CURSACH.zip
- SHA256 f6d42f583f325d085b515eec1ed2a16b9a3b49dfa706602eb5bd1d5f12513f3c
Overview
overview
5Static
static
3CURSACH/CU...ram.js
windows10-2004-x64
3CURSACH/CU...ram.js
windows11-ltsc_2024-x64
3CURSACH/CU...CH.exe
windows10-2004-x64
3CURSACH/CU...CH.exe
windows11-ltsc_2024-x64
3CURSACH/CU...st.exe
windows10-2004-x64
3CURSACH/CU...st.exe
windows11-ltsc_2024-x64
3CURSACH/CU...ds.vbs
windows10-2004-x64
5CURSACH/CU...ds.vbs
windows11-ltsc_2024-x64
5CURSACH/CU...CH.exe
windows10-2004-x64
3CURSACH/CU...CH.exe
windows11-ltsc_2024-x64
3CURSACH/�...�.docx
windows10-2004-x64
1CURSACH/�...�.docx
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CURSACH/CURSACH/CURSACH/Program.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
CURSACH/CURSACH/CURSACH/Program.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.vshost.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.vshost.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
CURSACH/CURSACH/CURSACH/bin/Debug/KeyWords.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
CURSACH/CURSACH/CURSACH/bin/Debug/KeyWords.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
CURSACH/⠪ 㯯 権.docx
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
CURSACH/⠪ 㯯 権.docx
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target CURSACH.zip
- Size 447KB
- Sample261107-p2npbab14x
- SHA256 f6d42f583f325d085b515eec1ed2a16b9a3b49dfa706602eb5bd1d5f12513f3c
- MD5 187cf19e6dc23a22de40456543f87a47
- SHA1 5fdd710f4163b4e05277577421066ec0ec9216d9
- SHA512 f35c9600510c658b352f77a4f69946888281e46ec93ceff1e9db7e837c766263abadd2e200800ad1d062e59bcacd22541081b6067a184e586868ca32947d54c5
- SSDEEP 12288:QbxuhbUygTvYIsTqCLVxSEmxBZPdkWR7Kb/tqcQEO4LUhBsPC:8gCyUvYIJCpxSEE/k4KTtrQ/UUDMC
- TLSH T1C3A4237C4133C9DACE2E8B71AB4222876334DD97A50F471B4F581BF1948AA401FAE9D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.exe unpack001/CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.exe
File Explorer
-
CURSACH.zip.zip 447KB
-
CURSACH/.$Cursach_virt.drawio.bkp85B
-
CURSACH/CURSACH/.vs/CURSACH/v14/.suo41KB
-
CURSACH/CURSACH/CURSACH.sln988B
-
CURSACH/CURSACH/CURSACH/App.config189B
-
CURSACH/CURSACH/CURSACH/CURSACH.csproj2KB
-
CURSACH/CURSACH/CURSACH/Program.cs.js 58KB
-
CURSACH/CURSACH/CURSACH/Properties/AssemblyInfo.cs1KB
-
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.exe.exe 26KB
-
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.exe.config189B
-
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.pdb41KB
-
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.vshost.exe.exe 22KB
-
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.vshost.exe.config189B
-
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.vshost.exe.manifest490B
-
CURSACH/CURSACH/CURSACH/bin/Debug/Delimeters.txt125B
-
CURSACH/CURSACH/CURSACH/bin/Debug/Identificators.txt32B
-
CURSACH/CURSACH/CURSACH/bin/Debug/KeyWords.txt.vbs 130B
-
CURSACH/CURSACH/CURSACH/bin/Debug/Numbers.txt34B
-
CURSACH/CURSACH/CURSACH/bin/Debug/code.txt81B
-
CURSACH/CURSACH/CURSACH/bin/Debug/lexems.txt174B
-
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.csproj.FileListAbsolute.txt580B
-
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.csprojResolveAssemblyReference.cache1KB
-
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.exe.exe 26KB
-
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.pdb41KB
-
CURSACH/CURSACH/CURSACH/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache6KB
-
CURSACH/Cursach_virt.drawio16KB
-
CURSACH/Cursach_virt.drawio.png.png 420KB
-
CURSACH/⠪ 㯯 権.docx.docx 16KB
CURSACH/.$Cursach_virt.drawio.bkp
- SHA256 d1357e87b3b466b582750ea79d915e28b7213297a96b8b73b863f32eaf3f7ff3
- MD5 cde9bdb7d9031d19a713dcd70cb2d666
- SHA1 ed09e4e84e67436193bc0a61c05c0e32717a5e6d
- SHA512 ebb4db657c918c2b09d8c94d5cabdbb1789347b5c9f192fe16206394d921635a3d400c270138a0675a664eef8ccb619a9401a556aee9fa92da0fd14f57740407
- TLSH T1B8A00241625C57145D94777167DCC41435DF47720311B10CBB8CE2145108D555CC5421
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/.vs/CURSACH/v14/.suo
- SHA256 fa02e27df08ca38476a3a772ee927f17fa9fd88e89813c60987db648cbaa5f39
- MD5 0a3250c03982d6206e634d50d4512d08
- SHA1 a14f2fd07a16a62b3dde7542f30fd46bb95c03b8
- SHA512 196405074649897864da2488c4eedba66c7fb9cbbeded0f03d4e7fe7ebaebf76be823b794db256788e05f53b15ab967b7ebdd5de6d8963c0b47a77fd94ae9ae4
- SSDEEP 768:jg0B0vVwjPd8oRORRx8W8K/8otIORRx8W8iot:jgywWjdzRORRx8W8K/zyORRx8W8ig
- TLSH T10E13432027F85259F3B78E706EFAD6996973BC22AE25C71F2055334D0831A41CD76B27
- MD5 SHA1 SHA512 SSDEEP TLSH
CURSACH/CURSACH/CURSACH.sln
- SHA256 279a6488fe188767215afb9fea7a81f9b72fc2ccec476b7a5788a1af8e23ab6d
- MD5 6bcc438e4539c7179c0299e36f893a4d
- SHA1 f99e1c62deac748308f8c234d69df8db05ae986b
- SHA512 e36cc9b57927453e5fe58593b30dc270b5482337cbf430bdaf91415f76c197596a983c61df49b982451730bb0d5d3e675f7810ca18c9ecc093656f5927336826
- TLSH T11B110AAC114D4CF4798523EA95F16CC72E338140D6DE4D3C619D60A82B1BE15D6BF48F
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/App.config
- SHA256 e8decc96235b5494880083eb79c22c84c6d9ef312828baf9490bee7782c350ec
- MD5 ef0181de18ef3951806c0ad63b897ba4
- SHA1 4b6a4b0f7fbbbd1dceab385e7fac74a35fc132cb
- SHA512 b1816817e8deaa7b22bc51966e9debed46b254be6463f2ac0204be348baefb751c5d846a5353d43cce66a005a73f6226462b8ec8b59d4e16a54130c327c68b79
- TLSH T10CC080554454BD274D334B1357528529EFB073A36424140CF01FE5560F3114D4657377
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/CURSACH.csproj
- SHA256 16690a7fea8e75f3b06838ff01bd66bfd6b5df7c295358d56604d0c64f9b1408
- MD5 ec3612ed81f011db4af17b96a2f2d572
- SHA1 8319b5131e90d4ad0f622c61049e8f921b3a0044
- SHA512 570e1d3c35524899defc943b67d804f0775c657f30f61f40e1fb2d652796a255256f3960eb35788f739c8b6134c42b206325f10ce8b984a4b1bf342323a1b43d
- TLSH T1B651FF30D1C86A9A43B45533D1B3AA45DA38A3E325944C98F69DE54B0B33E901153773
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/Program.cs
- SHA256 3ad4bab436d07dfffcaa66e995c76ee215eb57d155038be12dcd06dc6aad77bb
- MD5 d40a1f81aca1553258e3752aae6f0757
- SHA1 fb43c4aee91694e074417761f09a3d53a89d8387
- SHA512 d5ba4c9ab86f07e94ed8501fd73741a37c94980d6c5c07cb2911ac742b91abcd34e4f6a308843d89df152133242b57f697ebf0b9d7f71c8ae079230dbd6439e5
- SSDEEP 384:98bOPqRqNOhNMn0ubYYbk575ATjN5/tNfstZdoMt4GNuLSPN0AMImD3+d9Q:KoaT575ATxV/u5X15d9Q
- TLSH T1B243BB055C81067B4833A7BE870BA88DFE73232705E8531D7E6D64582FB652D42F2EAD
- MD5 SHA1 SHA512 SSDEEP TLSH
CURSACH/CURSACH/CURSACH/Properties/AssemblyInfo.cs
- SHA256 ebf14693add8bd3c094d6ca52eb8c82fc88f51a5a0249925303ca336032379bd
- MD5 3ef37e86072060a8d5def803a3c23f25
- SHA1 e1f424d6acedbb452a6d9d8f5b8c7e415a10f81d
- SHA512 05874e06f2d88a5d9cb3c1bd3d3e0dcbd887a48db0a0d73aad6558193782dddaf897bdfaac2ff3bf06459f73ef1c50f3a77dfb3aaddbf2daf4e8a79608a7c42a
- TLSH T104417B780586616E8F00F457ED09794874AE63FE2BEA461721E93C17F9A2178831D62B
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 02c75a98ba5734630103fd2c2993f663810f5c3b4a7ea2742e13d7871082433e
- MD5 7f70953d6b96c5e9c107428427df068b
- SHA1 1cb87f954a858733b5d0bdefb7e32a02ebe40e3a
- SHA512 5adb4409712b066a1cb0dbea36c34be9ff103128f6155cceec2f21b700ef04f33f33dc99ee5e765721f0307eef9f1ea3d9a6aa9fe604cb78f6e54e0f9d53d181
- SSDEEP 384:OVUC1xmebem7ZqF4synvH/xpndGzKrSUA+tXSkVtV/cWeueuw8O:OVv8ynvH/xpndGzK2U5b/cXulw8O
- TLSH T1C6C2511AF6AB8D72F5BC4A3805E312816231B6075F01918B5B8BC8E5779CFD9054ECAF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\1655299\Desktop\ГИТХАБ\TFL3\CURSACH\CURSACH\CURSACH\obj\Debug\CURSACH.pdb
mscoree
_CorExeMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.exe.config
- SHA256 e8decc96235b5494880083eb79c22c84c6d9ef312828baf9490bee7782c350ec
- MD5 ef0181de18ef3951806c0ad63b897ba4
- SHA1 4b6a4b0f7fbbbd1dceab385e7fac74a35fc132cb
- SHA512 b1816817e8deaa7b22bc51966e9debed46b254be6463f2ac0204be348baefb751c5d846a5353d43cce66a005a73f6226462b8ec8b59d4e16a54130c327c68b79
- TLSH T10CC080554454BD274D334B1357528529EFB073A36424140CF01FE5560F3114D4657377
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.pdb
- SHA256 e709ef9c6a8cfffa4cb4ccdaa0a494c6302f27e2e695c60d7638bde416aecc8a
- MD5 c4a723b3d6611b09ec9b3c5d324bee9b
- SHA1 64c38ec3b6cd9cf1220676f5d7109907c16dc115
- SHA512 892ae65b4b710496e839adda3ecbd772d5ae5c93ccfd2d9b53997858cd937d0641de9ca5bcb2916569c1ff2d7ecafb7909bffa43c8adf16ee1df0d9bea2d15a7
- SSDEEP 384:d8VOzVpVwOu2FH0ptpepn0jsMJBXjZXclFzKdUqNXcYU3Ro19VaPr4drZ4I8:d8ApKOSptpepWsiTZaGlY3RE8cdaI8
- TLSH T1DA130C03F6D1C933C861C17552AB0F2E83B8DCC94B4B574F9AB8B96C2DB275A5D85328
- MD5 SHA1 SHA512 SSDEEP TLSH
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.vshost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 58d46a3801c280908698ef4ff789546427b9be7cd78f61a7533cc2f56c1b881b
- MD5 5a968502b84a268ca84018f1a9f6bb59
- SHA1 473b76e89014eebfaa03aa6c3b741dc3747c98c7
- SHA512 73b0a1903b92e95ca0251e78a18d4fbdf61be15ec29f283488a7c3914ca2bdbb4267a4f5f86e0cd20a809bed1f0f0e804189da541a58a50df35271107f0c1bd6
- SSDEEP 384:TICPZQWMPW7SUA0GftpBjcV+ILKHRN7illI66s1:8WAMiWVm566
- TLSH T1E9A26C95CB7C8153ED935DB067E8EA837C3CA7D34C21962A006AF5C82C833D49F24A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e1:e9:5a:9b:c5:1a:28:db:42:bd:3e:5d:d5:82:29:59:09:eb:72:3d:46:d7:fc:fd:7c:97:3f:60:48:fc:99:e3
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 7, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
3a:f5:f3:30:87:8a:ac:42:96:2d:53:28:d8:38:6b:e3:62:bd:cd:59
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jul 7, 2015
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 4, 2015 - Sep 4, 2016
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 1, 2014 - Jan 1, 2016
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:57:29:61:51:29:c9:95:06:f9:00:00:00:00:00:57
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 20, 2015 - Jun 20, 2016
Minor OS version
0
Major OS version
4
Entry point
12122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
f:\binaries\Intermediate\vsproject\vshost32.csproj__1853760103\objr\x86\vshost32.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.vshost.exe.config
- SHA256 e8decc96235b5494880083eb79c22c84c6d9ef312828baf9490bee7782c350ec
- MD5 ef0181de18ef3951806c0ad63b897ba4
- SHA1 4b6a4b0f7fbbbd1dceab385e7fac74a35fc132cb
- SHA512 b1816817e8deaa7b22bc51966e9debed46b254be6463f2ac0204be348baefb751c5d846a5353d43cce66a005a73f6226462b8ec8b59d4e16a54130c327c68b79
- TLSH T10CC080554454BD274D334B1357528529EFB073A36424140CF01FE5560F3114D4657377
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/bin/Debug/CURSACH.vshost.exe.manifest
- SHA256 c0085eb467d2fc9c9f395047e057183b3cd1503a4087d0db565161c13527a76f
- MD5 a19a2658ba69030c6ac9d11fd7d7e3c1
- SHA1 879dcf690e5bf1941b27cf13c8bcf72f8356c650
- SHA512 fa583ba012a80d44e599285eb6a013baf41ffbe72ee8561fc89af0ec5543003ba4165bfe7b1ba79252a1b3b6e5626bf52dc712eacd107c0b093a5a2757284d73
- TLSH T1F1F0DCC1D188CA6AD73042A13A66E420A2AD435B19DD49EC74DC2ABB6F0BBC680C30F1
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/bin/Debug/Delimeters.txt
- SHA256 5aad63dc55c88d699fd0a6503a6ec4576d2db860fff6f9ed452cbb9a6dc9ce66
- MD5 a9b59217a4a4a9941bbb7e3e0c29ed4f
- SHA1 4529332631f3ef2b80807ab3e404399b8d4ae552
- SHA512 4b4829f8d425f4544bb99458ac8465f72f4c69b720fd63c63d3869e74d184d50930539d812801e0bde59b46ac95105c9f0c9704ceafae50286452ae3564bb164
- TLSH T164B0928698024E2922B81B4612E6A2D8F2AE5116A18B1CD2B4E0425A53205937486338
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/bin/Debug/Identificators.txt
- SHA256 3e540a958d086a4cbdfd537bc20319c43bf9b1c68725a70db4ed8fc249aa95c1
- MD5 0bc6eafeaec00cc572cfb14e73366e2b
- SHA1 d3b8e53615d1dd9c62ba4077ab0f96b2999ec1d1
- SHA512 7219b0f5820f0f616b7bf624fbb8fada76c51af46af1a0db3521ec876103a02f1618977d2759994b1d555d2eafa0c1e5282456c5e5c91576adb7c42029301c70
- MD5 SHA1 SHA512
CURSACH/CURSACH/CURSACH/bin/Debug/KeyWords.txt
- SHA256 8e9e20fc99d42eb089a32488a7e1f5b0ef24eb56a561af18a568210f7079b304
- MD5 085386ce74d5fe9c83a8c0ce88363187
- SHA1 df00bb0c7ccfd3675e4c4f5cb8d12e8046751cd1
- SHA512 1da25cc0e719d65ca19f4d7fb7f9f16ccf22c5d9ada600f2dba2ffba84988513408d8aa82ac07dfeb7cceb4d62382363efafa5cb988714a44353204a6077a26f
- TLSH T159C0921E29AD829A02745B551286E50DCDB45365EBC283DAF192A8B92DA42F88487928
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/bin/Debug/Numbers.txt
- SHA256 f606d53598b5b6ad79c5e7d722af0b8364b3d5a10b62b2d37327ae4dbbebec21
- MD5 f892667a2cdea87363aa9b886f494a93
- SHA1 305940dabd6564f6710009f05beca10c007afd31
- SHA512 c2ee9ae85a7ce3273a6bd14f2158255c5024065a7f03a5276de0d87e63b689458f4defc869912e5964cc98e32f57d44b78c11fca39c4ae048d0ecc1294d49bf3
- MD5 SHA1 SHA512
CURSACH/CURSACH/CURSACH/bin/Debug/code.txt
- SHA256 436baeaae1ea294886225491f2beb5ceba82a195aec213815bd56f5d7f251d63
- MD5 401785a49edb585592ac3792aed8d786
- SHA1 25f5765190367faafe6dd497a02beb0e3b8dd2df
- SHA512 58b2b7c0ab34996e2b3ba4c877ed3c6771fc46f0dc6aa0e84695b28524b2f624ea38ea9bbc2c74a1df031ce855907471c54ae3a79a4a07ab639690f9b76ff5cc
- TLSH T18AA0120023980021231AF074C5048A91501048345A624A4031408040C910928EC8A409
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/bin/Debug/lexems.txt
- SHA256 eeeb98a62b794e88418c8300cd6cecbec057a46f955624adc873414cb33c0a33
- MD5 87868f6762620ad35c59a24cbcb1eb10
- SHA1 8788a5cab2d97c59eb0f6c55d9357d1036816b02
- SHA512 08def7ced47450bc9102c08c8ebb9f3688baed4295dd1b23ce081b7346894d0440bd02b322da72629e3c77055292c6adbdee71172fad453f80808ebe2be17e37
- TLSH T1D6C04C42591B5674135DA0BDD80D4B4C8E63D712CB8BAC33451CA035494FE539164162
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.csproj.FileListAbsolute.txt
- SHA256 fb23a82ca513c3c681c7cc1039beedbbe8457ea846088c91aba9f2d7e028f014
- MD5 fde573a1d89ab1290524ded0578479ed
- SHA1 2c13378e3a35ab7249bd41376ae5d33c1a9099d5
- SHA512 6fd146b2be624c5fac515dbcf5c33a8314627fd1955ef3c553bf7c5e228416b9e5219d558e42b52dcf702b4e646cd350a92f47f34ebfa6f7614f4dfb57c8ad35
- TLSH T1FAF062FA40AC003683BC2945C35D609B23E21C13A5530F837AC50E43B5C7E1C27DF611
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.csprojResolveAssemblyReference.cache
- SHA256 8ff166459e8992ad2ddd57bd457f90cb2153a696e3dc67ed3b17ebd5474b1290
- MD5 34f2fc47b650441f73f6700a1cb86620
- SHA1 a9bd60687ff05d07b0a74f3ea6139386715a22bb
- SHA512 57bec98e2daefaa457f13384a21b5cf0e576a46f1b184ee355189635ad989102780d9438ad500f12355151130c8cc86d5d70a75b6c2c3d0939570d70353765f7
- TLSH T1CC418038D600C771E672B464FE52394935E94277B898AF69B1C8090EC4F3EDD2116353
- MD5 SHA1 SHA512 TLSH
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 02c75a98ba5734630103fd2c2993f663810f5c3b4a7ea2742e13d7871082433e
- MD5 7f70953d6b96c5e9c107428427df068b
- SHA1 1cb87f954a858733b5d0bdefb7e32a02ebe40e3a
- SHA512 5adb4409712b066a1cb0dbea36c34be9ff103128f6155cceec2f21b700ef04f33f33dc99ee5e765721f0307eef9f1ea3d9a6aa9fe604cb78f6e54e0f9d53d181
- SSDEEP 384:OVUC1xmebem7ZqF4synvH/xpndGzKrSUA+tXSkVtV/cWeueuw8O:OVv8ynvH/xpndGzK2U5b/cXulw8O
- TLSH T1C6C2511AF6AB8D72F5BC4A3805E312816231B6075F01918B5B8BC8E5779CFD9054ECAF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
31746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\1655299\Desktop\ГИТХАБ\TFL3\CURSACH\CURSACH\CURSACH\obj\Debug\CURSACH.pdb
mscoree
_CorExeMain
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CURSACH/CURSACH/CURSACH/obj/Debug/CURSACH.pdb
- SHA256 e709ef9c6a8cfffa4cb4ccdaa0a494c6302f27e2e695c60d7638bde416aecc8a
- MD5 c4a723b3d6611b09ec9b3c5d324bee9b
- SHA1 64c38ec3b6cd9cf1220676f5d7109907c16dc115
- SHA512 892ae65b4b710496e839adda3ecbd772d5ae5c93ccfd2d9b53997858cd937d0641de9ca5bcb2916569c1ff2d7ecafb7909bffa43c8adf16ee1df0d9bea2d15a7
- SSDEEP 384:d8VOzVpVwOu2FH0ptpepn0jsMJBXjZXclFzKdUqNXcYU3Ro19VaPr4drZ4I8:d8ApKOSptpepWsiTZaGlY3RE8cdaI8
- TLSH T1DA130C03F6D1C933C861C17552AB0F2E83B8DCC94B4B574F9AB8B96C2DB275A5D85328
- MD5 SHA1 SHA512 SSDEEP TLSH
CURSACH/CURSACH/CURSACH/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache
- SHA256 afee0fc804dba5fa12e924414fc06c6944fc21586c9c1508a057edd288f2d52f
- MD5 4fdcb2d7c8ff24c04d186c22db75dc39
- SHA1 2b6e48a48f7e51968221fb7fac303dd25ff21881
- SHA512 09b162ac86941aafab93f8b6c92f7b9098cac220a5326e4323a4557013df960996be468ad1a83e9f3d45e3def1b1241b8d90c7c8c68494b52d458396b391480d
- SSDEEP 192:Iig1EA1E6mrFmrFmrFi1EA1E6mrFmrFmrFM1EA1E6mrFmrFmrF88Si8PFMf1EA1v:Iig1EA1E6eFeFeFi1EA1E6eFeFeFM1El
- TLSH T160E19B34210893FA49632E91B455768223FF539F7A681E8CB960272DDC22E6F4737793
- MD5 SHA1 SHA512 SSDEEP TLSH
CURSACH/Cursach_virt.drawio
- SHA256 bbb9e5dcee86cb5f8cf9688a3888138b58338442eda6060f2bfa9a8ee6e9bca3
- MD5 830fe09194360b447d4b95050cd60fa1
- SHA1 b22a75c86e666694ea46f91d85bb40d0f078bc28
- SHA512 b1cd7f630b94a0a2ed2ab80c7a46f133cb8a94ab2f91533cde117cdad80cae0cafbcb6138734b36bf8bf6df86eae311149b623ca0bbbf306c2e25d80c7c32b8a
- SSDEEP 384:GUt6g/nujLe1U7V7QKcncWhWAfVUHbi4wYK8+6Lqbn/:GDg/nun4MNHVSWI+HRb+t/
- TLSH T15B72D04EF9A68F21077132531AC9AB032433A11A7141609DDF69CB77EAACC5AC427E6C
- MD5 SHA1 SHA512 SSDEEP TLSH
CURSACH/Cursach_virt.drawio.png
- SHA256 084c722378502ff72c780133f5874c1578e66f5bf508d7f1a9e6d3bc7b6c83c9
- MD5 7349413d0ff2849eb7028f9bb3c40f33
- SHA1 ce623d5f5273f9f277acdf760751ec786a6777d6
- SHA512 caaf74bc2d97aefca3406716495b88469ddb8f35860015ece906732abf884f5c704c393bd269c876826336cba3b771152a7626b29be7b26a9ec60050735c6cee
- SSDEEP 12288:BJNWAGxirsu4TfgLvVQyn0GOq4YeMagNlHf:BXWAgirs9T6eyn01VYjfHf
- TLSH T10C94CE27DDA9386F8520A66153037AD0D179289F743E2F2F1F856A721E6F1D8F430E68
- MD5 SHA1 SHA512 SSDEEP TLSH
CURSACH/⠪ 㯯 権.docx
- SHA256 7b0ea4c3b8fcf53f7cbd2f61cf17f5624a5b4705c62999cb65b8c540b75f4188
- MD5 d7170767163073744d24e9266576b4b3
- SHA1 1f8243149fd715dcb6dae61525a5c7b85362f515
- SHA512 db458975265ac1f571b78d8288eeb981701b124910115e8386ca66f36d7f75b20400968785c5d9bbd9690c322294cb5de001dfe13551703239771317b5d9b341
- SSDEEP 384:TDCXYy7Knfz1/oy6CznSYyW2KQQr8comLwKU2:Tty7Knb1zzSYBmFcRLwK5
- TLSH T1F2729EB2DF44BC39C79A89FE681F42E2F25F40839782E586700537744EE1647178E6AA
- MD5 SHA1 SHA512 SSDEEP TLSH