de4dot-cex.rar
- SHA256 80f73884289c9906f3f8ccfcde2da5915a2834fd7d8b060ae5516b13a38f24ff
Password
771
Overview
overview
7Static
static
7de4dot-cex...ll.dll
windows10-2004-x64
1de4dot-cex...ll.dll
windows11-ltsc_2024-x64
1de4dot-cex...me.exe
windows10-2004-x64
1de4dot-cex...me.exe
windows11-ltsc_2024-x64
1de4dot-cex...ta.dll
windows10-2004-x64
1de4dot-cex...ta.dll
windows11-ltsc_2024-x64
1de4dot-cex...64.exe
windows10-2004-x64
1de4dot-cex...64.exe
windows11-ltsc_2024-x64
1de4dot-cex...20.exe
windows10-2004-x64
3de4dot-cex...20.exe
windows11-ltsc_2024-x64
3de4dot-cex...64.exe
windows10-2004-x64
1de4dot-cex...64.exe
windows11-ltsc_2024-x64
1de4dot-cex...40.exe
windows10-2004-x64
3de4dot-cex...40.exe
windows11-ltsc_2024-x64
3de4dot-cex...64.exe
windows10-2004-x64
1de4dot-cex...64.exe
windows11-ltsc_2024-x64
1de4dot-cex...er.exe
windows10-2004-x64
3de4dot-cex...er.exe
windows11-ltsc_2024-x64
3de4dot-cex...ne.dll
windows10-2004-x64
3de4dot-cex...ne.dll
windows11-ltsc_2024-x64
3de4dot-cex...ge.dll
windows10-2004-x64
1de4dot-cex...ge.dll
windows11-ltsc_2024-x64
1de4dot-cex...ks.dll
windows10-2004-x64
1de4dot-cex...ks.dll
windows11-ltsc_2024-x64
1de4dot-cex...de.dll
windows10-2004-x64
1de4dot-cex...de.dll
windows11-ltsc_2024-x64
1de4dot-cex...ui.dll
windows10-2004-x64
1de4dot-cex...ui.dll
windows11-ltsc_2024-x64
1de4dot-cex...pt.dll
windows10-2004-x64
1de4dot-cex...pt.dll
windows11-ltsc_2024-x64
1de4dot-cex...ib.dll
windows10-2004-x64
1de4dot-cex...ib.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
de4dot-cex/Test.Rename.Dll.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
de4dot-cex/Test.Rename.Dll.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
de4dot-cex/Test.Rename.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
de4dot-cex/Test.Rename.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
de4dot-cex/bin/AssemblyData.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
de4dot-cex/bin/AssemblyData.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
de4dot-cex/bin/AssemblyServer-CLR20-x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
de4dot-cex/bin/AssemblyServer-CLR20-x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
de4dot-cex/bin/AssemblyServer-CLR20.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
de4dot-cex/bin/AssemblyServer-CLR20.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
de4dot-cex/bin/AssemblyServer-CLR40-x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
de4dot-cex/bin/AssemblyServer-CLR40-x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
de4dot-cex/bin/AssemblyServer-CLR40.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
de4dot-cex/bin/AssemblyServer-CLR40.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
de4dot-cex/bin/AssemblyServer-x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
de4dot-cex/bin/AssemblyServer-x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
de4dot-cex/bin/AssemblyServer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
de4dot-cex/bin/AssemblyServer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
de4dot-cex/bin/BeaEngine.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
de4dot-cex/bin/BeaEngine.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
de4dot-cex/bin/LinqBridge.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
de4dot-cex/bin/LinqBridge.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
de4dot-cex/bin/de4dot.blocks.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
de4dot-cex/bin/de4dot.blocks.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
de4dot-cex/bin/de4dot.code.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
de4dot-cex/bin/de4dot.code.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
de4dot-cex/bin/de4dot.cui.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
de4dot-cex/bin/de4dot.cui.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
de4dot-cex/bin/de4dot.mdecrypt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
de4dot-cex/bin/de4dot.mdecrypt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
de4dot-cex/bin/dnlib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
de4dot-cex/bin/dnlib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target de4dot-cex.rar
- Size 2.2MB
- Sample261029-1ep5eae13w
- SHA256 80f73884289c9906f3f8ccfcde2da5915a2834fd7d8b060ae5516b13a38f24ff
- MD5 b6d832c3fa38159651fc22548a30effd
- SHA1 988f8f77a07cdbbb6b2af0cd909d479ce72df2d5
- SHA512 197fe1061baa57372c2255bc569e58fa2ef9e24bc67231e2d80a109e9e686620cc125e69ca802708ce7c2048ab3b898d7ad39e7801c7cc2506aa91f93f8e4553
- SSDEEP 49152:624CH5SABjw/dZwFO0G0NBIORvwnuWzalfg6wiYdEW4aCqtr3LZjv6McoSf9VsAw:UCH5S6swdDGnpahg6F0EW4aCqtxjv6rW
- TLSH T132A53301220FD2176F60EDD9E4E8EB22F6C2B3716DD0161685654B62F11DACF23ECB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/de4dot-cex/bin/de4dot.code.dll agile_net - Unsigned PE 18 IoCs
Checks for missing Authenticode signature.
resource unpack001/de4dot-cex/Test.Rename.Dll.dll unpack001/de4dot-cex/Test.Rename.exe unpack001/de4dot-cex/bin/AssemblyData.dll unpack001/de4dot-cex/bin/AssemblyServer-CLR20-x64.exe unpack001/de4dot-cex/bin/AssemblyServer-CLR20.exe unpack001/de4dot-cex/bin/AssemblyServer-CLR40-x64.exe unpack001/de4dot-cex/bin/AssemblyServer-CLR40.exe unpack001/de4dot-cex/bin/AssemblyServer-x64.exe unpack001/de4dot-cex/bin/AssemblyServer.exe unpack001/de4dot-cex/bin/BeaEngine.dll unpack001/de4dot-cex/bin/LinqBridge.dll unpack001/de4dot-cex/bin/de4dot.blocks.dll unpack001/de4dot-cex/bin/de4dot.code.dll unpack001/de4dot-cex/bin/de4dot.cui.dll unpack001/de4dot-cex/bin/de4dot.mdecrypt.dll unpack001/de4dot-cex/bin/dnlib.dll unpack001/de4dot-cex/de4dot-x64.exe unpack001/de4dot-cex/de4dot.exe
File Explorer
-
de4dot-cex.rar.rar 2.2MB
-
de4dot-cex/LICENSES/COPYING34KB
-
de4dot-cex/LICENSES/LICENSE.ICSharpCode.SharpZipLib.txt1KB
-
de4dot-cex/LICENSES/LICENSE.QuickLZ.txt470B
-
de4dot-cex/LICENSES/LICENSE.de4dot.txt845B
-
de4dot-cex/LICENSES/LICENSE.dnlib.txt1KB
-
de4dot-cex/LICENSES/LICENSE.lzma.txt612B
-
de4dot-cex/LICENSES/LICENSE.lzmat.txt1KB
-
de4dot-cex/LICENSES/LICENSE.randomc.txt248B
-
de4dot-cex/Test.Rename.Dll.dll.dll 62KB
-
de4dot-cex/Test.Rename.Dll.pdb175KB
-
de4dot-cex/Test.Rename.exe.exe 6KB
-
de4dot-cex/Test.Rename.pdb19KB
-
de4dot-cex/bin/AssemblyData.dll.dll 60KB
-
de4dot-cex/bin/AssemblyData.pdb123KB
-
de4dot-cex/bin/AssemblyServer-CLR20-x64.exe.exe 5KB
-
de4dot-cex/bin/AssemblyServer-CLR20-x64.exe.config214B
-
de4dot-cex/bin/AssemblyServer-CLR20-x64.pdb13KB
-
de4dot-cex/bin/AssemblyServer-CLR20.exe.exe 5KB
-
de4dot-cex/bin/AssemblyServer-CLR20.exe.config214B
-
de4dot-cex/bin/AssemblyServer-CLR20.pdb13KB
-
de4dot-cex/bin/AssemblyServer-CLR40-x64.exe.exe 5KB
-
de4dot-cex/bin/AssemblyServer-CLR40-x64.exe.config208B
-
de4dot-cex/bin/AssemblyServer-CLR40-x64.pdb13KB
-
de4dot-cex/bin/AssemblyServer-CLR40.exe.exe 5KB
-
de4dot-cex/bin/AssemblyServer-CLR40.exe.config208B
-
de4dot-cex/bin/AssemblyServer-CLR40.pdb13KB
-
de4dot-cex/bin/AssemblyServer-x64.exe.exe 5KB
-
de4dot-cex/bin/AssemblyServer-x64.exe.config252B
-
de4dot-cex/bin/AssemblyServer-x64.pdb13KB
-
de4dot-cex/bin/AssemblyServer.exe.exe 5KB
-
de4dot-cex/bin/AssemblyServer.exe.config252B
-
de4dot-cex/bin/AssemblyServer.pdb13KB
-
de4dot-cex/bin/BeaEngine.dll.dll 245KB
-
de4dot-cex/bin/LinqBridge.dll.dll 61KB
-
de4dot-cex/bin/de4dot.blocks.dll.dll 143KB
-
de4dot-cex/bin/de4dot.blocks.pdb437KB
-
de4dot-cex/bin/de4dot.code.dll.dll 1.1MB
-
de4dot-cex/bin/de4dot.code.pdb2.8MB
-
de4dot-cex/bin/de4dot.cui.dll.dll 42KB
-
de4dot-cex/bin/de4dot.cui.pdb69KB
-
de4dot-cex/bin/de4dot.mdecrypt.dll.dll 21KB
-
de4dot-cex/bin/de4dot.mdecrypt.pdb35KB
-
de4dot-cex/bin/dnlib.dll.dll 948KB
-
de4dot-cex/bin/dnlib.pdb2.8MB
-
de4dot-cex/bin/dnlib.xml.xml 1.7MB
-
de4dot-cex/de4dot-x64.exe.exe 4KB
-
de4dot-cex/de4dot-x64.exe.config369B
-
de4dot-cex/de4dot-x64.pdb13KB
-
de4dot-cex/de4dot.exe.exe 5KB
-
de4dot-cex/de4dot.exe.config369B
-
de4dot-cex/de4dot.pdb13KB
de4dot-cex/LICENSES/COPYING
- SHA256 0b383d5a63da644f628d99c33976ea6487ed89aaa59f0b3257992deac1171e6b
- MD5 3c34afdc3adf82d2448f12715a255122
- SHA1 7713a1753ce88f2c7e6b054ecc8e4c786df76300
- SHA512 4937848b94f5b50ea16c51f9e98fdcd3953aca63d63ca3bb05d8a62c107e382b71c496838d130ae504a52032398630b957acaea6c48032081a6366d27cba5ea9
- SSDEEP 768:A7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD0v:AVtNIq1uzZY1C
- TLSH T142F2825EB74513B205A202526E4FA8DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/LICENSES/LICENSE.ICSharpCode.SharpZipLib.txt
- SHA256 a9cb8a4b8969e7ddf2927e07bcc17754a0d3b46a22ed94556cc912c750182c1f
- MD5 b6a468eb5295487a3455c115a2293b62
- SHA1 75841b755c4c094bb775b5e6f7b88a155ceecde7
- SHA512 fc7b17fd8972e9808b2767b3c20da73c71f3311477c22197b5c919e5a1a571ea1b377de0e1ccc4fe546e57fb66c1911fa997eba42dd9ff592ec6fcb77b736f7f
- TLSH T1AF31676E435483B316D70680764F51DBF36791E0726F9050A08EC29D0767D35B2BEAE7
- MD5 SHA1 SHA512 TLSH
de4dot-cex/LICENSES/LICENSE.QuickLZ.txt
- SHA256 c71f55ac4d4ccf5e61010dbd6cdecc3f18587b85e65f02067072b0917f977150
- MD5 636c3966240f99c7acfb111602c864f2
- SHA1 96298baa10517fa6e4c9837ff6a85c04664190e2
- SHA512 a0deda4a9112a005182c603e24d1d8e301a19ae8e44c66ed7acd2f4d3c7be4b3b530f256a4d886ac93e46afec7ff5718e6037c1ab76d46ebdaca63d0adecec72
- TLSH T112F09E0B000D233126D146F26A668EA7E10B6B0051EF618E6424C1AD20B0C086DDA322
- MD5 SHA1 SHA512 TLSH
de4dot-cex/LICENSES/LICENSE.de4dot.txt
- SHA256 6e65194ea8cd9e773fcade7ee7a8ed6d906a3731ffb5e32fda0079f0f214a23f
- MD5 d5dacf6aedff3e528617110b8880d8b8
- SHA1 9904490b4ef427197c58cdc2224683ce397344ab
- SHA512 bc1d471b8d25a9aa47c988fe3cba9b82c5d55da38b7505ae3b70ab0933ddd9b55229a6bae560dbe3298d064266364462c763ba334540d88685bac031fbaa938c
- TLSH T13E01CC4E0242C7B79C500EA0394641CFF326A3476BDE6470301A839E1F2E97315EA4D8
- MD5 SHA1 SHA512 TLSH
de4dot-cex/LICENSES/LICENSE.dnlib.txt
- SHA256 0eb3e7de2d66b28ad0c1f1757c1e2217e252debdb5a6dd566674e63974517a57
- MD5 0f25e725e9748b4b27e71d3ff477d99b
- SHA1 769675a57beb7840b3bfef7d3aca465ed5cad4ed
- SHA512 daff4d0daf6794c8926fb88b1df2397bc70e103e73ea055f09bb663e537b02d94ab1fa20346811fc94a8043c77825e59b2dd4f7229cdc295ac5746b5ad52a2f6
- TLSH T11621841E3251076218B607A069645C85F22B722F7CAB2688343DF3442F39428E5FB814
- MD5 SHA1 SHA512 TLSH
de4dot-cex/LICENSES/LICENSE.lzma.txt
- SHA256 50fbd61a1377396f5fcbbcf1163f6ac608c4e937dc068c41a3a3098e3394a58c
- MD5 c14b7989e677c5d5ea870b8f4b2af9ec
- SHA1 a8635feb52921c910606c2884c51c59b5964de24
- SHA512 b1aab51c53c41b465c5f2382ad0b5e43ab839d15806e5114680a1d5f8ed9fa4925f90c8e968028fdd7dd54b76105a55aae92709297e1ee0a3a4ebffcefdb2b18
- TLSH T120F002DB0D0AC1BF39F1C7CC106CA184F23B8551540F5D919C24438EAE1C315E82E66D
- MD5 SHA1 SHA512 TLSH
de4dot-cex/LICENSES/LICENSE.lzmat.txt
- SHA256 ebb6d5803fbe705e0e28005c2b92acc3cae107b8313d391b5c3907f5be72dc8a
- MD5 b378b2ac7aeaffb760a61c8d0fccc0aa
- SHA1 87c837b1f9bb8274a396b49f4649d2d5fd689aa8
- SHA512 bbedf7d290e1d5e68a4071761857fc9f9a0f7478b79616fd75d01d71c27cda819b7a30bc0452d5ad5ad5db758b5818e7b9dc8f7a440213ede3e81e9128c69cc8
- TLSH T1F1211B5C28108F3B19F10BC52A4EE7CAE26B27C1707F98B50049B386850FE7213E6AE4
- MD5 SHA1 SHA512 TLSH
de4dot-cex/LICENSES/LICENSE.randomc.txt
- SHA256 352b4c545ad033ffccfcfd4109cd63bf4dd43511afef59e105791bc3e12824ba
- MD5 fbc3ae181622ce6cec8b34e2a5e03212
- SHA1 ad61f85a6bd209fadd79c585e9b0607de00ccacc
- SHA512 e7c4bc620c290085b662c04e3fd6e405feefc6e640fab060f6097db0fed1a0be33d35cf268c3b7d781a790736142d90467d9d7c650238fc04129fc0327185ac2
- TLSH T131D02ECE2133CA632B908A47B8F38A8BF016B08188EA0E23EC614AA34020840B0C1059
- MD5 SHA1 SHA512 TLSH
de4dot-cex/Test.Rename.Dll.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bcd9fad8e3ab87b4be7d6996d1defcd96a8fe74b0a87a4d445dc34e775a85f6e
- MD5 262f0b45d67bd2c954b62a4968bfe144
- SHA1 1c98e9402a6e18df8298054d3bf9b1eeedcc1b36
- SHA512 e35848ee9bbb4b8d7742b5fa271e8be41e494c1c01a383f4e0a2e4a3310f1161640c15213d5f0b181a1db267230b6ff9cbe4edf332b43b1c93efcf11e59a0fad
- SSDEEP 768:42YNVNxeS9vKTuaNDpTT2u30XElfAdIcaVVQW1btdkGID/G:AkSpKnNP2uEUBFcaVVQdLe
- TLSH T1125372DC0B0A9772C90CC77AB06AC111FBBCE5AA2003E3536945EDB17897F6D0C53969
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
68774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\de4dot-cex\de4dot-cex\Test.Rename.Dll\obj\Release\Test.Rename.Dll.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/Test.Rename.Dll.pdb
- SHA256 a60f44c168f64513c9f852319486028c68ca54c9fa41aa6ae0008b7bf1bf0413
- MD5 5a2f5853449af3542e91d58c3bd8c47c
- SHA1 c5892d0c9f91826fec0f0359d1ea75c38ceb9038
- SHA512 15c9e1e91c84147c8285c12617978a799fa977d37b59ec668161e67fb5ffb8eba5dc944d98d3180c96812e0478fb633f9f8c99f9c098bb0ea2755194c37d8db7
- SSDEEP 768:G9BhMFVYrDY0PtsRl7eQBTvTHqxGP5GWqafrVTJFcKDo430rIUUy4jZurrwtQZ8x:t6rDv+Rxe6Ko2afrDNqhgC
- TLSH T1B004D02BFF59DA75D42C9038759F9B0C0B70F9988B82D35FA142B1AD2DF03952D4A29C
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/Test.Rename.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d1dabe9689eb3eb171cba233c700186016b0cd179db1b08f07338dbcd050d60c
- MD5 1c1ed9cb960d3f83894c6fe7338454a1
- SHA1 d992fa7e3f2f6c0047af7d6547686b0eb615d500
- SHA512 bca8b7dd25cb66a8a84fc7d71ed53c63f97998924d20b9818267fed70d7b882155fd340fe1e4c25441d13aee7bcf95f5deb47391ec4c0203dd5feee3ad82913c
- SSDEEP 96:weYG71pQt5/IvhnHT7ErI5Ke7XsuvKJUkzNt:B74zQXEeLsuyh
- TLSH T10BD1942CA7DF17BACDB31B35BDB703506B74F992C847C72F10C4A95A3D566418822A38
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
11326
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\de4dot-cex\de4dot-cex\Test.Rename\obj\Release\Test.Rename.pdb
mscoree
_CorExeMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/Test.Rename.pdb
- SHA256 e7d57b75a9a0cf11f1247c70de255604c7932148548e4ec8101708f3a457bf5f
- MD5 7ddf267b654e61b523b57459e175d511
- SHA1 2e292e82be0e7ecbc64e6185afe358a6c2fe41f9
- SHA512 d60bbcdd4b75060160c29debd1d5828dd26db2ca45233e3b6682e32067cc3ee9ad83fad78086fd4b1e2b79a79261629aa9bf7c14f61641be5828c42777c539b5
- SSDEEP 192:AAPQSAPCsBsTs6saDvi2h76HCtShWA1t7r8CLHsaswszsZH:/K4Dvi2m
- TLSH T1FD92BF26BB09D672C45C1534398B878C1730FE89CF82A75B718672AD3DB53921D1B7AC
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/AssemblyData.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2e91c540553e6432f24d4fb6b6b407eafd393b958bdff56fafaf615def9afa67
- MD5 d7b52562e6512f3654ee10c3c9529ab7
- SHA1 576c20c832a50a5b21bb583a93d23f40099ceb09
- SHA512 890d39ee5d2d80c9a335de9466de9efe706c63a55d60a3b87940b7b3a18abe60d09684af3c0f3ab17be28fe4b593a1cba79fbfaf3c8827785dd6a0f41f5809db
- SSDEEP 768:CcIF1qiC5Q0tgHYPjIXt3hE8oeNxu4WGX1Y0FPbjoOCOoeldoeNxu4WGX1Y0FPbv:qLeeqgHYbIXN/dApKNQz6
- TLSH T12C5338A06BF88FA3DDBED67E6876150423B4F8215837D72B5CC9A8BA24537184742373
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
67270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\de4dot-cex\de4dot-cex\AssemblyData\obj\Release\AssemblyData.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/AssemblyData.pdb
- SHA256 478fed113f925f8cfe8ebb33cf1d5d825081b856f2eb7d5f38e56c350c017d01
- MD5 e5e043e5a84c63e88ea2fda8d0a73e06
- SHA1 67a735f29b925d2cafccaa700e4d8738e6d73323
- SHA512 caf40b2f31216a5bdc81f1bd3998abf8049572752504d1ca2de0602f1b4a17049396349d8956196b387eef36887cde08ae582b6cbcb4c99275849e8eec379e4f
- SSDEEP 768:ZWU6Drn+ZMZJQHFU5MvZPJ7y57+cL9Fl874b52ccfPMbaLrdj0noGaPsj7OZR9bo:Q87tHPMWfdj0oGxMblm1cq3
- TLSH T1DFC37326BF41C632C449CA3DAAAB4F0D027CDD888B87572F5B98701DBDB67971E5A310
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/AssemblyServer-CLR20-x64.exe
- SHA256 e2d749f5b5e7eb849ab5cc72a19481e569335fc6a414dc65ab570ac0f6ba70ea
- MD5 a91014fd0864eb9b06fc0b2b5648cf5f
- SHA1 abd3e3eaa301c8ffc4a2f60d275458724480a35f
- SHA512 f67cb7fbb871e3f90eef9da68ece6270eb2c9da3a1003b4a85d7f01d86be2e79133d3c15b119a36ef88bd650cab8f141e20100ebcb008c75eaf13486fbfa33f9
- SSDEEP 48:6TEtCnmh+v4q9o7MMYInFmX0P0DCI0qkKKrILZLCVCGpfbNtm:ymkp9oTn0EsWvr0kUIzNt
- TLSH T146B1C810C3D543A2FAB30BB37DF3A6819738BA11D9A75F1F55C949139D123689D63B20
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\de4dot-cex\de4dot-cex\AssemblyServer-CLR20-x64\obj\x86\Release\AssemblyServer-CLR20-x64.pdb
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
de4dot-cex/bin/AssemblyServer-CLR20-x64.exe.config
- SHA256 357c03e99f43f0426f376cfede6524aa5e26387a3c1bd5ee61714df43e9dbfb6
- MD5 2e5d808cd3a7ef1fca5ae5ef02e8c5c3
- SHA1 131cae6a1caef58e74f7c1d5f5483d3063c4b166
- SHA512 c6ee09bdae6abdb854186127a083462ffebe3b683337e373be9fe214fb53c13d68190d2d386970bdcc293f99879f5a68cf00577243dcca5f94728d76df30f15c
- TLSH T17CD022821498BE271F1247B797B309A4AF3676E16436040D985F34BB0A2202CA3AA306
- MD5 SHA1 SHA512 TLSH
de4dot-cex/bin/AssemblyServer-CLR20-x64.pdb
- SHA256 b1135d92b335c58cf813c14a9dbd20a4889dc7f3d168e40f2001bd956ba89d36
- MD5 6fc6cfcc815f61a59031467720844cc3
- SHA1 2a174cb97acd3bcea0d778ef298e3b10b34b19f5
- SHA512 ae41cc8f79ad3cb01199807618fe3700c462765f8f941efe195043fefef6882fcfdaa850fd059a48cab9d761bba5fc37a1b569aa360ed944b7164341ffc397b2
- SSDEEP 96:zyAPYAPPsXsls0sePxBmjsUsLeYsBsL6:2APYAPPsXsls0seGsUsLfsBsm
- TLSH T18A523810B709D7A2C9A41A722E83D9C84704FE01CFD1526B7AAC7B1FE83D5950E36F64
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/AssemblyServer-CLR20.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4cc35f8e121ae20b813aeefb9beea4d20e5d4b70c86292f0f335469fa6da9ace
- MD5 078799c45e47eca7bf28de5d144c728e
- SHA1 084ab951e9f01088769202904a01a5e710e4796d
- SHA512 5b9a34aae7201514c9f85f8454d7218c7a5658adf0c5f0ddd24283d23aae04d194539653a26f4501522e7e30aa69d7941c64998d9f4aa04f8e72c4cd1eaad75d
- SSDEEP 96:QKUzNDCJ7C3bwYDBUKOtxl7sjvNYUozNt:dUcKbwEBUPlsjV2
- TLSH T10BC1955183DC47B2F9B70FB27CB376409728B611CA635B2F65C55A17AD222A09D63B30
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
10374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\de4dot-cex\de4dot-cex\AssemblyServer-CLR20\obj\x86\Release\AssemblyServer-CLR20.pdb
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/AssemblyServer-CLR20.exe.config
- SHA256 357c03e99f43f0426f376cfede6524aa5e26387a3c1bd5ee61714df43e9dbfb6
- MD5 2e5d808cd3a7ef1fca5ae5ef02e8c5c3
- SHA1 131cae6a1caef58e74f7c1d5f5483d3063c4b166
- SHA512 c6ee09bdae6abdb854186127a083462ffebe3b683337e373be9fe214fb53c13d68190d2d386970bdcc293f99879f5a68cf00577243dcca5f94728d76df30f15c
- TLSH T17CD022821498BE271F1247B797B309A4AF3676E16436040D985F34BB0A2202CA3AA306
- MD5 SHA1 SHA512 TLSH
de4dot-cex/bin/AssemblyServer-CLR20.pdb
- SHA256 fc9a0d1cd893f54c336d2b35fba92453cdb7ee8aa41518813c80d167c1c9b34a
- MD5 c77ef67eaaa96fb07a8db34d92c99746
- SHA1 0a16bf951d374535e156cad62ec3d47c15bb544b
- SHA512 4675aec9a1ea9139f4326ce1f92088e547ebe34cd48dd8b3e5cfe34ebabfc9ebcdd656b190ca6585c0b01ecd6edecb3349ead46464b76474727a38d169bbeeef
- SSDEEP 96:zhAP6DAPlsosUshsWHs/Bm/sUsnebsGs0P:1APAAPlsosUshsWMYsUsnMsGsA
- TLSH T1535299217709DBA2C9840AB23E83DAC80750FE40CFD0126B76AC771FE8395950D76FA4
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/AssemblyServer-CLR40-x64.exe
- SHA256 0276195ef3678753d666d556aa3154bc5103eaf28bf484f07eda6e3d3228dc0b
- MD5 6b5644d487b8a5eac008534de55c6ab9
- SHA1 54b670b4533ba471b535f6a1d000f7b62615fc55
- SHA512 82c0cfe3f7bda68acd24102ba3d07070c5bbfd6f580d31947b74e8c4335783c6ebf3463cda55ed56c6824e43cf0934829e4e75b90b31905b50255e05bbc0dce4
- SSDEEP 48:6yF3Bmz09uX7NMG3iPxizSmi2+0P0ZtnC60qOKKrKLfNCVCGpfbNtm:XI09uX/SPxjp2TsZtSvrekUIzNt
- TLSH T1E4B1A41193D88367FBB60B727DB3A2409338F740E9A35F1EA4C45A439D236648D63B30
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\de4dot-cex\de4dot-cex\AssemblyServer-CLR40-x64\obj\x86\Release\AssemblyServer-CLR40-x64.pdb
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
de4dot-cex/bin/AssemblyServer-CLR40-x64.exe.config
- SHA256 f586a52e0e29cc8fe05d6a255f6a3fbc8d14fca8560788f63830962f2d5f1383
- MD5 eac1b877cd0cce550517c55158a85af5
- SHA1 db732d6bf74d471f6b646272135d0ec0eb305388
- SHA512 afb373bc690d55f5bdf64d62d1e240b41ec727d05a401788bbf4d081d19dffa8d9d37144a4f07946620a4dd1ec2d2a7670fb04c4681a9faa5c958fa0f8c6ca1e
- TLSH T1C3D02282149CBE274F0147B7A6B34965AB3266A16435000DE81F31B70A2102C93A2306
- MD5 SHA1 SHA512 TLSH
de4dot-cex/bin/AssemblyServer-CLR40-x64.pdb
- SHA256 e2b9489081952833b622ba4a549693caab302042779ef053f6e76386b233d30a
- MD5 686617664c86e8bf39e7ab7e97e579b2
- SHA1 b3fe347f000591e2a5f91c5eff9b86d9e71c1313
- SHA512 90a9e2cb719793bc909403a15fff7515e574f992654d7a65ba400998c987c7fa0e45c1c5dc7f2b2cdfe6c20a2f058699012c7bb18a1f937e3bff49f3a52f1a2a
- SSDEEP 192:V9APiAPnAPWsZPs/8gsZMsq6gsZssZMrsXKs:VW98C
- TLSH T1EF5289107308E7A3C9951EB62D839AC84254FE00EED4467B7A6C770FE83D95A0D79B68
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/AssemblyServer-CLR40.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a222c177c52c07014542abced00feae38889f9aef7cfac7227c3f5feeb7d1eae
- MD5 4624ab4bce4ccc53eb7c0d4f1788447d
- SHA1 1d495243614d075d924d68d84c3f8901b3fc553c
- SHA512 cff66d49968e33a191ebc9f73740a93cd3823680d828cdbd9c4752920f50dd1b2c8b501a82eb2efc3d86aa1a31b293dc0df088da62a89ffa72fbb5829cf70af3
- SSDEEP 96:ZXCJUbDcADVl6wpGBVkXms6vLYUozNtd:kJGcQQw4BVhs6T2D
- TLSH T14AC1850043D88372FAB70F72BCB3A6419368B711D9A35F2E258A9517AD313645D62B31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
10514
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\de4dot-cex\de4dot-cex\AssemblyServer-CLR40\obj\x86\Release\AssemblyServer-CLR40.pdb
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/AssemblyServer-CLR40.exe.config
- SHA256 f586a52e0e29cc8fe05d6a255f6a3fbc8d14fca8560788f63830962f2d5f1383
- MD5 eac1b877cd0cce550517c55158a85af5
- SHA1 db732d6bf74d471f6b646272135d0ec0eb305388
- SHA512 afb373bc690d55f5bdf64d62d1e240b41ec727d05a401788bbf4d081d19dffa8d9d37144a4f07946620a4dd1ec2d2a7670fb04c4681a9faa5c958fa0f8c6ca1e
- TLSH T1C3D02282149CBE274F0147B7A6B34965AB3266A16435000DE81F31B70A2102C93A2306
- MD5 SHA1 SHA512 TLSH
de4dot-cex/bin/AssemblyServer-CLR40.pdb
- SHA256 1062a4a60131b77390b5aa9cecdf3b2506ab1d6376c1330419cfbf94c569f182
- MD5 b121ad800768ca85d578c4c049d349b1
- SHA1 591a8738884c950820102b9c34eabe9303549ac4
- SHA512 7861cbddcfdeccd641cd31d23e7ce85c6c61e71363311ab698edea0ac8d0d2bf504c40a586ba25f4ce357409e07d219bb486ae651533a27c873dbd2c314d72a8
- SSDEEP 192:iAPlbAPnAPzAs6sa8gsfsYlsagsqsMKs:9l48z
- TLSH T15952CE007309D772CA441AB32DD3D5C84754BE00EED10227767C771FE87999A0D76BA8
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/AssemblyServer-x64.exe
- SHA256 d20081dfe78fe10346d70644d92b43934a703dc9207255a3a4ab88ba4246f00e
- MD5 90d8eaf5e4f3d8603d6e55f18bbabbff
- SHA1 49212f3602fb7a5d9400bf8a6755f9ffe8263bf3
- SHA512 554928d1eedf3b2e3b23d8d658653776139fe8e3e500847adcd7ac95aa9db2ea612cca7f352424e1fff273eea6195080d451e106fb33cd70fe25e15025d14b47
- SSDEEP 48:6qRbCmHiMMoQvPt42Sq0P0vvHKM/MiKKQl3VpCVCKpfbNtm:JGmH/QvPGstfvO2UczNt
- TLSH T1C8B1954183D44363FAB70F727DF376405738BA11C9A75B2F6A855507AD222688F63730
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
771
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\de4dot-cex\de4dot-cex\AssemblyServer-x64\obj\x86\Release\AssemblyServer-x64.pdb
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
de4dot-cex/bin/AssemblyServer-x64.exe.config
- SHA256 aed6224c24f14853f35cd6077e68b3721bf5055b43d64724437e8164ada025b7
- MD5 88a956f4fca5481b2311afe28566092e
- SHA1 b1dfde164ed4089bf930acb8ed2d1da8e1f3fdd1
- SHA512 9bd67dfcd975f02ae0410f472373feb7cf62a925c050839e5f44d9b3b389aa35207c2553b087e74718888701a7e0618501c37005aa324d8ff56790461878b940
- TLSH T169D0978114A8BE2B1F0107B3677308A1AF3266B02035000D984F35B70A2202D93A6305
- MD5 SHA1 SHA512 TLSH
de4dot-cex/bin/AssemblyServer-x64.pdb
- SHA256 1f4218d4c9ae0621922a615e70b6abd7e5e552130301a42254aea227e4b2aef8
- MD5 5aa26dbb666efde1c225fb3e702de269
- SHA1 f99626c6dac580f837c052938c114227f64c4e15
- SHA512 754d6b53b7fbd379f52d93297fb2d22217cfc8cd59ce9ebb3a091b71184b6c78e70fb3754e8f7f57fd9ceab297b78fd6dfebe5f33ed3b14a9ae086fb5a5d55a0
- SSDEEP 96:zYAP9zAPNs3slsUs0cBm1sFsgeqsBsLN:sAP9zAPNs3slsUs05sFsglsBsJ
- TLSH T1D15212007708D7A2C65819322DC39AC94754BE01CFD1527B7EAC771FE83D9960E36BA8
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/AssemblyServer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1e9c9f02eff87555bc4bb7c59346fc194fbea3e91c4f9faa61609382735fcc40
- MD5 21b9eb044ce7e2be2324d1f5862bcd26
- SHA1 5a85f1e96241e65fc4d74a7a85dbd9da8dccd1a8
- SHA512 3a21c0a4356397ed1311530bfe98853906f9759271451ff3a3fb6c63bc8c74196bdb7bf516ef8afa43d1a034923bf3c7f5bcd44ad3a5493818a3fc5bee2ce64b
- SSDEEP 48:6zfGCAhefCRlFXK/MMk+vI9TNALm0P0Pa4HKIQbKKJRQD0CVCgNpfbNtm:QVAhe6RT6dvYMLsSHvPQRUgPzNt
- TLSH T1A6C1B44043DA5327F9770B327DB3B6405338BB11E9A34B2F51C656076C222A48E63F70
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\de4dot-cex\de4dot-cex\AssemblyServer\obj\x86\Release\AssemblyServer.pdb
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/AssemblyServer.exe.config
- SHA256 aed6224c24f14853f35cd6077e68b3721bf5055b43d64724437e8164ada025b7
- MD5 88a956f4fca5481b2311afe28566092e
- SHA1 b1dfde164ed4089bf930acb8ed2d1da8e1f3fdd1
- SHA512 9bd67dfcd975f02ae0410f472373feb7cf62a925c050839e5f44d9b3b389aa35207c2553b087e74718888701a7e0618501c37005aa324d8ff56790461878b940
- TLSH T169D0978114A8BE2B1F0107B3677308A1AF3266B02035000D984F35B70A2202D93A6305
- MD5 SHA1 SHA512 TLSH
de4dot-cex/bin/AssemblyServer.pdb
- SHA256 f5920e1ed7a5999fa87163fd201d0f6694c80aa29458a0851e620dc59e162f23
- MD5 e18fc476abfc821d0dda949184ade6f5
- SHA1 1ff56d7f1526f6b8644b47e8969f8e4c3c44ab11
- SHA512 21db5af5aa27f3218fce849f1963b1b5d88d5b8e1b18dce3be3592c901be7c756b52f4d317f01f60e92e4cd0da91822f73c5661d7fc699c052e89428ed241f62
- SSDEEP 96:zWAPihAPNsIsg3sBsUsBmBs0sHeIsgfs0Xx:CAPihAPNsIsg3sBsUts0sHHsgfsUx
- TLSH T148529B107309D766C95819323DC39AC84314FE00CFD422AB7AAC731FE8795960D7ABA4
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/BeaEngine.dll
- IMPHASH d752e294794bde96faeb4ce0eb29fe2e
- SHA256 2fbe38190fec83b2414ea50c137b1cd12acfa0b8e090abb7afdf56e20357968d
- MD5 91f428e8b84a48b6d768b0c30176daaa
- SHA1 18bdcf92dabc0e8a1d399737d49a6db42f28104b
- SHA512 788349b814c9feadc7c9c483e0fef6af1a4ab5d76db7fdf76b478a368cd6bcd7b59ce58fc2436629854a307ac6e853b60a06d3be2f3fa203efc310994c7a4bcc
- SSDEEP 6144:HGK5Ty9/cqrWBeCFASajDuXOQoMuA+X6bnHXD8Her23IDQ2FmdODehF0q5pjtAQT:xbFpJnlolzv
- TLSH T1613484965670C9AACC2E4FFE16260376297667943C9154BA4BEE3FF88F426C0142DDCC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
202064
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
HeapValidate
GetSystemTimeAsFileTime
GetStartupInfoA
GetFileType
GetStdHandle
GetCurrentProcess
DuplicateHandle
SetHandleCount
GetCommandLineA
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsA
ExitProcess
VirtualAlloc
VirtualQuery
_Disasm@4
Name
.text
Size
208KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
de4dot-cex/bin/LinqBridge.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 acb589d7708040e016cf3f25dfc3309d2366a58c85fdb79fa6295c07f95acaa4
- MD5 b1d401765196dddc72cd1341a684debc
- SHA1 e02bce01f4efd3a1e34edab54a55832fca9ca5cf
- SHA512 893fdc5c009fb6826228f3ddcea9195cb235feec4d125e157b4c6c13def28e6ad98f6aaba32295f1db316fb9b8c60dc518fc6877fbe621026953cb36b9ca650e
- SSDEEP 768:Vv7jPTwNjih6NhbY5/U+R+ghvgUu4Wlx8N8eh/HyoaH3Eozfv92cLv:VLKji9VvhvgDx8THyom3xzff
- TLSH T14453F60973880723D1AF0ABFA571328387F1C59B90079B476BECDEB56C12B591D5B28E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68686
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\dev\pub\LINQBridge\src\obj\Release\LinqBridge.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/de4dot.blocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ba197b4b6a19ce6242256639a3f641575c77108a07d5fcd3ac13f1d38bfcf98f
- MD5 cdd68ffe464313c170ef8e98b37204c7
- SHA1 9fd1b8318a333cd10e017b208cfbbb71c6868d33
- SHA512 684b50c63c832aa62fad5db675a8037fcc0b5f91c76f21fba99e3c240c5f0f06786f5e240c4019697e5b4d7b924cb3522a2d8e2565d45cdf9ffa3303dcd86f7d
- SSDEEP 3072:e16xabl5Ifu7aVv8V7LjQlFnbH7QTjpJ:eMxapy27aVv8F0FnL7QB
- TLSH T198E31B119BB88A3BC6AF56BBE4A50605C3FDC41BF693E74A9CD4B0F66802321F5112D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
151742
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\de4dot-cex\de4dot-cex\de4dot.blocks\obj\Release\de4dot.blocks.pdb
mscoree
_CorDllMain
Name
.text
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/de4dot.blocks.pdb
- SHA256 2f34ef9acb87f1bad0aa23841907e5b226ef977cc76c815382250ecd1151f725
- MD5 be37a3ab3497f186cbd7b1ff8546e47f
- SHA1 1ba9544e60c3ca38eee36f82b6edf522ea18e022
- SHA512 4bec39aa2cd53889096c4f5cf5305ac72ebaad42ab9dff1dbf091df79093b5f417a5f2727870e950ae4cbbeca8e865f2257b2e4b2049c1bac7ea30b22df55896
- SSDEEP 6144:R4xvgFhtS7APdumokSnvNwszJwXwcnPanVdmEFoOG:RFk5JwXTCPTm
- TLSH T1CB948426FF51CA32D455C53CAAEB4F0E4238D5C89B83635F878AB06C7D963A61D8B310
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/de4dot.code.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6d7d8616d74179dbef9ce441f02cdfd2b0eaaec55bce1d209c86f196ce55135
- MD5 e8a0659bd6a0de12bc61b4087adb9996
- SHA1 844dd095dac2667bf19d2e9e161f39f1d1aed67c
- SHA512 431cb41a6bf7324654179b91e89b086ac9e4040ad34d809b2ed71bad85d6dcadcc90c4f5bd449d69ab26112057cf41d4ac4419ec0f0abef0fc552166fb736845
- SSDEEP 24576:uvNg6tCYUV7XnZ0J1PK0Kq/f/19glYbrZqSBSw:zDZ0Jpf/vrZqSBSw
- TLSH T1D5455B12BBE94B0BDABF077AA4B5451903F1E955D3ABDB4F4DD2B1A92C42350CE02363
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1167762
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\de4dot-cex\de4dot-cex\de4dot.code\obj\Release\de4dot.code.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/de4dot.code.pdb
- SHA256 2f1fe823b84f12a11a7f3e19bb60583d69ef71a1ac57240ca3d532d27eb63451
- MD5 4b28a7ef598f5214654339ed006a3d4f
- SHA1 cc6726389a449b297639a89d2731dc80365429fb
- SHA512 b6e1f89f213823661d2bde6a3a739a06b8077e5be9fcd5201b44b99b4b66f319773a921e31b2983d298f091334319a8598c06ef189a98f883ac602675727d8c0
- SSDEEP 24576:W+uYwc18EPhqLdYl0UBdv19StNe+twLwi:Vsu
- TLSH T18BD56112FB45CA33D45AC63C66BB8F0D033CD1899B83975F6B99B06C7E863961E4A314
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/de4dot.cui.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ac7b8dfb428d46cd31f3fca3c4002ba01a3acd67dc2998e11941d519f34cb792
- MD5 5ddc6ba42b288532d57d7809dce2db1c
- SHA1 1968d7374674b9c9aa04a9604c813c9490f3f9b4
- SHA512 dd7d1f3cfd61b5c0fbf24b590a7aaa7ff0cdcafa303c2f7f00a71f5d8703e398643ececfb94d6b8ece8fa3051480667c5df233ee7bc0ac70fabc606aa3a59428
- SSDEEP 768:zEOAXehvKC6osqb5l8Jh+2F5pqkGOlk3BaCEoOLpX+Ipdmh:zZ3BIqb5Qh+2F5p3QgX+5h
- TLSH T1E613C44237EC8327E6BF3FB964B4522016B8FD67A531EE4D0DC121CE2866B40DA64767
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
48658
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\de4dot-cex\de4dot-cex\de4dot.cui\obj\Release\de4dot.cui.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/de4dot.cui.pdb
- SHA256 029cba4deec4c81d7176e148f7bcfffbe262006b9d6cd8e69e56a34d9a027267
- MD5 05ea38583fdd31a9ea02e0f9cbe5f9c0
- SHA1 79099ec5c22e3984531da03af04543c256fd394f
- SHA512 92ddf88cafe7e812abcf2be95d8e1f2af0c4509d13f69d589dc754caaa1c725b5c2c002acfe0989e90a70532df5b6b80bbf671da0a437ee04bd805d570c7f97f
- SSDEEP 768:PKbKtQpBECCvmPRfufYorfUHKeRrgJtgWY8JE6qsHM5hN1zIScm:vCqmIQRq+YtZdM/NiSx
- TLSH T186630142FF44C732D459893855AF4F1D023CEE889B875B2B5759B12C3EF135A1E8A3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/de4dot.mdecrypt.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1f765abd720d9b38561826b4c034416156bf9e9903d9062c83e6aafc0b197d47
- MD5 3ce65d3b080b42be3d95200d985b0d57
- SHA1 f80d1054d0ea22aac598754c39d3b1f664dd5b71
- SHA512 6d3491dc63a6b00bf9a1d58ad1f78106c8790a5696523b8ab08eea64302423ace0a6a19171c1776ba988e9a327a6e792e6857b1fab90c6cf13e7a73a4fe7bc4e
- SSDEEP 384:5yCVfkl0dZk4jq5T0T9W2Eg6qHbQprXtQSQ6qt07gq:Y0kqdZk4meT9hEg6qH0h6VK75
- TLSH T186A22905ABEC9337C9EE4BFE9CF5104247F5E492AA13DB244DC8306D4C43B940992B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\de4dot-cex\de4dot-cex\de4dot.mdecrypt\obj\Release\de4dot.mdecrypt.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/de4dot.mdecrypt.pdb
- SHA256 002e7884add7a16a1364158ba36de3ab2ea7924d49ab053a7f4b2bc23b6bc5fd
- MD5 2f57394b075eabd67582c7f0c8b3d9f9
- SHA1 7c47734fce2a0885975b321716f267f5a9a650d1
- SHA512 c9384717c01ad1b6d694498a9432b280ab80587dbd252d49bb121f3cba2b85b8b32290bedfd419206cedcd8f2edd74ca8c605a358dede396a22c949bfe646d27
- SSDEEP 384:u0bFa5sJyxfg6zhnapgExiYgPjo/wlQWBjYRJmNOio:u0bFuPfBE+Erffme
- TLSH T1F3F22E15BFC5CA33C4598A3C56BB8F0D023CEC849B83AB1FA699716C3DB235A1D46754
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1b9e108e458c30655f98bb681bc6162b39c08e781264f2181e18be297d7b22d2
- MD5 6e803cedc518f40f427be4ed6bf77553
- SHA1 6cbf298605c4d236f88b4c77435a55dddd9f4a57
- SHA512 75e077872e0d0ed19657d7d0bb456ff22a53dd72cd96cc08841f3bf516822a6e07cdc3b25429459cff9e159e4f56104ecb6ce6e062d30d90bf50ebd56f7985cd
- SSDEEP 12288:qnRCeKXI1U5NjDEtJ29lsX8n5+wGIJTBtO9jbWAIG1Ml9lUfqRhFov7fUMD:qDl1U5vWo/qWATAhFov7fD
- TLSH T170256D1237F86727D0AE4B39B472881C4BF2E9597763EB8F2651E6A61C83754CC113A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
976382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\de4dot-cex\de4dot-cex\dnlib\src\obj\Release\dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
946KB
Virtual Size
945KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/bin/dnlib.pdb
- SHA256 1c546cf8c8f281cb11590eccc74f6dd99e076eddee3fc6b2f789b7c7ef9c6a04
- MD5 c753d0a42e8ecd350b390bedb67ea555
- SHA1 2e05976f9ecf5de491474d1f0e1bb2ff22a1e548
- SHA512 1f3b26f03bf146ecf955fc38e8a18c14c03d940f544aaedd4335ab8c25221ab479424c6a7d5a9b87ae2df2bfca480f13cf26504db361f0e1505ebdf9e29d569c
- SSDEEP 24576:mhjALCkDYH1OiMQ/amEPJKmCMdxO3aL51ltJ9t9L:QjaCkDYhnA
- TLSH T12AD57326FB44CE32D819C57D66AB4F0D0338D2CD4B83975F974AA07C7E827AA1D4A394
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/bin/dnlib.xml
- SHA256 138046cd15f4d276f0736e0bd21d0b9ec65fd9a4d7de9cff57f5432fc3338a57
- MD5 bf3a41506473556ee9cda13a1d26eb86
- SHA1 5d18d5a44643acf0cf3647bae3917bfba6d7c1a9
- SHA512 e23dadb35057fca05a6249bf4a65395a3bf790a333553b4eed77148fab8e55803fa4aab5ecb29788a60d3f9bc9953cd719c016e1bf048ef72373798a3f3d050c
- SSDEEP 6144:VN+NOgw+PPhElJ/ivlu6jXXhRmUaMtC4C:wOxGEj/ivluGXhRmUaMtC4C
- TLSH T13D857914B6C6AD121C32525B9E64FCC4FE150C33604A2E19B28D2F535F7ADDBE2AF960
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/de4dot-x64.exe
- SHA256 31892c6ba09d5ec1ad774b036a57936221b788cc2bb7af34e803b97b466a6e8d
- MD5 b8c7e0333c8d0883800d408ca4da1db9
- SHA1 1bceafeace4157d1122a14898eae95a9aede3db8
- SHA512 31cfd64b86f1cab6a0c7e6f99aeaca93eed83d72f763a5ece7b3061fb8a56d2963cb61c99b61ac79ce6fec3b09cbafeb0dbef9451b566b4783908b271201481f
- SSDEEP 48:6YxCRfe9Q1/bMMVp454R1oE0P0Fn+AvMMOgKKk3oNvKP+CVCapfbNtm:uRfe9QrpysPvkOeUMzNt
- TLSH T17691D71083D64363F9370B716DB3A6806739FA12D6638F2F19C6061B9C0BB848D67B30
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\de4dot-cex\de4dot-cex\de4dot-x64\obj\x86\Release\de4dot-x64.pdb
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
de4dot-cex/de4dot-x64.exe.config
- SHA256 caba4f4bfa95539f0dc3dfa3ec1229b325bf1c307bd666a3889fdf96421f5407
- MD5 93e84ed4b5e33f385a7f4b4fcb0fcc68
- SHA1 926af837e5c707e523ba06af17dfca3d2e8ed2e8
- SHA512 8d132f889591b70e5c5120b18cdabf34662c4ce9ce2aa81168910552d6dddc7acc6dcd88be8b79b7e48cb5cd93b50eefc0a6c60d92f5c9e69f2eafd570dc5647
- TLSH T138E06850A048BE1B9F0052B37A7204605B3B1B71203C000C54AF38774302059A2B9316
- MD5 SHA1 SHA512 TLSH
de4dot-cex/de4dot-x64.pdb
- SHA256 e4b0e708e323f699175c1fac7c44ee73966fc4f4c26b4482a4b66f79e0016230
- MD5 d32d3321ac9116647f64c62662c2ffb8
- SHA1 6540b6c797e830c0da0abd05940a563b25277bf6
- SHA512 caf4395a5b90c1f95d7b43a055bd7996d2c6ea08ab1ad1d21b3ce61b63cfd099fbae81fa2bc7f8c5baab6cf738e0b9f43e6cb3971f5d46691ab9a72f99fbab55
- SSDEEP 96:zLAPYAAPYCs8sQsts8su0Bmtswsjeds6swL:nAPYAAPxs8sQstsPuJswsj2s6s4
- TLSH T10E524900770AD673C4581A712A97CAC90620BD41DFD156B739AC771EA83D6D30D7ABA4
- MD5 SHA1 SHA512 SSDEEP TLSH
de4dot-cex/de4dot.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0dd150d75641089f7cc7de58e064ce6d091a2dad87f69fa812321838efff0752
- MD5 e4ec36a7794af9974ae5d559828aae6a
- SHA1 ddfe58436c62d3a81098ec862f612daa7d3741c7
- SHA512 328dd26f46203adc8e38c995a6aaa4e1e4d8d482f8f09a20183439e906a6041a516f0cb826aa3069559e9ef4cc79c8bde984ccb7f40d947955a355772dd34e93
- SSDEEP 48:6LCwUlCAJkZL1zJMMGXd7dc3M0P0P56A+AvIoOdKKAVfPhvV9PPCVCQNpfbNtm:YCwdAJkHzIXd7AtsPk3vsKUQPzNt
- TLSH T107C1A61183E94323F9730FB26DF362405778BA22CA2B8B2F24D746076D177A48D67B61
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10314
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\de4dot-cex\de4dot-cex\de4dot\obj\x86\Release\de4dot.pdb
mscoree
_CorExeMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
de4dot-cex/de4dot.exe.config
- SHA256 caba4f4bfa95539f0dc3dfa3ec1229b325bf1c307bd666a3889fdf96421f5407
- MD5 93e84ed4b5e33f385a7f4b4fcb0fcc68
- SHA1 926af837e5c707e523ba06af17dfca3d2e8ed2e8
- SHA512 8d132f889591b70e5c5120b18cdabf34662c4ce9ce2aa81168910552d6dddc7acc6dcd88be8b79b7e48cb5cd93b50eefc0a6c60d92f5c9e69f2eafd570dc5647
- TLSH T138E06850A048BE1B9F0052B37A7204605B3B1B71203C000C54AF38774302059A2B9316
- MD5 SHA1 SHA512 TLSH
de4dot-cex/de4dot.pdb
- SHA256 99e8df9d42ff03da8b52acaaae554b9fd09c7887cf4955872f4aea28a0a7eb66
- MD5 af316748aa3501bb6247d988ba29f850
- SHA1 fbb0b2ecc6a0c94d2c4064c1e70bc810fa886d32
- SHA512 2c67f73e7f8dc16298119e4002637582f87bf0ca48d92b0a77d2b95b68f77f1817a78d5eea725debb87ecec2d04381a2048095e662564f6e7a799a75e6613a90
- SSDEEP 96:zCAPCAPVsLsBsQs2hSKSBm5swsHeEsFs2es:WAPCAPVsLsBsQsrK/swsH7sFs8
- TLSH T1855229007709E7A3C5681E722993C6C94650FD01DFD1526B3ABC771EA83D5D30C7AB98
- MD5 SHA1 SHA512 SSDEEP TLSH