Archive2 (1).zip
- SHA256 1d4c76904bababa206ffa95e6fb62b7e96afb137bac79a80209dbd11b8c291dc
Overview
overview
10Static
static
3Hidra Forc....0.exe
windows10-2004-x64
10Hidra Forc...am.dll
windows10-2004-x64
3Hidra Forc...ch.dll
windows10-2004-x64
1Hidra Forc...ic.dll
windows10-2004-x64
1Hidra Forc...lg.dll
windows10-2004-x64
3Hidra Forc...pw.dll
windows10-2004-x64
3Hidra Forc...c2.dll
windows10-2004-x64
1Hidra Forc...ub.exe
windows10-2004-x64
3Hidra Forc...ub.ps1
windows10-2004-x64
3Hidra Forc...et.dll
windows10-2004-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/HidraForce v3.0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/cam.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/ch.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/mic.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/plg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/pw.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/sc2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/WinMM.Net.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Archive2 (1).zip
- Size 8.4MB
- Sample261108-sy2csaac87
- SHA256 1d4c76904bababa206ffa95e6fb62b7e96afb137bac79a80209dbd11b8c291dc
- MD5 99da32d6bdf96f8c0491df0608a64618
- SHA1 586d2f2f6800d33a7caf72a8a8e0d2cea9896855
- SHA512 b7e38176902204fedf291cbb2eb304c62db12de26518599418274daff282a668323790deb0b50db5b2388e908a6dd351221d5ef1339842fc0d44a9712aa708b5
- SSDEEP 196608:uGe5kBNwaFX1cN/LZ9LujBmGVE58YzIbmJAhN5ZaR:uGe58Cd9L0a58Yun5ZU
- TLSH T18F96339C57580357FC1DE66C724C76D17198EA2FA0248BA2E46092FC371FDFB9286B14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/HidraForce v3.0.exe unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/cam.dll unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/ch.dll unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/mic.dll unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/plg.dll unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/pw.dll unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/sc2.dll unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.exe unpack001/Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/WinMM.Net.dll
File Explorer
-
Archive2 (1).zip.zip 8.4MB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/GeoIP.dat1.2MB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/HidraForce v3.0.exe.exe 8.8MB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/cam.dll.dll 63KB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/ch.dll.dll 12KB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/mic.dll.dll 50KB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/plg.dll.dll 28KB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/pw.dll.dll 251KB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/sc2.dll.dll 12KB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.exe.exe 21KB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.il.ps1 228KB
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.manifest.xml 487B
-
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/WinMM.Net.dll.dll 43KB
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/GeoIP.dat
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/HidraForce v3.0.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ce4ce8096ca4062a653646210c0edb94887ff1e15c07b11aa43c5516856a3627
- MD5 ffcb1ca392024351161ef8050235874a
- SHA1 dee49a5d7d51a18ada3d6bcc18787ba9c9527412
- SHA512 80bdab65dfb9d05b7895e21180842036482e1b4dc0e3f0d8305e3d31c1b5597232ecf4da85d8d27fa99022bf9e6c82262ac75d2648da71705163ab37ba886429
- SSDEEP 196608:dLW7/jhwVNT87bH2YCIwYbBCW2fpGQj6223zcC4eJI9PRQvM6nnA4MpW085sBwdH:d2/jw3YFBMI3oeApxUnA40+FoYy5bv9o
- TLSH T123961292A5449898BFFA4210F0E97B2CC3F83783B5ED686E0DDD194501B5A88FD3958F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9127710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
8.7MB
Virtual Size
8.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/cam.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- TLSH T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
71150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/ch.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6e31148cc1b3235b71731c3944a7b06f861e104e978708d12c695ec09b5b3760
- MD5 e747fa3339c1f138b6bfce707b541d03
- SHA1 b95c54fbd6eb20ba4b4e69736b574baa2699ab8e
- SHA512 b970c3e8bf6a2e3ae920bc8bd014edb86ca92c85a2bccff732c7e5eb2f81ffbd902a34a0a68bd51545954b5f4d6dd1bb84b5c005868c0659717eba2892a67355
- SSDEEP 192:pc/uGfMx2+zkUakpBZHrPzYuPYrDq+PzDuGRDAVEBP6jUvsB3npn3mNFcTf:wuGk2oakpBZHrPzYuPYrW+bDPRDiEBPE
- TLSH T15642D62577A88B63C96DA77D45A2534133F3D1118222DFAB7DCA68EC4DE63C51B0039B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/mic.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- TLSH T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/plg.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
- MD5 0cbc2d9703feead9783439e551c2b673
- SHA1 4f8f4addd6f9e60598a7f4a191a89a52201394a8
- SHA512 06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
- SSDEEP 384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
- TLSH T185D2C70D27A0C525C7BE87365E2143225EF786134C25FF2E4CCB4AED5EA2789DB4864B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/pw.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- TLSH T16C44E02722CE3CA1E17E4A7033B353C2C3A9DD108612D51E29D83556AA7E1D37A42FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
250558
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Super\Documents\visual studio 2013\Projects\pw plugin\WindowsApplication12\obj\Release\pw.pdb
mscoree
_CorDllMain
Name
.text
Size
237KB
Virtual Size
236KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Plugin/sc2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- TLSH T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 32216042c853394a048925e3e8883a28248335cbb1344a895bd1f18481e3ee00
- MD5 65733fa9bc464267094a81c7b70961fd
- SHA1 ba0cfa759c09423b8633f6ad429f03533055b665
- SHA512 9fde8e9dae0053ded2a5e74e235d029aebe6da742115a6d1051c6fda51d0dd42e4576a2bd51a06f36bfa550c96fb11ec73bfcc982b99748896a1c3d09e423230
- SSDEEP 384:YfkPoE3D9lzG8aknCinLk24jXPl+a3XEWNNHUWYEf:VP7plAsCG2XPVf
- TLSH T113A22B1957EAC636CDAD07710D32935223B1DE05A247EB7F9ED8B06FACB73414B92260
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
24174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\Pc2\Desktop\Nova pasta\Stub\Stub\obj\x86\Debug\Stub.pdb
mscoree
_CorExeMain
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
117B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.il
- SHA256 daa4362a762a472f717a480102883382b41dc5c17484f649272c5bdb5142917c
- MD5 2041e64bffccfbc9379235fdf294f188
- SHA1 19c1fd78e8f36493e2a9b1c0e437afc2416586f8
- SHA512 c5d5be4615767483432287d3486e805d6744d45a5eac6445cef87ce1e8475bcdbb521dcd8d1c7918d8d73d6634617842b67290bc4fb734a4ab31dfe7daaaec13
- SSDEEP 6144:AdCb38V4N80EC7PAdpJZrLZ9u4zDdyxGu8VnNQUC:AdCb38V4N80EC7PAdzZrLZ9u4zDdyxGG
- TLSH T1DB34EF2D8228999AD4B2701DBA72CB16F76F12270F716C967CEFD254BF322C54270636
- MD5 SHA1 SHA512 SSDEEP TLSH
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/Stub.manifest
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
Hidra Force v3.0 ЧИСТ ПРОВЕРТЯТЬ/WinMM.Net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
50302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ