64
5Phantom-ma...ub.ps1
windows10-2004-x64
3Phantom-ma...ub.ps1
windows11-ltsc_2024-x64
3Phantom-ma...tub.js
windows10-2004-x64
3Phantom-ma...tub.js
windows11-ltsc_2024-x64
3Phantom-ma...AC.dll
windows10-2004-x64
8Phantom-ma...AC.dll
windows11-ltsc_2024-x64
8Phantom-ma...64.dll
windows10-2004-x64
8Phantom-ma...64.dll
windows11-ltsc_2024-x64
8Phantom-ma...ut.exe
windows10-2004-x64
1Phantom-ma...ut.exe
windows11-ltsc_2024-x64
1Phantom-ma...om.exe
windows10-2004-x64
10Phantom-ma...om.exe
windows11-ltsc_2024-x64
10Phantom-ma...tor.py
windows10-2004-x64
3Phantom-ma...tor.py
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
Phantom-main/Phantom Technical Documentation.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Phantom-main/Phantom Technical Documentation.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Phantom-main/Phantom/CodeGen/FileGen.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Phantom-main/Phantom/CodeGen/FileGen.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Phantom-main/Phantom/PhantomMain.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
Phantom-main/Phantom/PhantomMain.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Phantom-main/Phantom/PhantomMain.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Phantom-main/Phantom/PhantomMain.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Phantom-main/Phantom/Properties/Resources.Designer.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Phantom-main/Phantom/Properties/Resources.Designer.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Phantom-main/Phantom/Properties/Resources.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
Phantom-main/Phantom/Properties/Resources.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
Phantom-main/Phantom/Resources/AESStub.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
Phantom-main/Phantom/Resources/AESStub.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
Phantom-main/Phantom/Resources/Stub.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
Phantom-main/Phantom/Resources/Stub.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
Phantom-main/Phantom/Resources/UAC.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
Phantom-main/Phantom/Resources/UAC.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
Phantom-main/Phantom/Resources/UAC64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Phantom-main/Phantom/Resources/UAC64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
Phantom-main/Phantom/Resources/donut.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Phantom-main/Phantom/Resources/donut.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Phantom-main/Phantom/bin/x64/Release/Phantom.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
Phantom-main/Phantom/bin/x64/Release/Phantom.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
Phantom-main/deobfusactor.py
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
Phantom-main/deobfusactor.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Phantom-main.zip
- Size 2.7MB
- Sample261024-snvr9act8k
- SHA256 8fa1216867aa71b2b8afe95581221335a48323c0c810ed39816b6eec1572159e
- MD5 b6a0e4f6c6b25e2e55344a97f9924984
- SHA1 a8076a56db37a4e222c31039a298bef510cb4bc7
- SHA512 96d20914342045ca32dcfb06c6704de32bd85d5634724f0d4f0ff2671643794c39d531fa757facab616960a5a1eecbf0897b51065b75a4cba0060a74b0b0b9b5
- SSDEEP 49152:08opfrTGY57UPgOvP3euYDi4HCPP7jbbE12icFOrZyVs9mUqOU+Xd2SAjb8wC:Bk57ojn10HCrj3i21eZyVsAUqIIbM
- TLSH T1F2D533D525842442C77E247B3853E4EBF70A5221B87F6F8F1F8224498F927A2762EC57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Detects DonutLoader 2 IoCs
resource yara_rule static1/unpack001/Phantom-main/Phantom/Resources/donut.exe family_donutloader static1/unpack001/Phantom-main/Phantom/bin/x64/Release/Phantom.exe family_donutloader - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Phantom-main/Phantom/Resources/UAC.dll unpack001/Phantom-main/Phantom/Resources/UAC64.dll unpack001/Phantom-main/Phantom/Resources/donut.exe unpack001/Phantom-main/Phantom/bin/x64/Release/Phantom.exe unpack003/costura.dll unpack003/dnlib.dll
File Explorer
-
Phantom-main.zip.zip 2.7MB
-
Phantom-main/Images/PhantomAfter.png.png 144KB
-
Phantom-main/Images/PhantomBefore.png.png 221KB
-
Phantom-main/Images/PhantomUI.png.png 21KB
-
Phantom-main/Images/pdf.png.png 410B
-
Phantom-main/Phantom Technical Documentation.pdf.pdf 618KB
-
Phantom-main/Phantom.sln1KB
-
Phantom-main/Phantom/App.config.xml 186B
-
Phantom-main/Phantom/CodeGen/FileGen.cs.js 4KB
-
Phantom-main/Phantom/CodeGen/StubGen.cs4KB
-
Phantom-main/Phantom/CodeMod/Obfuscator.cs2KB
-
Phantom-main/Phantom/FodyWeavers.xml141B
-
Phantom-main/Phantom/FodyWeavers.xsd8KB
-
Phantom-main/Phantom/Misc/Settings.cs1KB
-
Phantom-main/Phantom/Misc/Utils.cs2KB
-
Phantom-main/Phantom/Phantom.csproj13KB
-
Phantom-main/Phantom/PhantomMain.Designer.cs15KB
-
Phantom-main/Phantom/PhantomMain.cs.ps1 19KB
-
Phantom-main/Phantom/PhantomMain.resx.vbs 49KB
-
Phantom-main/Phantom/Program.cs779B
-
Phantom-main/Phantom/Properties/AssemblyInfo.cs1KB
-
Phantom-main/Phantom/Properties/Resources.Designer.cs.vbs 2KB
-
Phantom-main/Phantom/Properties/Resources.resx.vbs 5KB
-
Phantom-main/Phantom/Properties/Settings.Designer.cs1KB
-
Phantom-main/Phantom/Properties/Settings.settings249B
-
Phantom-main/Phantom/Resources/AESStub.ps1.ps1 1KB
-
Phantom-main/Phantom/Resources/BStub.cs2KB
-
Phantom-main/Phantom/Resources/Stub.cs.js 10KB
-
Phantom-main/Phantom/Resources/UAC.dll.dll 259KB
-
Phantom-main/Phantom/Resources/UAC64.dll.dll 308KB
-
Phantom-main/Phantom/Resources/donut.exe.exe 242KB
-
Phantom-main/Phantom/bin/x64/Release/Newtonsoft.Json.xml.xml 693KB
-
Phantom-main/Phantom/bin/x64/Release/Phantom.exe.exe .ps1 1.6MB
-
costura.dll.dll 4KB
-
costura.pdb2KB
-
dnlib.dll.dll 1.1MB
-
newtonsoft.json.dll.dll 685KB
-
system.diagnostics.diagnosticsource.dll.dll 33KB
-
system.valuetuple.dll.dll 77KB
-
Phantom-main/Phantom/bin/x64/Release/Phantom.exe.config.xml 186B
-
Phantom-main/Phantom/bin/x64/Release/System.Diagnostics.DiagnosticSource.xml.xml 26KB
-
Phantom-main/Phantom/bin/x64/Release/System.ValueTuple.xml.xml 83KB
-
Phantom-main/Phantom/bin/x64/Release/dnlib.xml.xml 1.8MB
-
Phantom-main/Phantom/ghost-icon-838x1024-08e6wfgk.png.png 43KB
-
Phantom-main/Phantom/ghost_icon_838x1024_08e6wfgk_yMY_icon.ico28KB
-
Phantom-main/Phantom/packages.config4KB
-
Phantom-main/README.md1001B
-
Phantom-main/deobfusactor.py11KB
-
Phantom-main/version7B
Phantom-main/Images/PhantomAfter.png
- SHA256 f98525817279c20b8b2d050e557af17f5397fb8a4258d2f69fb08c572cf6e9ac
- MD5 61fcf18d2b4c78a70e7f21ecfd59fffa
- SHA1 e0dcce04b47cc6d9e3e2f95b99ffed27be710107
- SHA512 51b007b2025499a8650c70728f5b4307676d594f7145fef5d699ba69ca0ccc887aa4ec38811dd10a13224230fb7761c7b5ff369272ae3f2d38739e65a8f00264
- SSDEEP 3072:Sb9OEKjI5eeeeeeemwM0000000000W2nJzXuhXNrv34oor3kcwmh8YCXks:X3INJz+hXNkooo0h8p
- TLSH T1BEE3F1D5CC124A80C08667396CB77B8D3B742CED81A9738123BDE970EEF55941E8B8B5
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Images/PhantomBefore.png
- SHA256 320aefc35ed3d8dc049be0b89fdc80c1d0aee219677514485b6d6ddf2e212962
- MD5 9d814f1cd9e22f2c8e7c27303bd29e82
- SHA1 5e501284eeec3e4f561851158a89c3084f3cf121
- SHA512 442bf672c88634b4422fa83702a6b205ea90bedc6f280e9d72fec3950460366223349ca25e020502798df42701857f0486ea035dae6497e3b47ee1fbe5089a83
- SSDEEP 3072:Nq8Ciuz+AQenGOcduddB0QC6/x1P2tRks+Ukf3fqhv7YM9zjSEr7esFrBzQB23Kb:VuCT8DYLVhkfIv7Y2jSF61wxLPvQwt
- TLSH T12B24128CC603C347EF6F227824FA0ABF494045F682AA5270937B440CD5E5D9EE95B7B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Images/PhantomUI.png
- SHA256 b5fe0ab8d7156733113a04a1d5150964778f4e0013e8e27c1c63a8c5af6dc58f
- MD5 4777f3879bdae4f3b72f90bae69173f5
- SHA1 21f273c3e122253e3e211fae2c1a48a6631424e8
- SHA512 1448992a1cad3e9ca9bfa993e29f05712804a4acd923277b0ea4f9e027ce21528a3ab64cfc8f1d35b8dc42967d3942fda85cd77dd42d8adfed1686a510e6cdff
- SSDEEP 384:u5fjJerAunvAhmJ8fJayb6NLRwbpHfOMgyZDG71mX3xSfXxvqDg/DlESAp:wlOAunvAkJIJvb6NLRu4Mg2DGWkDLl3+
- TLSH T14BA26BD6FE96C9364E15BB8F6DF0690C48BE61B780E14477566A2CD0E47893BC202F49
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Images/pdf.png
- SHA256 ffa6dd53bf339ad403ec643db1142f4cc02b60efd3a07f69d0e08dc1d6e3a85e
- MD5 3e34ae028161bf0e75bfe726e9b2c142
- SHA1 d8ca4df553d3f4e62b9c3aa4293525365ac3669d
- SHA512 53cb656d7707435c69630585e4cb90c80b0ee6caf2c841343d8b4926f2e5efa8dbcdb32fdda8f39cc5b7cf490a3c4c4c7dd20ff3932c1395b3e72d61e50ff4bd
- TLSH T174E0F1C37BA4FB74DB0C5AFD050345B47C25420B214013443734084C5E48291D073D53
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom Technical Documentation.pdf
- SHA256 e5191629807aa753c28843418f2acc15411a4cb6a57aadebe4f95d3b70707ce0
- MD5 b81d3d29aa86a35ad9c07ebba7e1b80d
- SHA1 1b6bb89a8ab346d3a2ccfe186a17266cdca680bf
- SHA512 86e83ead5439e9c85935aa37c2b8edb5876804901f5bdce5d6f554703431113645b832d8a8e41f741d754fc95d2e721e6c51c1704f0a3c85de8f952f6c400312
- SSDEEP 12288:MDK1p0L0liZZmhEiauKrLPAU4iZkIf+vGGwNATOVeUaL:MCp0IiZiaBnZ4zGGYAr5
- TLSH T1EDD41B039C198B83A46883F8BE171EAC2F5E7B18E5423BFB44250ECB7E645525C9F16D
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom.sln
- SHA256 9e325fca586f693ac6212ff668a224431e9693ac208dc81a1571fa78e716e06a
- MD5 1fe916c54fd9fec98c2440472cca7656
- SHA1 2f4e289bb1856ffe006c9f0757ea9f654523adbd
- SHA512 0cf2593a11eb34cab862d19a0e0ac19adf4dc16da700e26d5aae48a37269c3b93be30983de5312ed1d1139a2969c955e878c5db1aeb3d40eeb030cb8361bacc7
- TLSH T1263147BFE11EC8A1994616EFC9F20FC22E736244808F1D7C129A105C2E57A19927748B
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/App.config
- SHA256 7921098e47e894412fdfd0cafe0f88cc68497740998eac17c68c00129069d803
- MD5 b51c130a957051ba9fb2245bf76fb6f6
- SHA1 42181e5745daab2a0e8cf87693142828306f9bda
- SHA512 fa2ac3eff5d51aea7acc9cf6aa018a77fae295d55c5bf808c9d7048c801baf4626568f00fb001a9f2780c46dce294482cfeb3045aabe139ddc557c0d3bc11640
- TLSH T1DCC08C4940A8BE279D338F239360C922FFF032A3A424150CF42FAB670B3115D464737A
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/CodeGen/FileGen.cs
- SHA256 f7e56a1c55590933dfefcb7a5d8497ac423286913ddd49e69a5c2d8c23b1bbc6
- MD5 9cfc2b2bbb0a1d1711b9c97f0a9a3da5
- SHA1 567b2b9b480b086deeece6c990a4c0613da73889
- SHA512 5429f2ddd88398a2fccfe8373c5c27e27a7b85191afa7cc5c7e1a51e384758619bf163c0580f0afd60ee4dbce6291a4d935302eb795d06b9e76ff2615e2aab77
- SSDEEP 96:Jo4hUXmrdfm7kdAaX4S8WoEOlDMKscOy01ucWaHJ6f:9tfaQQSjh6DMK301utyS
- TLSH T1E3A1531A7021063E6E37542597CE60BEE756A35BD3649B90B9DC1E007F39124D4BCEE4
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/CodeGen/StubGen.cs
- SHA256 df3ff6dd0227b13c0999a8c3b038dd67ff5f67e9b287f88ca0f6daeee529e8e9
- MD5 4c18cf9005e0c449c3ce3f70685c204e
- SHA1 f2e7a24f4ec0a56ea19e5e459b8ef288827c386e
- SHA512 e17d9d7356523d93bec064af9da0cea4db408ccc41babae1341c3c9621bf7c5fbff851583a07e9a3b6779752ed2bda5d0cfe3181f7cafd2a88e0a8db3814659c
- SSDEEP 48:Jo4hGezLsAAWmU9fH9PzA3OX+VTf/KHcY8qlir35LMoSmLOx8WTSAGU7nGTt:Jo4hGuLLmU9RzKOr8YI59SyOMUzGTt
- TLSH T116A1EC25780254EA2EB75853CBDB7428EA616223C372D4F2FCCF02155F39428E1B2AD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/CodeMod/Obfuscator.cs
- SHA256 fdfb6527e5f1506ec65be519d5e1272e988af2614dc3f86db5d70aea2b200498
- MD5 5ecb11d2472c3bcd2a03cb3930eb3785
- SHA1 3d10f3a21cb4c586a735aa96ec9274f9a16e4caf
- SHA512 827c6658ebd49def69cc0733bab2e0c5c3f246268236dfea216196d091fa684276436ea4a333ff2a4b808deea045a8adc75142dd6fa53f420832646db0e979a7
- TLSH T154516A0A6C06598B2D73292BBFCE9550FA7A632312B361F4FEDD56451FB44288270E7C
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/FodyWeavers.xml
- SHA256 79c688c8d3979b439dc068443bb78d27d43ee8d3fde0383812de633303e2ae4f
- MD5 a5a83d4f3a7c54dfb9f3ea972686c685
- SHA1 d6ecb6a18b77a5d1531302b8bcaaa0442d02ab8d
- SHA512 e616603fcab1ed87630a0a66c98244d2c286045f16cf81241f63ee7113ffb64c074595828acec6ab800a7eef0615db50b1f3782efbb0e5e3faaa21bbaae1259a
- TLSH T12FC09B7C827444076B2F9483D1515459315291C9ACC04BF7F565B94B7D05189615365F
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/FodyWeavers.xsd
- SHA256 a24b0566e764a5d1ffec375067f0c0521cf7fe950e98bf9684c81c59dca25a8d
- MD5 e1748f1d36ae87d46b4efe6b8e6a2874
- SHA1 2248378debf8d32d7b5194fa241819bcb02d39b1
- SHA512 fb397092af27f660db1276451c26e909f02c53e8d82b71dfdcc733ec9f3058573c9f72eb62e3a186930590ee24bacc7faddd44861dff75e25456b15f1d019617
- SSDEEP 48:3rX+3yoF2+Dyob22CnivQwSdqwVeVJTbJfeFLf1o80SY6p0uOMDMvgQpgPyThALq:7ayOtyusivQ6QMoJyT4yFDMsT
- TLSH T1EA027BE451C4E6A63E2741337D32A049FE14612796F16E51F08C533BDB24CB8A66FA37
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/Misc/Settings.cs
- SHA256 68a91e8e64d901be6fd9d5454b538c883d8bd1e6d84c72cad0594b11e7bd0719
- MD5 31a43879aff8fe3f64f5ab6c683728f3
- SHA1 d5df553895bca1a10909ee1064c61bd4640dc051
- SHA512 6b2926f9d60ed910567bd6c5fae275484c4a995a2209432995785660bcfcf3367f96930dec394d646d5707a8dcafb23fffa70886e3e72aacac0a24eaa512216f
- TLSH T13E2138072713CA14053216B6ED61C189EF3758E302BAE064BD9CA3401F36D199274F9E
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Misc/Utils.cs
- SHA256 74e9d0f2602d23d82587d6c6b2250f60fcbc0588eb68fe71d898a88f895bcfef
- MD5 afaf1fc6c5f67b3cf601c79281e8a0b4
- SHA1 1a7d5df99554c4a271fa1f3aef418efb3138d0c0
- SHA512 8d2109ee35681194d8de0b5902ba490e4df8c254893080812fb39c6082d369ac9e5266eab1b3605737eeb3074a4fce7d597dd401623e6379ff5cc4581baef483
- TLSH T1E5519B292D1BDB6906F3A22FEF669204FB66672712938B99FEDD45100FB10144274FE8
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Phantom.csproj
- SHA256 1c10175fec4ac679eb022e7c6f541a32f1323c9dfb4bed17b382657db3210465
- MD5 44ae25b677449a6611e310104794c0ec
- SHA1 40136075240c0fb3395697be1aaf05b2a53c62c8
- SHA512 953eb34d47b4bfc015f21237832e23e031e27bbb9ec366c19325cc47e104b5130c46478a26ff46eb00002c8aea5c562d814cab392e60a104bfa8a89c99e22465
- SSDEEP 384:7AZJ5NLiNt8FBnN1ZN9/NhaNS9NUzN69NrqNS8NolNHVN2ENwPNcoNTgN0UfQ0He:7AFle
- TLSH T15C521430E2C8F6A40B7106268593970FDF5913A7269458ACB7ACA24BCFB3D4B4363577
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/PhantomMain.Designer.cs
- SHA256 1431b1455f74a99cef6bdf8b94ccf0eb81a9bd6f434562411f6602561099424a
- MD5 3636a3200ff80a8d8d4da550feaf3ea3
- SHA1 d2f7c49697a8282290ddb0c0207025c8b6ee75f3
- SHA512 9c55362a611a35144c1eaa69257b8146d20445247a403fec34470a59e9d688ec189a5c33f8d8ea69594ce17c14766f6a77b4d7056bab9036345ae23b837b26d5
- SSDEEP 384:Lw1XS0Q2q4Wp3LlkKoAq4ESo0VUq465Yq4H1Iq4yKfJ248QdPhq4YlZq46tc5NqT:s1yb9
- TLSH T133729D68136E8659C5F6608D9F1A9680DEB9022B7D578F1D388F87C4DF770380339AB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/PhantomMain.cs
- SHA256 67a4ef46ec4fe9337e6553c4cce38bd4283aff0fadb105e8b57905fe138c56e1
- MD5 3fd47940d5fdb521cf9b35d673df8bf2
- SHA1 7646af1c1baba9026d2814b7946b76811326d1ac
- SHA512 2505204c96ef7ae2d750885b4470dc414edce13d33e670cfd000cda244d4708d1ce9a89c949b62aae142212d61c15af3f45e27188c47d7dd69ec3a76ad2fc7ff
- SSDEEP 384:YGLb0fevedgHk2Zg6634Qx6SaHCSAOz+Gv4bj78:XvedgEag6dQgSRS/4g
- TLSH T14F92942929069A6B8BB36236EF92650EEF26021F57556020BECD02445F7442CD3BCFF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/PhantomMain.resx
- SHA256 d8b31a52c96c8edaeb81c2a00fdb674c667e5484f00e4ef00fb5fb9401c68e5d
- MD5 31330e89876596da014df48cebc478f1
- SHA1 c79df82f42704ca40ea56faa30cfa20d78f8c381
- SHA512 b185cb6b95e6f7cce4ed54db3652739422bd43e932b802b110d109cd7cd400ac50189fc352b78857deba05e66b97afe514eeff754abc16ad30c129a173dda0de
- SSDEEP 768:KjXdskSv6bNZFLaLLC2WU/vsicURi3XhjJt5YxJxEqU316Lc1l:Kj2v6bQeuqci3Xhj5g/E733
- TLSH T1D433417998426E5B15BC350433283D79EC6A2CFFC52CF614708C9BC9FF3DA9968A9094
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/Program.cs
- SHA256 96b5c9e84244586a9d7b17fb58a6b23a6f3e73bf02857b31bb59262bf351f958
- MD5 848b20c77a1522c0d6cad1792827e3af
- SHA1 57a13c1bede1663fce8507a9e927e23029894d65
- SHA512 0fd51c30f7ba52d2d9faafba9cf2ee4b2ae4bf8ed561ca798593b9cfdb0c98b2cac1bcb67ead9b7f70574d83fea96a3083094a30232a993c01952ba05bd14be2
- TLSH T130017B5971CEE785D9B7007F6A059084DBB7617B16BE3214F99C4242CF370104339E5A
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Properties/AssemblyInfo.cs
- SHA256 c93790635ed89f5b47b7b818f525823c72c678439afd7b9abbf7285b9c1c2ff9
- MD5 8e1849ba18bb298b640f5e96bfa4e267
- SHA1 830209a4f95de5905c0dae8d05ad16d54d0a540b
- SHA512 d4303991a6f59fb935a944341afdc34c62870a7f1746041288b3554ebbfcec036b87828aee903884f0405bc002f37e6aeafbcbea0e0f347c48debd289f350090
- TLSH T130215C2D6341A37E8F510193AE6B35C5837D732892FA0C4935BCB853E601B7843A99BB
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Properties/Resources.Designer.cs
- SHA256 0ed13a52c5f459731930a549e8f722dc64176915904f1e41eefd2e1d1d28214c
- MD5 ef6badce8e1c797d0c1a66afa37aee94
- SHA1 6a10f8a888164ed705fd18b93f6bbc02dbbf2d89
- SHA512 0ec64d6f93ba9c54abe5eb4aecb270dcffc034ee6c84da17ced741f1124fe63f777744dc8253eae13c72229cc87df51db9ca20d193440670f9b5b91dd6dd8573
- TLSH T11451CCB75F94C1320D34D59B9700F451CB672123C63DD878F8AE02655FB6390436EDAA
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Properties/Resources.resx
- SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
- MD5 0cd8c971317d19bbed44757809bcb92b
- SHA1 47b15748ecc8e952c5935170090db7c269ce4b4f
- SHA512 883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT200qSdvabvDIwQBugqvA:KjrbLPD9sLvIzSvKgIqUEa2
- TLSH T17FC11245B1C09D220BF3482DE6527988F7A8923B0235AC54B4DCA61F5F73C85A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/Properties/Settings.Designer.cs
- SHA256 34ce94e197d9ce2699088be470c2801824ffe526ba17434972c025ee00f41135
- MD5 ece66f87435aadd5b213ed02cf406abc
- SHA1 2978866be273be89edce4083044d786d8ae5c647
- SHA512 1aa979b0048f443cdd94d5bf6bc6607ba4a4ddce9b7bfb274493999b2bf2cfbbe8efdfa1435baadf7562b7679404d00f9324b4ca054eff930a9d0a8d1de981c9
- TLSH T19911CCF53E91C7370176E6AAD605C163CF32123BCB2EA439318D4205EF3644483ADEA5
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Properties/Settings.settings
- SHA256 f6a4290723520caddd934b8800319c7ca6cc7eeab647059ec89b7a13b1513265
- MD5 8c0f00d7d9b0046695a0255f1b11b061
- SHA1 5e1d04de66ffcc5dfd813530ab6992e6daaae417
- SHA512 a95c07dc3241b7c9f37b7f0a5c143c9c133c3bcbfa16e4a689cf47f45b3e9d0ccf5c965143a6848237e7a9fa8deecb89837dc12b12fabd8231fe94f3ccba26aa
- TLSH T1A4D0A78994C8880693313970F468E13C91106757046A95647164784F15071D612D35E7
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Resources/AESStub.ps1
- SHA256 8ecc8244bb15c59e89e3a3a2326fb2ae92816fe3201ed904a3bb2d892b9c970d
- MD5 ba2f921c5680bac542e2d7baa49084f8
- SHA1 69714c121be7649ae3781e93a3b871db54233f7f
- SHA512 2f8f4a2d26f377d8c494907ae006771395bcc21a18f44873b431752c8f61d79e0661d318deccf25276db02f26f117b894b75eff426d030d342e2cf586be7c142
- TLSH T1B331EE3C3513A6E896CA6CBA0C3F924A8F280202B219CD45FBCDD645967D9B417B11DE
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Resources/BStub.cs
- SHA256 6ae095b5efb670be2a61bc064869e6e043a4e668f12dd0f863890222ae0e1cee
- MD5 79c081380e21bc57dbc670a48e40f65b
- SHA1 e93613e679eff150a9b8fa10c7c6c19c046898cb
- SHA512 8d10b02357ba63c4c2f9433238eeeaf88bc54d1eae9e37c14e69936314c2a436cb24133b5bb2ebe6da6a712be18def2d7c424be1cc308f17b63bfc38e14d7be5
- TLSH T1DA41CC502720771B44F3241CCED9129AFADB60FB4EBC661175BC44909FB85718E3AF85
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/Resources/Stub.cs
- SHA256 72fe623abff74a874fbe59803bffd0bb3a480ef27300809e0b7613a5e2b2f9d7
- MD5 c460169f89a7cd024ccd7e837af97dc5
- SHA1 b1cda658ee41289e191fe93fb9bfba45755108fe
- SHA512 f1ae167996fb2d08655aca608b45a0a599c95c01a5f57ffd2e843b839818877e64bdf79f425dfd20addf75b9db5b56e52b16331d93a988bdb0ab0c9e334adae4
- SSDEEP 96:JoOUwX11c6zyVF9vwcdMwkkwaFDEDLqdYJEFH1S86jHB4xkgLaGc6jK0lidP+rBh:K7MwGaRLHkzjhABa4j3qQIi5KLV/Xqp
- TLSH T1092273592815A77A48F3222ECF668609FF37122726F24A64BADD81406F7806583B4FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/Resources/UAC.dll
- IMPHASH 993e3fcbcab0ffdde9d950113c2f613b
- SHA256 2907480701d5cd8b3f1577165d59c6321dd172ad6e18e96ecc7b95c67e4e450d
- MD5 40ecf3b9627783b858f342b765f91780
- SHA1 91f073a86e47fd09c27b856b975f1ce4df9e6646
- SHA512 fa76cf04b10cc1565362cf8d052c170f9c1ff62bc78d6c1bb96ad335ef438f113ad65bac7602017ca446fa19066c6ec6dafe2e64a3224373c2e8d8ad6c1d14a6
- SSDEEP 6144:ds7Pz6MhtyuqCxevrwP4fJ8JIiI9Npm62mvFsQk3z8:d0q04h8vIjpm6TY8
- TLSH T18D449D42B981D0B6C55F00352029D36AAB3E76104791CEEBE7D09CB94E7B3D18A35B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
150638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
CloseHandle
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
GetLastError
GetConsoleMode
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFullPathNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
AcquireSRWLockExclusive
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
GetCurrentProcessId
CreateNamedPipeW
SetThreadStackGuarantee
GetCurrentThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
DecodePointer
SetFilePointerEx
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
InterlockedFlushSList
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
RaiseException
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
bcrypt
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
DllMain
WTSQueryUserToken
Name
.text
Size
199KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
46KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=29395,
count=136, id=261, version=29395,
count=20, id=260, version=29395,
count=31, id=261, version=31823,
count=15, id=260, version=31823,
count=19, id=259, version=31823,
count=5, id=257, version=29395,
count=113, id=1, productName=Unmarked objects,
count=2, productName=Unmarked objects (old),
count=1, id=256, version=31935,
count=1, id=258, version=31935,
Phantom-main/Phantom/Resources/UAC64.dll
- IMPHASH 230c2064c7853810ac54060ba958b0e7
- SHA256 1abd799ba4bfee25737243568ae048c0b50f1892b41d7e0f7b3c3af8410babde
- MD5 130553ce2e4112cf59f9cfecfb81fe75
- SHA1 0ec3164f9d3ee5baab8e3862e1b499941a072e5c
- SHA512 50b78c5974147aa1c7e9445bc23490e01f1fc9cf7968040ae27216c34b54c09246409bbcf1a1e5e3f25efcb87906a27386175ea6f911a8e87adbb6d3e2781627
- SSDEEP 3072:+5/t0CPqIvxojcC2QYizfp74RRW+72w3jLYRtx4+O2CvvqFyhvIL65Bl0gdB74ip:KtHlojfpZ6T7PYS+6vCFy465n1Wek
- TLSH T1C2644A15BA561879D16BC13882534A627AB67CC20731EEFF12D462393F3BBE06A3C754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
167932
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
CloseHandle
GetModuleHandleA
GetProcAddress
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetStdHandle
GetConsoleMode
GetLastError
WaitForSingleObject
WriteConsoleW
SetLastError
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
GetCommandLineW
CreateFileW
GetFullPathNameW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
AcquireSRWLockExclusive
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
GetCurrentProcessId
CreateNamedPipeW
SetThreadStackGuarantee
GetCurrentThread
ReadFileEx
SleepEx
WriteFileEx
ExitProcess
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SetFilePointerEx
GetConsoleOutputCP
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
InterlockedFlushSList
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlPcToFileHeader
TerminateProcess
GetModuleHandleExW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
WriteFile
bcrypt
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
DllMain
WTSQueryUserToken
Name
.text
Size
217KB
Virtual Size
216KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=29395,
count=133, id=261, version=29395,
count=10, id=260, version=29395,
count=33, id=261, version=32420,
count=14, id=260, version=32420,
count=9, id=259, version=32420,
count=5, id=257, version=29395,
count=118, id=1, productName=Unmarked objects,
count=2, productName=Unmarked objects (old),
count=1, id=256, version=32534,
count=1, id=258, version=32534,
Phantom-main/Phantom/Resources/donut.exe
- IMPHASH ef81b9a18c758ad2cb875d81e1e4b658
- SHA256 ee68d7deb7cefdfca66c078d6036d7aa3aa7afcc62b282999034b4a1faed890d
- MD5 2a516c444620354c81fd32ef1b498d1b
- SHA1 961d3a6a0588e654dd72d00a3331c684cf8e627c
- SHA512 e8e4bc395997eb6e83e147816faf00ae959e091acba6d896b007781bdc9146157d049d958f9ff7b71a746ed681bd4dcca2fd84aac3eb76c4afe41d49e9f7bd2a
- SSDEEP 6144:ZiF3dWaGNQzmzbgONa3sbMMnl6ysB8X7+AAAAAAAAc8:gFdWaGNGGLUWl6JB+A
- TLSH T16D347B55B7A510F2E8B38234C951D716FE727C5503709B8F23A81BA6AF632A07D3E790
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
34432
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
user32
SetClipboardData
CloseClipboard
OpenClipboard
EmptyClipboard
kernel32
HeapSize
GetTimeZoneInformation
FlushFileBuffers
ReadConsoleW
ReadFile
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetModuleHandleA
GetProcAddress
CreateFileMappingA
GlobalAlloc
GlobalLock
GlobalFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
SetEndOfFile
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwind
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
MultiByteToWideChar
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
WriteConsoleW
Name
.text
Size
139KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
37KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=29395,
count=158, id=261, version=29395,
count=10, id=260, version=29395,
count=3, id=253, version=31823,
count=40, id=261, version=31823,
count=17, id=260, version=31823,
count=9, id=259, version=31823,
count=7, id=257, version=29395,
count=112, id=1, productName=Unmarked objects,
count=1, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=260, version=31937,
count=1, id=255, version=31937,
count=1, id=258, version=31937,
Phantom-main/Phantom/bin/x64/Release/Newtonsoft.Json.xml
- SHA256 2d46b37b086d6848af5f021d2d7a40581ce78aadd8ee39d309aee4771a0eeccf
- MD5 f414b3f68fe7c4f094b8fe8382f858c9
- SHA1 66ee1b3266fcedde433b392156ab4a24262b2f34
- SHA512 19b2feb40c2e9d4d20d9a21f88f6ecea773060c056b8cbbd21a6eec41486dc5fc101e6c31129b0d53466d04709bcd4ed777058ddfb02532242b43e253a7b24bd
- SSDEEP 6144:XqqUmk/RikeaG0rH3jGHdl0/InHHpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DUq
- TLSH T1F5E4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA652FB6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/bin/x64/Release/Phantom.exe
- SHA256 ccfaf90ce7a8a6b43308fa01f200fe041b545e198edacbfeef11c475ddcfd36b
- MD5 8a26090dfa6ba542f8dccb1615928ce0
- SHA1 cc95636bb8e773f9470c49f135d844af6569c3b5
- SHA512 886426a2b0adb1d4f512a8e0c57dc469799056703960f91b3caa06295d529ff0fd1b4696029a19096ab821869d1309aaed088c7e691a03bf6c7fa3d0c99371c4
- SSDEEP 24576:7O00V4h8gtKm7PMWXWArwboKdpyuw5D9wJWopfw+Jwz/S/6R:BIm7P/GoMgt52Wuw+W7SCR
- TLSH T16C75DF01B68158B5D06BA1388532E222EB357C6197A0DEDF33D8397A3F377E06A38755
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DonutLoader
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
costura.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
- MD5 501981c7fc457d59238eb99780efb615
- SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
- SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
- SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
- TLSH T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.pdb
- SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
- MD5 34b42a5776a3ad022b429124d55e576d
- SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
- SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
- TLSH T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
- MD5 SHA1 SHA512 TLSH
dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
- MD5 508ccde8bc7003696f32af7054ca3d97
- SHA1 1f6a0303c5ae5dc95853ec92fd8b979683c3f356
- SHA512 92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
- SSDEEP 24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
- TLSH T1EB356B0177E9AB3BC49E837AD432091943F2D40677A3EB0F1654EBB92C837959C217A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1167430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
newtonsoft.json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- MD5 081d9558bbb7adce142da153b2d5577a
- SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
- SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
- TLSH T1B8E44A0633E88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:83:93:14:a9:06:f5:64:04:02:a1:dc:eb:a3:1a:a7:e9:21:c8:88:2c:dd:c2:3c:e4:c0:45:50:4c:ee:75:10
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Mar 17, 2021
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
698886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
675KB
Virtual Size
675KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
system.diagnostics.diagnosticsource.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a83a46fe737c51694b9dad4e0ccd004a3c0b3e6e3bd5d595ea1f1d4b14bab417
- MD5 e420f9b08dc6f2dc5347fdbec71ed523
- SHA1 c4d265ab43a8edb710409fcefc6fe4b03f8f469d
- SHA512 35788ffe1450b7a944849e1ce1a60acd1068740e62a8f610d4897843136745bc5c88fd991a225ecc007b49741b68d3ffc18c1674f7e9fb76f84ebb55c980861e
- SSDEEP 384:luMc+PVo0TkTPLj7oUwQsqmJIQISd5MlLmWJbWBC77q0GftpBj6kERHRN7FxlBPv:VrVd4TPLjwQt+YSdyJidEBFNv
- TLSH T121E24A55DBBC4653DEFA0D7076A8C8433936EB836820D70D1A99E5990C937D4DB20B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
2e:fd:91:16:f5:70:ee:83:1a:3b:c6:45:c0:92:68:3f:c0:ac:bc:7e:e4:8d:0a:84:a3:13:89:50:0b:ce:66:ea
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
1a:a2:21:ac:7b:62:61:02:67:59:a1:1d:35:b6:12:a2:33:8d:57:c5
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 5, 2016
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 18, 2016 - Nov 2, 2017
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 28, 2015 - Jan 28, 2017
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a1:a5:fd:b9:ee:a7:fc:9e:9d:00:00:00:00:00:a1
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
23338
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\netstandard1.1\System.Diagnostics.DiagnosticSource.pdb
mscoree
_CorDllMain
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
system.valuetuple.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d6fb0dcfee1490a8168117ed1b55758f11db38475417b3668d19f89dcb55cbdd
- MD5 99cec77dbee0ab10b9fc4d52a1d414be
- SHA1 c83d024e80c36b663458d478dfdb067336e2d616
- SHA512 988b0ff9ede87fe7538b2e0cdd684962965b4fc2a4f0fc92726248f249cacb7c5674f3978d2d7cbed68991c71e0b0339d6edda57384097a4da8efd7d77b43cd9
- SSDEEP 1536:h784YWac+abptsy5VyYc/9n1RcGxzeeUVn9KyQgHo0JuresehaA1VUF:h7N1r9KGI04CCAP
- TLSH T1D173E82C23583653C73E843318A699C7AFB8D30BD74657BB7DDAE5E818D2374A302664
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
50:0b:9b:f8:2d:1f:dc:2c:85:5f:8d:44:8e:f0:06:34:42:5d:c4:9a:fc:6f:51:5e:c7:96:0d:06:3c:1b:20:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e0:5a:d1:da:4b:60:60:fb:28:f2:b5:1c:59:6c:d7:66:96:16:eb:e0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a5:48:17:72:27:f9:70:be:63:00:00:00:00:00:a5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
68586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Phantom-main/Phantom/bin/x64/Release/Phantom.exe.config
- SHA256 7921098e47e894412fdfd0cafe0f88cc68497740998eac17c68c00129069d803
- MD5 b51c130a957051ba9fb2245bf76fb6f6
- SHA1 42181e5745daab2a0e8cf87693142828306f9bda
- SHA512 fa2ac3eff5d51aea7acc9cf6aa018a77fae295d55c5bf808c9d7048c801baf4626568f00fb001a9f2780c46dce294482cfeb3045aabe139ddc557c0d3bc11640
- TLSH T1DCC08C4940A8BE279D338F239360C922FFF032A3A424150CF42FAB670B3115D464737A
- MD5 SHA1 SHA512 TLSH
Phantom-main/Phantom/bin/x64/Release/System.Diagnostics.DiagnosticSource.xml
- SHA256 d0da84ec032a02c3ebc1b319bc990b79cadae202f034f058ea2689b8bf425fc5
- MD5 1d33622904d33c6425ea36cfcec41caa
- SHA1 fe6dab34666b7004bcd98ab08dca7f455b26ec06
- SHA512 6996e3d152b52e7d84a1a6f5677f0af29cc032c7c2b5215260e81caa49f19139b6b08b7440dc54315c26b362ba2fac4f3d73bcd7e7c5f9ba79276161850e7faf
- SSDEEP 384:VsKIrXkz1ukSA8Q3vK0mNRIwHtL90/6q6M:VsLA8Q3vK0SY6rM
- TLSH T106C2433BF7C48A280C7703227B44F4C4E62659AB103198B9B5CC9FDB5F32CAA576B495
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/bin/x64/Release/System.ValueTuple.xml
- SHA256 b5c69cb0668b009900333ba825e11e70a5c0bef1d06f934f9cf60889a027aa73
- MD5 4a8f5829752a0318a5ad38df9b18153d
- SHA1 5512017e7f643ccbec19d5713afa350ba22e0a0b
- SHA512 98897badef2e894de5f2a1029580dc44fee6fb98118f3dd5f477f99462c366c49d2345b277c02357703777bea04e5e5a6c109bed4bd0f7bc5fb861e1aef67a47
- SSDEEP 1536:xAsWY2MqXflh1jBmumYGWIzHcG37XxYzdSgESL9UW6lJMI79mARgg59ae9Rice2L:zL
- TLSH T1EC839E3C7BC88A12447606015E24F585EB3A573BA85BED1034CE6EA31F77D9362FB885
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/bin/x64/Release/dnlib.xml
- SHA256 db38da18a628bb610c4dd3f072e729c74c7cfb6a3fe5ab2840beab09c0b3d336
- MD5 a6af65e52c0dab35380c2ef1befb7266
- SHA1 827cdefa74f52fb527561796b45bbd175a74e151
- SHA512 200ba9ef98b55875e901c1349677ed2f592e1043f43700ab7a6c503cb7490dd7ad0084a4109a19a6c2f812c30db0248264554a8b109d998e58921106a51d393c
- SSDEEP 6144:VGe+Hpg6Ii3grOok+XhR+y+cNUaOtCX5n:apg6Ii3grOmXhR+y+cNUaOtCX5n
- TLSH T14B857714B6C2AD121C36525B9E64FCC4FE550C33604A2E19B68D2F535F7ADCBE2AF920
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/ghost-icon-838x1024-08e6wfgk.png
- SHA256 8977552bef13bce1f3188f77fef23bd3d6e9cdc4214c55d3ca411e9daa41f430
- MD5 7f3176c46ec5582b9427149778c93c66
- SHA1 fa3d8fe0eba2cb943fcb163707b1c52aa9ddb670
- SHA512 fbdd816364e9515592230de90ffc56dc55d85d7b75502da205be4562b9dd50473599b477a6dbe04fffdf9cf5b4a4978b4cecebbef3e9f3b31fbf58843daa378c
- SSDEEP 768:fM5nRENwFgOrcEXTaC+foTnBwpgmXFIyv5FrXDw83ZqKP:eREmFDcUeJATn2CmX/jTVZlP
- TLSH T1F013BFA40B07D9D4C0C1BD144846FBDEEBAEA1021149536C04E8D3F5633AF7FA6A6F98
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/ghost_icon_838x1024_08e6wfgk_yMY_icon.ico
- SHA256 0f87a945b14fe317422fcf55ca55f15c34867095929f9dd76c38f6bf6631ae53
- MD5 c7b3f9a77d9c8800bb2468e13215ab9d
- SHA1 34799fefdcc65bf5d9c8a426d6630f80546c43b0
- SHA512 776fb835c391927c9a1a7f62c60d293b4ba5628412add2390efef8eedf84216b2585eb1676d33d8ba815e669865b774657080ac3a439602446d4fcb8fc123ea5
- SSDEEP 384:4wFfr0XUXUm5RYbzg0QU9oqS3IgvwOGk1nyBF2nEMD:4wEm5RozVoxYQEk1nyBIr
- TLSH T1FED294887A07ED45C84473BC4C36F1F6E22CAD7AF9D28B8326D07E6B3F71894A815056
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/Phantom/packages.config
- SHA256 7876395d4d7d238de998efa0e7a3d0a5db24488c0a9e2d697b2d95bb215c2b8a
- MD5 fd159ba1a9e7cd28778a6a36d6f8620b
- SHA1 5e57962aae1be251f3c89b001cc9cb1cd7d22037
- SHA512 214aa4581c4f482b14d455f7c5e7fbe06186ab96a8f04e2751c9a2caaf6c74a176610353661a382e9ec1481e1b2512d6baa881f9bf14e626cc2b98c730874867
- SSDEEP 96:zIHcHv7HPHzoHzbHlHsHFH1uH1NH0HxHAH7HkH3HvHTHqHMH2HpH+HMH5HSHnbH3:zI8jvs/FMlVuVNURgbEXPzKsWJesZy7X
- TLSH T1C491C33453ADB7FE43226EE2B7BA41051BB865A6F9214ADDFCE10206CB63445C247B87
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/README.md
- SHA256 2de27bde8db9b703873e9d567c98f9780da5a2a7c194419197645bd0116f3961
- MD5 a04c4f1d219db349f1c8a05b5dad256b
- SHA1 a5eeb904f10c0a50137b411c7e4d814c05f1da68
- SHA512 9e6192e945f403c58ca9709f7837650e85e582a4501ace04d8a856a867015a17b1f931fd5555199574bb1eb55071d86129062273b2d1bb21782f47f137b3834e
- TLSH T1BE110EFA74C4368727B3C8D3B66572E8DE21A07AF52492ADA4144818918123322B623F
- MD5 SHA1 SHA512 TLSH
Phantom-main/deobfusactor.py
- SHA256 ae142a2319c78fe6029e98e961df6bb6d9f907da3c4aff61a322f70fd3ebde7d
- MD5 e1538f8805616f328560718829a528ea
- SHA1 8fa50535e3413e195dc7d7a488220c174490cc8f
- SHA512 88b1feee723947f64c7d69b81afa298b2e53293e8069f53a869acf82025914e5d99dd3089ece6243a0be97803ebd2d1815553d05bb229c987019f270a50d95b1
- SSDEEP 96:P74STPxJY0Rdak5mQvYf6YIDroe7EqJR9eCwbCEn8F+mIdPSmiFuSez5vQwFB2mE:P7FY0IZcrEqJSjy+m+DdoePTQxj
- TLSH T10B327223A8A0A5F4C3C7C56D8D69E40183267D27A6056674FACC86D84F9823DE3B19F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Phantom-main/version
- SHA256 145aabe1106cd123b7123194b94bcf8bff4442caf1c5336c3e2c9c671f4895ca
- MD5 3d39e0a89ee3d3e45c2113b2c8d4542a
- SHA1 04132f0dbc5bc8b65c6dd9044312de63cb6e7e75
- SHA512 a7240b782985d20c8bcb6d11cf5e5da4bd871bc5ada6cf05a21da8792828bbf839e68a141923c22aefa3e28b16b97f2b09d8e25199da3119cb04120132c3f4e1
- MD5 SHA1 SHA512