1.zip
- SHA256 f23f7ce392b524267f82b78aee42112186111e22bc408143744d7f0bd5e72eb0
Overview
overview
6Static
static
3Microsoft....ns.dll
windows10-2004-x64
1Microsoft....ns.dll
windows11-ltsc_2024-x64
1Microsoft....on.dll
windows10-2004-x64
1Microsoft....on.dll
windows11-ltsc_2024-x64
1Microsoft....ns.dll
windows10-2004-x64
1Microsoft....ns.dll
windows11-ltsc_2024-x64
1Microsoft....ng.dll
windows10-2004-x64
1Microsoft....ng.dll
windows11-ltsc_2024-x64
1Microsoft....ns.dll
windows10-2004-x64
1Microsoft....ns.dll
windows11-ltsc_2024-x64
1Microsoft....es.dll
windows10-2004-x64
1Microsoft....es.dll
windows11-ltsc_2024-x64
1NetAirflow...ry.dll
windows10-2004-x64
1NetAirflow...ry.dll
windows11-ltsc_2024-x64
1NetAirflow.Shared.dll
windows10-2004-x64
6NetAirflow.Shared.dll
windows11-ltsc_2024-x64
6Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Microsoft.Extensions.DependencyInjection.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Microsoft.Extensions.DependencyInjection.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Microsoft.Extensions.Logging.Abstractions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Microsoft.Extensions.Logging.Abstractions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Microsoft.Extensions.Logging.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Microsoft.Extensions.Logging.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Microsoft.Extensions.Options.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Microsoft.Extensions.Options.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Microsoft.Extensions.Primitives.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Microsoft.Extensions.Primitives.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
NetAirflow.MyTaskLibrary.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
NetAirflow.MyTaskLibrary.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
NetAirflow.Shared.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
NetAirflow.Shared.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 1.zip
- Size 199KB
- Sample261102-2rhfrsfy4m
- SHA256 f23f7ce392b524267f82b78aee42112186111e22bc408143744d7f0bd5e72eb0
- MD5 a0110ca3ebfe7fb25a855a47197d3123
- SHA1 794ae61905d65430ebf85cb5699ff3ec0ffe623d
- SHA512 9701adc64671f68afab2a3b15d997f05eab2f81aaadc43bdd1f1c5ae83dd8038818d5db471080c346bcef3274c5f43bf37e295795123011ca9669e0bfeda7a80
- SSDEEP 6144:B24A4DIc6Aqs+2EBMocOjRt24T01sFiKzkOU:B64D9itaKn24TrzHU
- TLSH T120142237D9021A16C7B9FA7279AFCB144CC466E79D46B98E6A003456189C7D0C1BCFCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/NetAirflow.MyTaskLibrary.dll unpack001/NetAirflow.Shared.dll
File Explorer
-
1.zip.zip 199KB
-
Microsoft.Extensions.DependencyInjection.Abstractions.dll.dll 62KB
-
Microsoft.Extensions.DependencyInjection.dll.dll 90KB
-
Microsoft.Extensions.Logging.Abstractions.dll.dll 63KB
-
Microsoft.Extensions.Logging.dll.dll 49KB
-
Microsoft.Extensions.Options.dll.dll 63KB
-
Microsoft.Extensions.Primitives.dll.dll 42KB
-
NetAirflow.MyTaskLibrary.deps.json5KB
-
NetAirflow.MyTaskLibrary.dll.dll 9KB
-
NetAirflow.MyTaskLibrary.pdb11KB
-
NetAirflow.Shared.dll.dll 5KB
-
NetAirflow.Shared.pdb10KB
-
setup.conf70B
Microsoft.Extensions.DependencyInjection.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 67fa4325000db017dc0c35829b416f024f042d24efb868bcf17a895ee6500a93
- MD5 e61d0a82bb0deab84b3c1e75df6f5b0b
- SHA1 f1b7207ffc54183e96ad1da76401f896a030dea1
- SHA512 0f3cf57fd108ef397f510e6635dcc16568560c6d40600d80e27d2976d172b3ad8f43bc1970c771ca772090169333139be9ea00118958e1fbd47db395088b28bd
- SSDEEP 1536:+DHW/pHp2Dp9edpX0Pnaw2oR7uhQDt8TIg6dKdQ1W6azK:qakQWDqTZ6dEQ1em
- TLSH T185533A6473F8677BCBEF4A70267650204B74BE471043F7163A6AC0B519A3BC84961EBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
aa:df:2f:2b:17:a3:42:1d:5e:18:c3:34:5e:02:09:6c:6a:9a:88:9b:4f:c4:3c:61:8c:7a:07:fd:2a:fd:1d:0d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 17, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e7:2e:8f:2f:93:0b:4f:1b:e9:00:01:00:00:01:e7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
58106
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net8.0/Microsoft.Extensions.DependencyInjection.Abstractions.pdb
mscoree
_CorDllMain
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.DependencyInjection.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 158761ce778e799949f3a3060c461b1055bb35f1f5a65eff0e42397849f09ecd
- MD5 ec9754049bb1b696f4fdda765e55dc73
- SHA1 8a06f022eb13670a06138811aa406177867253ed
- SHA512 ef8f997221049a3c8faec3cfe3ae62fd689e60b3c675da2b7eb2f9740519a2984ff199e882931bc05ee9c8c884dce09c624e6f3684c7e456172cc7c0f1b78dd7
- SSDEEP 1536:HikoH+bvkw5ZSHZrt1xDtSN6A3vMZ+t5TvZdGpNeCWWo/Ep4zB:CHH+bkwU5rW3vJtvZdG6CWx/Xd
- TLSH T151935C25A3EC4B26EAEF1574687440004FB5EA9B3103D74D6E94E4AD1EA3FC14B712B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a7:73:07:21:ab:c8:10:e3:f9:bf:c7:ee:54:1e:f4:6f:23:f3:b4:bf:6e:b8:04:be:d6:fb:97:b8:09:41:c4:ea
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 17, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:ea:9a:24:72:d5:59:3f:61:63:00:01:00:00:01:ea
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
87694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net8.0/Microsoft.Extensions.DependencyInjection.pdb
mscoree
_CorDllMain
Name
.text
Size
78KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Logging.Abstractions.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 45c22524218541717e4a0ade36847c1cda4921f5945b4975a1c78ddfe023d0b1
- MD5 ecebc7bc0237ef9ed6c12b9c6a38d757
- SHA1 fcb5492a4880763e727b5a5ba0156db023bdb2b9
- SHA512 ca7392ce00dc5bc4a7b16022324a53ffab30cbf62ec73bfba8387667371e6a8f097379b454aa2a308d5b294ea85c8b90e447844c250c19e1863cff0faec17d0d
- SSDEEP 768:mz7ouUrbVozuvO53ReiJdelmwSroV4RJJq5OkGkJJQiY2hsUBaIFClG9zu:1uOVozuMRhhq57QeBaUiSzu
- TLSH T133537D159BDC5377CBBE4C75E821D5834BB8D367A402D35B3CCCA428681BBC84A613BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
03:db:7d:09:08:1b:6a:73:a7:e8:64:11:fb:a7:a6:99:24:51:e5:ec:b9:14:51:d1:35:1c:8e:f6:9f:56:33:95
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 17, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:551A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:01:d1:45:59:98:10:cc:42:4f:00:01:00:00:02:01
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
59538
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net8.0/Microsoft.Extensions.Logging.Abstractions.pdb
mscoree
_CorDllMain
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Logging.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b2cfba2e05ee89a91e9bc9cf112468a5f4fa05d1a77ea81c131ea656f3d133c2
- MD5 973cbb386eeeac6ec135977655f69d44
- SHA1 51edce77394f087e71abb47fe86c6092488d13ee
- SHA512 14b6cfed2082bd7184118ea4b519fd31b192a6d1b0bbf2d9796b7cf47d56cc9b4a4129e0d1cb15306f244352906a6dc14ffb748d1e745ac471e8d782c9b41515
- SSDEEP 768:c4byNvwqX2LvG84aSBWZNSYv6VmTygGPSikiw64yw64pbdez7+Ts7XTfl3l37WqX:ctd2C9aC+EYYbgGB4pmOYlVLWqKzg
- TLSH T1A9336C4053AC6327DEAE1E34F9F8A4450E39D7566402EB6B5FCDB0950CB37D486212BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
52:8a:8b:1d:99:b7:92:ee:35:1e:18:a2:08:98:d7:a7:d1:2f:1d:58:f7:e4:f0:10:c8:93:1a:f0:bc:ae:df:5b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 17, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:e8:50:b0:80:cf:2b:72:99:4d:00:01:00:00:01:e8
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 6, 2023 - Mar 5, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
45918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.Logging/Release/net8.0/Microsoft.Extensions.Logging.pdb
mscoree
_CorDllMain
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5e01894cbc0661bacb8ca8f485a40d5ee4e02f28fef58007668a0276431b4693
- MD5 18638600345307f00b51037bdf4374a1
- SHA1 e8fca245a2b9a21589bfe18526c97c22939abf1b
- SHA512 6a15b951c71d03ea49677ef3bc4f0095cb78cf2180e2199422da4497e3e3bc7004272e10ad4b2dfad27948f4c94e843f9617bfe6ddd3fa5bca4cd10bf1618b09
- SSDEEP 1536:UahqHoZX+NmzYUGrCUidKHPhwMEbBolCixzZr:UYXfFGrCLQvhwME+l7tr
- TLSH T1C1536C05E7888712DEFF8931B4ACB6620F30C35BF507B76745EDE95429233908E6563A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
4c:e8:01:dd:12:b7:be:df:04:8e:a1:3a:72:eb:b2:33:56:f0:36:99:5b:6c:58:02:b1:9f:c8:9f:c3:79:9f:01
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 18, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:cf:52:36:be:71:4b:cd:48:ca:00:01:00:00:01:cf
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 25, 2023 - Feb 1, 2024
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
59738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.Options/Release/net8.0/Microsoft.Extensions.Options.pdb
mscoree
_CorDllMain
Name
.text
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Microsoft.Extensions.Primitives.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 446ff16e903e7479558816e213a3adee9a1c1adad65a56d853801b10933e29d7
- MD5 f45226e320f41097397b1ba7468c2d1c
- SHA1 1181845c7d16ac4c525eec67ec3a6dcfaa78a433
- SHA512 417466f57fa8c6d942be5d86b14da5915d507dfbd7aa8d2700b4dd79a9668897a6a6abaab225be45076bdb8d86ccf4777bb3c699b4002a081e4407604f4e2f87
- SSDEEP 768:CKEGbmbB0QERF7v6EtkKS+1ke97a1O33ttBOP7yW5yfyqTuia+15OFyx/iCL9zRv:CpGe0QERFhkKSM7ag33ttBOP7yVfHTuu
- TLSH T132135B52B79C8333CEFE9E34A4A4D1442A38939A7923EB5E5488E4651C737C4873227F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
96:13:f0:a3:e1:76:51:a3:6d:91:37:e3:d1:c9:06:82:45:30:a6:53:c9:a4:65:9b:c8:77:66:81:ac:08:47:f3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 31, 2023
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8D41-4BF7-B3B7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b3:fe:25:ce:29:1b:1b:8a:1c:00:01:00:00:01:b3
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
38034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.Extensions.Primitives/Release/net8.0/Microsoft.Extensions.Primitives.pdb
mscoree
_CorDllMain
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NetAirflow.MyTaskLibrary.deps.json
- SHA256 3942258faffd2ac842c5e77b4eb84648a72ad2b5bf14cef7dd39abaaf8bb7bc8
- MD5 1f11c1475896c03a1c4538606ac07504
- SHA1 a8d87ca552d627e317df7bc20770fc9ddfdbf695
- SHA512 cd31904b9b59bf4d214926eebd18221a848f7b99eaaaff46c028bcd03738eef6631e31c19afd6af3864cf6421d9aae5d03bd26af176b6da8e1ff0dab1c0fb1a9
- SSDEEP 96:CXIsuPnjSTNM8oBPTV/n0yc1QdpltGhjsFmyWHGpk6kfIDD47co+8g:CX+7QxUCu
- TLSH T110B14424E4546E7341B6FBD8D8BA4542F239433B2004694A78FD145C8FBBBDAA0D6F39
- MD5 SHA1 SHA512 SSDEEP TLSH
NetAirflow.MyTaskLibrary.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 13a2162b0d9d00e601239e5ba43999d02c3fd70a47e2476db7b2b0b6b5723108
- MD5 1ec1a8f12534ab0320e647a1c5548aa4
- SHA1 eb8c2b65828c71426baf1cea0172393062771ef3
- SHA512 5d100bebe72708ddf646b67ecbdbac543dcc87db207b97da5bdb72d322e50b72db88d3b9367758f241a5f33ea1d044bcda063cd1a0909c4780f2ad632d15cdbd
- SSDEEP 96:qgdiTHTD3C1KrNHU0Mh0nj/Wvnnryy3LHkpPEf/kQLoANMZQOvKjis2cpocYww44:qgsTzrR6ry6ntLkpPE3javgv
- TLSH T18812C61597D4C623E9FF5F3B8CB383860736F9015C22DB5F4888A05A1C675944EA2BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15254
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\brand\Documents\netAirflow\NetAirflow.MyTaskLibrary\obj\Release\net8.0\NetAirflow.MyTaskLibrary.pdb
mscoree
_CorDllMain
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
956B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NetAirflow.MyTaskLibrary.pdb
- SHA256 03c8ebd69e7a1a10a88494c522d12c97f066d216c4399f0568aa9d57853affeb
- MD5 d46c07cecb5bd4481b54e219697e209d
- SHA1 9c16734f57177f1fd885856c481e75eb0428c253
- SHA512 e7ab1683a8e0fa6d8c1579fcb99050d5822a4643f86b65237f42462adae5858cdf2ef0e0bec2d2b1ec6ddfdbf21c9c03b52e0b819990c6eaa34e4dacb246bc39
- SSDEEP 192:pW7ZMrtr8xcXO9gw4JxApaIxZvLbYjGEfxnsukcyamJguPJFGBNoH7fpxnxvvQOA:0kgLZ4JxApaIxZvLbYjGUxnsddfgBBNR
- TLSH T177329077934CE621C68668B65962C1CC373583202341EDBAF2C83919DDAF6CE47F6271
- MD5 SHA1 SHA512 SSDEEP TLSH
NetAirflow.Shared.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 92a7da20a340d8d79a50d7760e916c2f607ba73019c61bb3f8bd5bb8b47711b2
- MD5 8f42739472e60ed8a4635de3a74f6320
- SHA1 d118a6a37f2a7135a2d81460d3fc0295c3237607
- SHA512 1647cb61c6fb1fc87b7dbe222b491d11d34f3b5379478616a2687ec890a7e6e444ab966c230a41613f9de7cb79f6e128b19cbccbb715c793af2a43dbd4b0abdf
- SSDEEP 48:6d6AA7CnQGRwcW1G5sXMz2l/1Y9DfE3LBjx/bbn/KXDK8RNttYIph85l4tfpmJOL:6nR/W1G5sd/1/3LPbeT7HIIf
- TLSH T173B18231B7E4473EECBB0B36BDA367431234FA208A0B9BAE0844715B1C5B5105B73B68
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\brand\Documents\netAirflow\NetAirflow.Shared\obj\Release\net8.0\NetAirflow.Shared.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NetAirflow.Shared.pdb
- SHA256 74699a25b110f7f79453a41a44705b7b4dc630a0454d79c1207de9609f2841fa
- MD5 9e2b5964525ef0cfb84a7b3ecb39ea30
- SHA1 aa71179f5f7fef093e481663ff44ce452f2d96d4
- SHA512 e53af1a408e1ef18441f5c1ac210719f5ff7469c38562f0ffd6de0d37c2b645c9e9953a4567eccf281636ec27240e39413c2c8cb360da7302c7c7b05e7132a25
- SSDEEP 192:kxMyykxcXe9gY4JxApaIxZvLbYjGEfxnsukcyamJguPJFGBNoH7fpxnxvvQOOSru:kxJ7V4JxApaIxZvLbYjGUxnsddfgBBNJ
- TLSH T16A327F77A348D621C55528B26966C4CC373583202745ECBAF2C92A08DDBF69E43F6175
- MD5 SHA1 SHA512 SSDEEP TLSH
setup.conf
- SHA256 d8bbd034aabfcdb0c8462f5d9677ae323bf23095827034cbc4ac12ace82c67da
- MD5 814c4f36171645f020b352206de50702
- SHA1 a93ec52b289c3184b1383d94a2a0ff886f39c66e
- SHA512 acde52cbd2e06fa96ea07cd8e781659d9b12d8e07ce7af44dbc783d488141b2ac592ec3f763b79cf757cbd75f7369bee4dcd7f8a2b7df621486da4bf0be19f1f
- TLSH T1C6A002ACD04D9920C3C38A803966F0CC900288514C570C8982D016ACB6BB8C2035A3A3
- MD5 SHA1 SHA512 TLSH