addin.zip
- SHA256 ba5f5b073a7e67313c733808f2057f1c83c71ab0e298e0bffc024445b3788cf5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SnippetsAddin.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SnippetsAddin.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
System.Web.Razor.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
System.Web.Razor.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Westwind.RazorHosting.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Westwind.RazorHosting.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target addin.zip
- Size 154KB
- Sample261027-edbdzaat2s
- SHA256 ba5f5b073a7e67313c733808f2057f1c83c71ab0e298e0bffc024445b3788cf5
- MD5 448fcb59ac72ca05341f7f568841ce6f
- SHA1 a9761a170e63c56cc9cd0b5e9d23e1de60475250
- SHA512 84b23a9b3adb4ca2a32ce0afbd8d18fadd62d21d9e82a0c8cc31395dc8e8e7fa2a4be716f1a7a07d3bf8a0e923c07f5156f7fb2a2b983406a2ac6708dd2f4575
- SSDEEP 3072:JwjRZaeSf5yLZuf812OsR+VoNAqLd1MdTGOLGh7eL8aANZxxgbWl5r7dSiWQWK:Jzf5y1M87sR+AnLQdTGOLR8aAzfgbW7d
- TLSH T11FF3128FD5C245A0F26C77A7D58F1725C6C4CD4B58BB7E294863EEA8DECB622E005301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SnippetsAddin.dll unpack001/Westwind.RazorHosting.dll
File Explorer
-
addin.zip.zip 154KB
-
SnippetsAddin.dll.dll 54KB
-
System.Web.Razor.dll.dll 264KB
-
Westwind.RazorHosting.dll.dll 39KB
-
version.json1KB
SnippetsAddin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa39931d3167912372d4b05ca7e4888d2318c85cb80c7f20ed968c00fab0ec30
- MD5 da56facbf8d82ed5ef221331a42834b1
- SHA1 4eabe1116d7a8decd785573f66fc5ace807fa128
- SHA512 0823033698340b49f473f0edb13f62ba784d515ba888e6fe22163a39f08979c0816cb0f3670e23320d5c5489323a64b75f1ce54324f4dd9c6cd3271eeeeaa465
- SSDEEP 1536:waWyogKuYAcLeyNX3QecYNBMZ0Y2JXFkefL5guJ8:wVQykZV2A
- TLSH T181432B3133ACC376CBED8B75F8B1126047B6E6593613DB8A4D86B48A796274049327B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects2010\MarkdownMonsterAddins\Snippets-MarkdownMonster-Addin\SnippetsAddin\obj\Release\SnippetsAddin.pdb
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Web.Razor.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2fd7c5cfcb5f37303f37f15986f3bfddb616e2763315bc6e6ce6b206eaaa3902
- MD5 985bb9cbf997ba4dafb8e7dd7449c733
- SHA1 1a4dfa1d76dba3bba5e535e484b2008a6a96d360
- SHA512 374c784c6548a14e395312517cf42500a240f502d85148352b931f641699b98cab56df59e14c7cb241b4433c39399def1d3ac81c3b65b5fae7b0975027315cd8
- SSDEEP 3072:AAMQMGiL8OL5SyYM5xZ6DDtqKlFiZniRsb4KL4Fehet5QK8uxxU48vapPpucC9Kj:AGUslFE+s8KLyjt5QKZXU4vyc6s
- TLSH T152446C4063F8067AFAEF0771F838142986F9F596F5CADF6D8D5464AA3923B00B901637
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a7:8a:7c:96:de:a2:2d:8f:66:a5:9a:0b:79:a3:91:51:58:5a:e3:28:41:34:f2:24:4b:19:62:65:a9:c4:73:c6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 11, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e4:3b:de:e9:29:ef:af:05:95:12:7e:29:ea:13:01:80:71:00:73:96
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 11, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:ad:80:23:37:65:c4:5a:23:6a:00:00:00:00:00:ad
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
259918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\BuildAgent\work\66655eadfca7b8d7\Tooling\obj\Release\System.Web.Razor\System.Web.Razor.pdb
mscoree
_CorDllMain
Name
.text
Size
246KB
Virtual Size
245KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Westwind.RazorHosting.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6b475b29d76b7d632efc0ff2e0405e7bdb48701ce5c1cf1d034ed82bda0566d3
- MD5 ecd5f247723d5dcbc2d38c4ef1190364
- SHA1 3b97e57f5ded11637b9a345fa904f45464f3ccc8
- SHA512 3dde5d067667ccccd91f39a1f1d044135d4fc198175f37f5126df6505c3a59567b1e5522b0ee594a31832e010c6e591df6ba62aa26f58ca9a6743edfdcc34ef5
- SSDEEP 768:hkuWT1C/Okp+pDmOBe+/a+WbYM4aMy+2je36Oh+ZD:hoTqEEOBe+y+WbYBKs/+5
- TLSH T130030A5553F8CF3ACBBE07BEB431607005B5DB472502EBBA8E98B4CA2823B151611BF5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
45890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects2010\Libraries\Westwind.RazorHosting\Westwind.RazorHosting\obj\Release\Westwind.RazorHosting.pdb
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
version.json
- SHA256 73bc233d9dcf7a8c9d24094ca5ac69d6a2aa4f0becf1147ccb8dd0977ca642b0
- MD5 783c77759fb643cd7c8e44be3bb1b091
- SHA1 72e6b979781e392809b7f6c5ccaa7f5fe57150e3
- SHA512 d1e6cb04dd3ddb092cbedcb30e772fef0c1b075f15fa7baeb5672d10b5331d3e916e1db83e53c531ddcf7d1d02bc9e7128b98b04ef9ee23d4f82129d89494517
- TLSH T19921F02FE900361E0A7681923775A0D3F634520F7368858379FD843CCB76BA5894B180
- MD5 SHA1 SHA512 TLSH