Debug.rar
- SHA256 b79dc6fe3b4df52da5cd8065e33404c68385e28571dbce6648146e08c9e177bb
Overview
overview
3Static
static
3Debug/EIYM...ed.exe
windows10-2004-x64
3Debug/EIYM...ed.exe
windows11-ltsc_2024-x64
3Debug/EIYM...ed.exe
windows10-2004-x64
3Debug/EIYM...ed.exe
windows11-ltsc_2024-x64
3Debug/EIYM.exe
windows10-2004-x64
3Debug/EIYM.exe
windows11-ltsc_2024-x64
3Debug/dnlib.dll
windows10-2004-x64
1Debug/dnlib.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Debug/EIYM-cleaned.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Debug/EIYM-cleaned.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Debug/EIYM-cleaned_Slayed.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Debug/EIYM-cleaned_Slayed.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
Debug/EIYM.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Debug/EIYM.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
Debug/dnlib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Debug/dnlib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Debug.rar
- Size 1.4MB
- Sample261107-txvpaaes3m
- SHA256 b79dc6fe3b4df52da5cd8065e33404c68385e28571dbce6648146e08c9e177bb
- MD5 9cb346b7b9bc32ea35fa0649a8ace20f
- SHA1 cd03993177e8376991a633c33b4ecc6759edb767
- SHA512 b08590aafce6d2e8fa096a107e781edbcbbcccec80fb67388345c7603f8784b1cced3c6dc9b162c6223553a8e93db8dbc2fedc8abc81327b8d9e5edb5e6e5ec8
- SSDEEP 24576:EAwexU2zt+MgFtMBThd1O2XohSA2DZfMwbsvTUHvI2BvCa3Sce+kLDg:EAFxU2ztpS2XohSAiD0gPI2Eaicxko
- TLSH T12D6533A42694CA64D8EBA1600077798EB4350C4E79E8FC9A75F6CABEEF3C5776C0444C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Debug/EIYM-cleaned.exe unpack001/Debug/EIYM-cleaned_Slayed.exe unpack001/Debug/EIYM.exe unpack001/Debug/dnlib.dll
File Explorer
-
Debug.rar.rar 1.4MB
-
Debug/EIYM-cleaned.exe.exe 756KB
-
Debug/EIYM-cleaned_Slayed.exe.exe 756KB
-
Debug/EIYM.exe.exe 777KB
-
Debug/EIYM.pdb931KB
-
Debug/dnlib.dll.dll 1.1MB
-
Debug/dnlib.xml.xml 1.8MB
Debug/EIYM-cleaned.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5eda76f7f3c9b90c614bc0ad127ca9a7ac4833e0515f5c558dee0fc4f2e0415e
- MD5 864c34749bb1d10a843bc6f824388e9d
- SHA1 356df6b34557dacce336727797f211feec4a12a5
- SHA512 782826760c2f16ad94dccb97a858387fedbfd00893c60ed062cac23ec30ab289e6d10e5047810691aa535ba5730f095f97e3a872effee374e924bc44c2878c81
- SSDEEP 12288:/0OYaYuPPnYaYuaoMKtPqP1fAPHkBNvk2e9MKPPuP1fAP:/0CPmoMKFCKHkzTe9MK3+K
- TLSH T1CFF45BA83BD04D13D9FD62B481B4C2A047B19D239097D2891ED93CE839E2742976F6DF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
614878
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
592KB
Virtual Size
592KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/EIYM-cleaned_Slayed.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 135e0b844b2df8c69404537e35d198a388d4d44a7cf7afae1be90c453aae20bc
- MD5 55aa62eb4fe936b221705df39c3f6dbe
- SHA1 ac076efadf20d3e93c58057cb1aef735c30a77ae
- SHA512 5a3b62d08a3913a3cafaf5603d6c4473f8c6a9f73168a5db0e2768de0df4202c410954dde9d454c9d9edfffdaeb62c5230aabcc6fbc5bc633419eccb8e59b421
- SSDEEP 12288:x0uYaYunPbYaYukoMKtPqP1fAPH9gNvkgeoMKPPuP1fAP:x0ePcoMKFCKH9AheoMK3+K
- TLSH T1C2F45BA83BD04D13D9FD62B481B4C2A047B19D239097D2891ED93CE839E2742976F6DF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
614654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
592KB
Virtual Size
592KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/EIYM.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d586056871182b3b855978475b818c82dc11dcb9dfff426605507880f4d1d061
- MD5 e6a46c4028750134dc7c8bd4c81e4352
- SHA1 26d17717de624a83e1a5747728c2e447a41ac1b6
- SHA512 1704cee98e82fb963168cc6d1a0d87b4b72e4c36b89ada2a2eae7d1f50db4e4c6a9f290b500d86f21ef342f4bcdccc8f64e8d2383bcb5bca952eb12a7ac3db9c
- SSDEEP 12288:fG5ciguI/HFciguI4ukvUNMDQueYMKtPqP1fAPHTMKMPUP37AQ:fG5CHFpvvRxeYMKFCKHTMKsWJ
- TLSH T19B0517A82A988E13D9FD67F9C179806443726D039993E2091FC83CE93DA1782572F5DF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
636062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\al3mk\OneDrive\Desktop\SourceCode\MasonProtector\obj\Debug\EIYM.pdb
mscoree
_CorExeMain
Name
.text
Size
613KB
Virtual Size
613KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/EIYM.pdb
- SHA256 2203338a7697380fa6f677614ffc3c08997bad2938d178c38004ac66ac820548
- MD5 8d80753839ce3c55ab5e3d5a50b6aea8
- SHA1 4bdbd78a20bb8af43a482c0f88c5469566561706
- SHA512 1f6e770773546cb36332318e5422f80c6bfdb70a37b5fe131a5e1549e9a08fa5b13aa6db6f93118eeb9a602e1313e94e46a42b6907b36e6defccf4fa3fedd55d
- SSDEEP 6144:xmpm9fkqThOb5SM+JStZRAfzXGuNnpsA9elHDcf3S9N1lxacvZ8BfrW7njpJ1xFe:uvDAfztEjj9naja1Ow6snH/
- TLSH T1A1156D53BA82D833C4A6C6B857A74F3D933CD1944F5797CF6BA8A52C3EC231A1D46224
- MD5 SHA1 SHA512 SSDEEP TLSH
Debug/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1183806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/dnlib.xml
- SHA256 2c4e2806188d354cbf7bf81bbc3963eb465d10dcbac8a75690b219886d164416
- MD5 d5bc999b9d5cbc01e803f406952c21ff
- SHA1 645a318570c531c5470b3e114b53d74f21d783aa
- SHA512 5245c5e5e098ae915209c97a41724fbc9c849e2ec339f3517190edf4556660534a081c249b57ad145c164526c59b381a1cc69b7a95a0b529acf2d3c03c9713f7
- SSDEEP 6144:VTA+HpSCIPAqPFgrOLkOXhR+y+cNUaOtCW5n:dpSCIPAqPFgrO7XhR+y+cNUaOtCW5n
- TLSH T150857714B6C2AD121C36525B9E64FCC4FE550C33604A2E19B68D2F535F7ADCBE2AF920
- MD5 SHA1 SHA512 SSDEEP TLSH