WTT-CommonLib-v3.0.6.zip
- SHA256 ec500431573c343cbcf2ffa780c6d063ab6be2a9dcb5d8ea58277d5163b7bb88
Overview
overview
3Static
static
3BepInEx/pa...on.dll
windows10-2004-x64
1BepInEx/pa...on.dll
windows11-ltsc_2024-x64
1BepInEx/pl...ib.dll
windows10-2004-x64
1BepInEx/pl...ib.dll
windows11-ltsc_2024-x64
1BepInEx/pl...ka.dll
windows10-2004-x64
1BepInEx/pl...ka.dll
windows11-ltsc_2024-x64
1SPT_Runtim...ib.dll
windows10-2004-x64
1SPT_Runtim...ib.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BepInEx/patchers/FixPluginTypesSerialization.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
BepInEx/patchers/FixPluginTypesSerialization.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLibFika.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLibFika.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SPT_Runtime/user/mods/WTT-ServerCommonLib/WTT-ServerCommonLib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
SPT_Runtime/user/mods/WTT-ServerCommonLib/WTT-ServerCommonLib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target WTT-CommonLib-v3.0.6.zip
- Size 242KB
- Sample261102-p14ddawt9k
- SHA256 ec500431573c343cbcf2ffa780c6d063ab6be2a9dcb5d8ea58277d5163b7bb88
- MD5 31369741373a8951276377f770609960
- SHA1 20d393d9055fd5f3be7fe930f56ee4c5be4df015
- SHA512 9ec025dee7f6ac5b3a2a2ff93e88a18f6cefcebc4e86400c63b48cc3ccd6e5178ceed7dbe4eef4f858984395b40072d6884744aa8a75f4fc4768add6c954c62e
- SSDEEP 6144:llnL1cHKdoAUBfi4CpkpRNW1SKNvuaZasUlVUpD9x:rRcSV0i4pRNW1JN2u8u3x
- TLSH T17234231995EED69CF2618B333E9B77A469E8BC917124461EF0BA102B14CC981CDE8B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/BepInEx/patchers/FixPluginTypesSerialization.dll unpack002/microsoft.deployment.compression.cab.dll unpack002/microsoft.deployment.compression.dll unpack001/BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLib.dll unpack001/BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLibFika.dll unpack001/SPT_Runtime/user/mods/WTT-ServerCommonLib/WTT-ServerCommonLib.dll
File Explorer
-
WTT-CommonLib-v3.0.6.zip.zip 242KB
-
BepInEx/patchers/FixPluginTypesSerialization.dll.dll 137KB
-
microsoft.deployment.compression.cab.dll.dll 48KB
-
microsoft.deployment.compression.dll.dll 36KB
-
BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLib.dll.dll 152KB
-
BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLibFika.dll.dll 8KB
-
SPT_Runtime/user/mods/WTT-ServerCommonLib/WTT-ServerCommonLib.dll.dll 297KB
-
SPT_Runtime/user/mods/WTT-ServerCommonLib/config.jsonc45B
-
SPT_Runtime/user/mods/WTT-ServerCommonLib/db/CustomLocales/en.json215B
BepInEx/patchers/FixPluginTypesSerialization.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bd6b988e1d2ee0ec070e69a2711c79f72f4bb1930d6778cf0900c446dc70325c
- MD5 e126b9d21378afc76c514fc72098cd3a
- SHA1 8d56741d1cd4a1570ea95b1a8443d5b728e71ebd
- SHA512 dfd8dde71149ee5c48d1a65625939d0ee737533fcc76803172f9769440e40af010ee33fb0cd706b516b8f8ffc81035b14a472fe4123df1af98236372fa6811a0
- SSDEEP 1536:/QmMcuoN3+JB9nAW8k7dxjkoSEchTUG4nON61Tqdrjh+ZsmBRhoheCoLPrbPPtpV:Y9cuoN3+JB9BgcyWO0XSYWgPTbuhQ
- TLSH T16AD32A1E13F84A36EFEA163E54F19B0407B998667611F30AEC9487FB1C9E7D48A40B53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
146094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\jakec\FixPluginTypesSerialization\src\FixPluginTypesSerialization\obj\Debug\netstandard2.1\FixPluginTypesSerialization.pdb
mscoree
_CorDllMain
Name
.text
Size
135KB
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
microsoft.deployment.compression.cab.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 396d5c26a253cd68b880620391a2ac46881995ab8374aa65315a2c250c18b88f
- MD5 79762e5bb1df556e33f97a72e7b25120
- SHA1 4f9b34a236c90903147cba575f2044b14d766f19
- SHA512 99599ac0993329f06d32e4cba47e59a610692f5164a89ec37b97891f0c0673f72334aa8a8cf7d1bf07162965e457d6b676b92144f39433650c7b2617d216804a
- SSDEEP 768:NqJeXMeN87ApxAz0YyT5kcpdlQf7ayGTl4Pux+ugHnGLov:NpEApxkctQfh84Pu0DGy
- TLSH T19B234B1067DC8627EBEE4BBD85B121A203B0EA397613F7D68D85D0AA7E177D053A0317
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42518
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression.Cab\Microsoft.Deployment.Compression.Cab.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
microsoft.deployment.compression.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3077b23b8637bb07e4abf83f03613e56e324d28475694b93e8bf74130e88909c
- MD5 eb17c6d71a32fb17202a6c70428268d2
- SHA1 7cbf641e37115ece84ece7a0b7efc0d9fc713489
- SHA512 da5d7a1926533b0e63561c6ad1d98289e95f736a4c67b662d1a9ca15bc2b0e105cab9ea21444ecf3f26fe7f4da8b06183fc08ad2d35c56cdbbef2aafb1485354
- SSDEEP 768:BqYBKFxJeMiyAL0xjfxWXsBOU7iisO1Kl1OxAqR:BLEFvpiya0xjfxWcBOU7iisVQxv
- TLSH T160F22B5567DC823FFEAF0AFCB57222690370F651A913EF494C8CA0AD2C137585A513AB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32154
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\build\work\eca3d12b\wix3\build\obj\ship\x86\Compression\Microsoft.Deployment.Compression.pdb
mscoree
_CorDllMain
Name
.text
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 40b345cdc5d509028023989efa8d96dd7dd4753257338d1f9d37a024fe9a1a3c
- MD5 5a29c4775312f1ab6468c33828c16752
- SHA1 ce37f397c26a668d189d8434381e3c1331d29101
- SHA512 e7bd85881aa2332572f1cffce73813c466360a580b5d1b12af21c6c70abef7494c8fc5972cc3bc30ab11c92931741026e66778bf9e4d2bfa2fa7400af64df734
- SSDEEP 3072:82xSByw+lN3Jz/yZdDx8pSaq4VfSTSrizaG2NQLId:LwMz/C+SaqKV
- TLSH T183E3087863FC8668E3FF2FB9F87001510BB6F947E837E61D194464DD0A62742AA21763
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
161294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Q:\Games\SPT_410\MOD_DEV\WTT-CommonLib\WTT-ClientCommonLib\obj\Release\netstandard2.1\WTT-ClientCommonLib.pdb
mscoree
_CorDllMain
Name
.text
Size
150KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
BepInEx/plugins/WTT-ClientCommonLib/WTT-ClientCommonLibFika.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e6f9a3517edefe5922ccae54711d17cd02c360fb22d9884b6724355aa91ab9b0
- MD5 a92cdda798196bf51b6c4bd8cd4b3982
- SHA1 05cfab8b83a7aea28693439b86dc54ec881223c7
- SHA512 f7f7db1cbd92845fc15430a6099f2c302ed831bcdfe1fefa6f292a2417ccf8b0178301f93626666a383d746dc3f72087ef17c1c52c7a4ae30ff5ad72f7a8b2a3
- SSDEEP 96:0qLQdBO8LzxVtYmXQk3/0k5YID0eGIi/sweBj2a3a2MNaut2RKbr6PBPqT:gO8LZgkxh/dMF6
- TLSH T14802BA0153FC1235CCBB6BBDFAB9A2610F75FA516637CB5F09C0104A6C176A09762B36
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14322
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Q:\Games\SPT_410\MOD_DEV\WTT-CommonLib\WTT-ClientCommonLibFika\obj\Release\netstandard2.1\WTT-ClientCommonLibFika.pdb
mscoree
_CorDllMain
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SPT_Runtime/user/mods/WTT-ServerCommonLib/WTT-ServerCommonLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dc765a67977c97315ce776d1042980894520fa02dde35c67dbe80de8cf4b15e8
- MD5 ee5aa56670d55513abbbc72aa912ecb5
- SHA1 a7913db26946bd70db3c060e8e301cfcc717931f
- SHA512 b50c8b085450a95a53a16ee227f5e01ebb64546f0834bce0bda2cc11c9d9ed42b550731b3e7175bf1e785c6070e038fd90e82b13ac9f92680661c5fd2465c7b1
- SSDEEP 6144:XtmZl3jMzamdzOg8vlrLZPz7xE+0jOU5nwDi4m:88dzxklxPzVBDi
- TLSH T1A754192163FC4725F8FF9B7AF8B4419446B3B283BE61E71D498960DD18E2B00969173B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
310022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Q:\Games\SPT_410\MOD_DEV\WTT-CommonLib\WTT-ServerCommonLib\obj\Release\WTT-ServerCommonLib.pdb
mscoree
_CorDllMain
Name
.text
Size
295KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SPT_Runtime/user/mods/WTT-ServerCommonLib/config.jsonc
- SHA256 62cf530372501bf54903af0fa1fffed7932333228c1c19d13caf9bfd6291158b
- MD5 8d04cfddf0f20062dcd6849d5e7dbd2c
- SHA1 b1d7faec69791107077673e18ac4b688d9a9a354
- SHA512 a369e07229c0b75ff3ba31d504649852cffc4df71297508f4039018bcac8b66f6df8b13cece6d9e47ec56d76f5980bf80e473d7805049abff1fe0a9e0bfccf93
- MD5 SHA1 SHA512
SPT_Runtime/user/mods/WTT-ServerCommonLib/db/CustomLocales/en.json
- SHA256 22bba18943bc37bb518c2f330720acab5c4b0fb8ec5850711530e9795e6d61aa
- MD5 1665cc609abd30c96d1c8eacbe1efccc
- SHA1 90b53cd0e14b5f63d72d8ce8d6adf652d20aa4c8
- SHA512 3050e4079713239f6235a358cf5fc9963c30ee9ebae2a09b3856b13180e183a7b3ac5b668c643186069ec57bcfb9511e837bb85d664f6ee62cfef8f9fe61722b
- TLSH T158D0A923C811E2CE87250554A80AF266F00F0E8DF220088EAF33096827DC00C2695381
- MD5 SHA1 SHA512 TLSH