DebugActive.rar
- SHA256 9cce0c2b35acd5e1dee77248adaa50484663364bc60eec33152fb3b586e356f0
Overview
overview
5Static
static
3Microsoft....er.dll
windows10-2004-x64
1Microsoft....er.dll
windows11-ltsc_2024-x64
1Windows Activator.exe
windows10-2004-x64
5Windows Activator.exe
windows11-ltsc_2024-x64
5Windows Ac...st.exe
windows10-2004-x64
3Windows Ac...st.exe
windows11-ltsc_2024-x64
3XylonV2.dll
windows10-2004-x64
1XylonV2.dll
windows11-ltsc_2024-x64
1dnlib.dll
windows10-2004-x64
1dnlib.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Microsoft.Win32.TaskScheduler.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Microsoft.Win32.TaskScheduler.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Windows Activator.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Windows Activator.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
Windows Activator.vshost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Windows Activator.vshost.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
XylonV2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
XylonV2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
dnlib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
dnlib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target DebugActive.rar
- Size 1.0MB
- Sample261027-das9yah13z
- SHA256 9cce0c2b35acd5e1dee77248adaa50484663364bc60eec33152fb3b586e356f0
- MD5 32c45a20d49a3619197d8e110778c5be
- SHA1 912fb514bfddc1d786a83aacbbb101593c9965d2
- SHA512 503205250eea1299beba190b850372bad251c7fbf5a2397d5ad443b96ad7829286c21e96d4301f552f4f9de6918c1f5e9da2a572669ec4ef8853f90d9e067ed9
- SSDEEP 24576:EhyAm3bTU9CcwNK9fx/Z8CC4Ill+/Rfev9QCJcjQrTaKrMW:zbTUQzg9ACC/l+01Q2csrGg
- TLSH T1F835337B12511FE55F19DF6C930CD21C20B2ED2D29A2A44467789836D6B872ADCFB3B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Microsoft.Win32.TaskScheduler.dll unpack001/Windows Activator.exe unpack001/XylonV2.dll unpack001/dnlib.dll
File Explorer
-
DebugActive.rar.rar 1.0MB
-
Microsoft.Win32.TaskScheduler.dll.dll 326KB
-
Windows Activator.exe.exe 81KB
-
Windows Activator.exe.config.xml 168B
-
Windows Activator.pdb67KB
-
Windows Activator.vshost.exe.exe 22KB
-
Windows Activator.vshost.exe.config.xml 168B
-
Windows Activator.vshost.exe.manifest2KB
-
Windows Activator.xml702B
-
XylonV2.dll.dll 1.8MB
-
dnlib.dll.dll 1.1MB
Microsoft.Win32.TaskScheduler.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5b666551577fb620852ff99a39227523db5828ac87f18652888964212531de38
- MD5 0fb404d7b251840e2847d8179937dfad
- SHA1 1f1bc47e96e57a200985055f18babba5ca8c1d88
- SHA512 7f8802defa5d02bb058ad75af80615995932fcde5bf53411a35caba0f40cbb66e84e2335db594ed4963fb14affa5b25e44a45e89aed0b3e556842c836eb4fe5b
- SSDEEP 3072:q1sSJAlTaQU/x0Ay9ODGHfs4zbYvRc5JeTKYmKMKNXj9HIaKlay8weCycJ5Dfwrf:q1sSmlet/xMtsvR1KQfNXZIKZ6
- TLSH T126645A6167FCC32ADABF0B39E471021187B9F806A56FFB4DA584D59B5C237809922733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
339318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb
mscoree
_CorDllMain
Name
.text
Size
323KB
Virtual Size
323KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Windows Activator.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 71cc3868083542d757f8350a5b0ddd53ad49d1ef60267d5f382b3d05c6768a35
- MD5 ee3daed10ed6ae8e9dafcfe479eb97a8
- SHA1 a03b33b8a52485950089b0703503cb4065962ed5
- SHA512 a752b16810079fa09dd0fdd363e3f5e6795cf56b3cf36ce92856f28674a556e447bf66616bc92906aa38ae5734a4a0b63001fb96c49733bac740985553f0eb70
- SSDEEP 1536:dq9pAajsQy+xSpt2f75SwkRF9L3VjcOuplP6VvgFWc:dq9pAajsQy8SP2TIwkRF9LlCjumWc
- TLSH T12D83733506FD2951E0B79BB567B121D4DB6BFE321E05DD3E28C0120A86F6807BEA1F61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
74686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\hamoo\OneDrive\Documents\Visual Studio 2012\Projects\Windows Activator\Windows Activator\obj\Debug\Windows Activator.pdb
mscoree
_CorExeMain
Name
.text
Size
65KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Windows Activator.exe.config
- SHA256 1d01507c8e9b3a25fe47e14c4dbf897054c0207ce5e6834d8be9c4a9ff399ed3
- MD5 24708262fc6cb48e3f154fe26610c9ef
- SHA1 016243da38e1b8b8f49c57516055a236fb08c2f2
- SHA512 d6c60d703fdfaff21fd3be749ad1fc6b47bc16c9128cce0c9e122b0cbe72a6d8293363bf441f9b0bff9685da73d14e4c825b5175cc0a428415c4da8b72943ea5
- TLSH T14DC08C2944ACBE269C334F1362014912FFB00292A024000CF01FA7030B3104D4217326
- MD5 SHA1 SHA512 TLSH
Windows Activator.pdb
- SHA256 928cb992530d5797b1541d16447b49a316803b7e9dde69a78fca2d2a943784f7
- MD5 31f24649628456f8648be1c8dda53c4a
- SHA1 cf1884f2f36cb38dfa827f1613ce0524fabb0227
- SHA512 18618bcbefe6d5089315680e8b7b69baf6993ababcaf98e10b2524b2f76db112996c453df0afab12305660503e9f73d0a65c2d9c3f24b0708ed38a6f6458f5c8
- SSDEEP 768:78Diga9hf+ogcsteVZFthZjpz8J9qKvkrE4U3OXHod7hBN:78CXPsteBfHoT
- TLSH T1FE635205A799D532C06A6B39977BCF0D9238EC806F9F871B2784742D7CB33026F86659
- MD5 SHA1 SHA512 SSDEEP TLSH
Windows Activator.vshost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f4cefed49fb2f58655cde4c216f4e52a1f2aaaea0b5809664a97f075026f92bc
- MD5 a219fda38d52905ccf484f9f300b69b3
- SHA1 d3526d48e7306b9b3f0024ff745bb774a02be9fa
- SHA512 223023a8232029325ef037a285ac437ae77d8f3b4af759119e6b2e44e5a9f0efb973c1af8d5df125aa2ccf33e0b9d804f1c1f888fff36c0f400167294fb34081
- SSDEEP 384:p3pgEPZdWIBWp1ae00GftpBj+czFtAHRN7vlR8sx3I:pZgUb4asiFE3hx3I
- TLSH T14BA23BA5CB6C8143ECA39D7063E9EA837C3CD7C74D61A95A049AF5991C833C5EB24728
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
22:64:5f:e5:cf:38:f2:a2:a8:69:b4:29:9f:d2:ac:e1:72:43:a2:c4:35:f0:35:c1:ce:91:a1:5b:f4:6c:43:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 27, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
62:ac:05:0a:9d:d8:fe:44:a8:ef:62:6a:b5:a0:96:e3:c9:0a:46:e0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 27, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:19:cc:93:00:01:00:00:00:66
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 10, 2011 - Jan 10, 2013
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:05:13:36:00:00:00:00:00:1a
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2011 - Oct 25, 2012
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 7, 2012 - Oct 7, 2013
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:d4:55:00:00:00:00:00:0e
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 9, 2012 - Apr 9, 2013
Minor OS version
0
Major OS version
4
Entry point
12382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\vsproject\vshost32.csproj__1853760103\objr\x86\vshost32.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Windows Activator.vshost.exe.config
- SHA256 1d01507c8e9b3a25fe47e14c4dbf897054c0207ce5e6834d8be9c4a9ff399ed3
- MD5 24708262fc6cb48e3f154fe26610c9ef
- SHA1 016243da38e1b8b8f49c57516055a236fb08c2f2
- SHA512 d6c60d703fdfaff21fd3be749ad1fc6b47bc16c9128cce0c9e122b0cbe72a6d8293363bf441f9b0bff9685da73d14e4c825b5175cc0a428415c4da8b72943ea5
- TLSH T14DC08C2944ACBE269C334F1362014912FFB00292A024000CF01FA7030B3104D4217326
- MD5 SHA1 SHA512 TLSH
Windows Activator.vshost.exe.manifest
- SHA256 c884df239bd9af119f9b32bb12a100548baa223c702860be75e582aec26e577c
- MD5 c2a7aaec0dba5cdee60ef4f42a663ae9
- SHA1 78e6a25ceef82f418d5f737634363dde9b501dfe
- SHA512 a4eb0174d214afaf867d214d58288ca6a09ad4fee0309b04759650edb9ce81a5473f326815ac9f0af5a511196d9c44389e612ed7a0a3652c7eff5a6042e50ab7
- TLSH T1F6518681C1E0427153B140CB3D299B27EB37536F158D0AF8F44C5A6EAFB664AC3931D9
- MD5 SHA1 SHA512 TLSH
Windows Activator.xml
- SHA256 eb8a6a6cf1cef4f990a8b042bfe673a3284fa9199d68d417bb0b9448dd7e4892
- MD5 c852820201ac3acab102bd70bdd4cf4e
- SHA1 a73ff4d9dddbf8a3b0dd79efee236e4b0ad2c01b
- SHA512 bca7e563bd5ffbadb9e394efb18c99ed54c867a95886238b4b047b43406f8d39bba8eac8779bf89fcab7486ba46d6dabf33403442f53032d447c284d5a76cd1d
- TLSH T1E1017606A3A87D328D31147B6C62F491318B6960C23D300DEC6808771BE238B23EBD66
- MD5 SHA1 SHA512 TLSH
XylonV2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5221c5cd0e15ac46eb0dd592fea2883af2254107b9c6e899ecab5f0a18871374
- MD5 01be6620d1ebb53c8cb9b70dccd18e45
- SHA1 4c15aa2761dcdfcd679b186c0bdb8d6919724cc2
- SHA512 6d8b14edfb5e4dbe14f4930559ecfd259b95df79b5dfc2a068d0f92cca72d8638d491c37fd0490877f7df7fe56d92ee3cb0493937eb9e3e1246ec9d01e5b59d4
- SSDEEP 24576:dFpANGPdf3IQipq7WFu3kPQG8X7XGcmEbpQdeCBv7fR6h4hgH:/1df3cUGMmEWT
- TLSH T18C85381337A89A2BD09E473AE437061477F1E806E257EBCFE6D0E5AA1C527848D31763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1844986
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\S4Lsalsoft\Documents\Visual Studio 2015\Projects\XylonV2\XylonV2\obj\Release\XylonV2.pdb
mscoree
_CorDllMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 884b4fb8574cd2b0356304e3e7006d492f9aabf53e096e7e061cd164ddc64248
- MD5 d7b7e3c6466f2eac201bb3a09b1a885f
- SHA1 9fafdf91b58bd6cb2f39f1ad58f3ea9c43d27aba
- SHA512 cfa9a74950152c4ce09b7b5e19f20f7666fb109bc4b12a7f0244435771aa912fe7dcb7e48c2846c62e136951113d5e1eb33593139aa4e0fab0f80c9d1758cc89
- SSDEEP 24576:6ipq7WFu3kPQG8X7XGcmEbpQdeCBv7fR6h4hg:rUGMmEWT
- TLSH T139356C0537EC9B77D09E877AD4360A1847F2D805B397FB0F6610AAA95C87794CD02BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1162954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\dnlib\dnlib\src\obj\Release\net45\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ