dnSpy[.]Console[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
dnSpy.Console.exe
Size 139KB
Sample261107-p46ynsb16s
SHA256 826608b138ce60439dec9828aa246a847e02c34cc04a2933ba242696c770fcd2
MD5 56bb7df6ed7405a8ff99797423b44c6f
SHA1 99fafb636f51a5d1bc03cbf813f806e50d05bd2e
SHA512 9f00bf86a1607f5bf441bbf6e6fa44b8c907ef431d7d5ba991cbadce09658a4322f952d3a7da7e8e2cad936501faf1fa156a1109289723c4f2ab233c2354e86d
SSDEEP 3072:9Uffq4qd9J+AbT9aMqOQl+RgAvImdr+swj7:9QANK4bNlw
TLSH
T155D3380BB2F921E8E0B6D23985A24601F336787647769B8F03A0462B1F777E0DD79721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dnSpy.Console.exe

File Explorer

dnSpy.Console.exe

.exe 139KB

dnSpy.Console.exe

IMPHASH ea4dd374d22e48fdcffcc7ad5e323053
SHA256 826608b138ce60439dec9828aa246a847e02c34cc04a2933ba242696c770fcd2
MD5 56bb7df6ed7405a8ff99797423b44c6f
SHA1 99fafb636f51a5d1bc03cbf813f806e50d05bd2e
SHA512 9f00bf86a1607f5bf441bbf6e6fa44b8c907ef431d7d5ba991cbadce09658a4322f952d3a7da7e8e2cad936501faf1fa156a1109289723c4f2ab233c2354e86d
SSDEEP 3072:9Uffq4qd9J+AbT9aMqOQl+RgAvImdr+swj7:9QANK4bNlw
TLSH
T155D3380BB2F921E8E0B6D23985A24601F336787647769B8F03A0462B1F777E0DD79721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\standalone\Release\apphost.pdb

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetLastError GetFileAttributesExW GetFullPathNameW GetProcAddress DeleteCriticalSection WideCharToMultiByte IsWow64Process LoadLibraryExW FreeLibrary RaiseException RtlPcToFileHeader EnterCriticalSection FindFirstFileExW OutputDebugStringW LoadLibraryA GetModuleHandleW RtlUnwindEx InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError DecodePointer EncodePointer GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_errno _cexit _seh_filter_exe _set_app_type _invalid_parameter_noinfo_noreturn _configure_wide_argv _initialize_wide_environment exit terminate _get_initial_wide_environment _initterm _register_onexit_function _initterm_e _initialize_onexit_table _exit _crt_atexit abort __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __p__commode _set_fmode __stdio_common_vsprintf_s setvbuf _wfopen __stdio_common_vfwprintf fflush __acrt_iob_func fputwc fputws

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc

api-ms-win-crt-string-l1-1-0

wcsncmp strcspn wcsnlen strcpy_s _wcsdup

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-locale-l1-1-0

_lock_locales setlocale __pctype_func ___lc_locale_name_func ___lc_codepage_func ___mb_cur_max_func _unlock_locales _configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-time-l1-1-0

_gmtime64 wcsftime _time64

Name

.text

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dnSpy.Console.exe

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic