Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 5123d3cc830d4acd49dafb1ba472a90e
Sha1 4bc13337342c06f7b156904544be65bc74e5a0b9
Sha256 93759d6cfbfdd0d5018f197461a25ac2361bc57c6d8eea5e3ee044bb146f071a
Sha384 de66d26299df9ba7bf55195723fba7a3d542bc117dd8d8c93957c3ec7f1d7a096590ef7f7e63d31a9971851af3b07afa
Sha512 5d1138ce1cebc0383c30d3cbf0ae373f50a60a8f2dc9fa59c0dcad816e13b55f4b5d824c31c9149fe3ea925a6c8f7df3e6ae26a04f09606515c50b6aa410c410
SSDeep 196608:rr9uV25DeTD+oqzukSIlLtIY79n8SI75bWAXAkuujCPX9YG9he5GnQCAJKN:1A403qakSoR7tfI7ZtXADu8X9Y95GQLJ
TLSH EE76334463FC0659F1BF6B78E87162119E32B613D43AE78D198C119C0A72B82EDA1F77
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
costura.bouncycastle.cryptography.dll.compressed
[Authenticode]_d58937cb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.system.net.http.formatting.dll.compressed
[Authenticode]_fab616bb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
System.Net.Http.Properties.CommonWebApiResources.resources
System.Net.Http.Properties.Resources.resources
costura.microsoft.bcl.asyncinterfaces.dll.compressed
[Authenticode]_75086844.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.bcl.timeprovider.dll.compressed
[Authenticode]_72e88acd.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.Microsoft.Bcl.TimeProvider.SR.resources
ILLink.Substitutions.xml
costura.microsoft.data.sqlite.dll.compressed
[Authenticode]_42637b14.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Microsoft.Data.Sqlite.Properties.Resources.resources
costura.newtonsoft.json.dll.compressed
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.dll.compressed
[Authenticode]_977e1d63.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.pdb.compressed
costura.newtonsoft.json.bson.pdb
costura.passwordgenerator.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.dll.compressed
[Authenticode]_f15220e2.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.pdb.compressed
costura.polly.core.dll.compressed
[Authenticode]_9ad0d74b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.core.pdb.compressed
costura.icsharpcode.sharpziplib.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.icsharpcode.sharpziplib.pdb
costura.sqlitepclraw.batteries_v2.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sqlitepclraw.core.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILLink.Descriptors.xml
costura.e_sqlite3.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
costura.sqlitepclraw.provider.dynamic_cdecl.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.componentmodel.annotations.dll.compressed
[Authenticode]_d788dcd4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ComponentModel.Annotations.SR.resources
System.ComponentModel.Annotations.Resources.System.ComponentModel.Annotations.rd.xml
costura.system.diagnostics.diagnosticsource.dll.compressed
[Authenticode]_a4f4beae.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Diagnostics.DiagnosticSource.SR.resources
ILLink.Substitutions.xml
costura.system.memory.dll.compressed
[Authenticode]_15ab3250.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
[Authenticode]_ae030d4d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.runtime.compilerservices.unsafe.dll.compressed
[Authenticode]_81de04f4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.text.encodings.web.dll.compressed
[Authenticode]_06fd6b5d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Encodings.Web.SR.resources
ILLink.Substitutions.xml
costura.system.text.json.dll.compressed
[Authenticode]_b52de434.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Json.SR.resources
ILLink.Substitutions.xml
costura.system.threading.tasks.extensions.dll.compressed
[Authenticode]_7121b905.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.valuetuple.dll.compressed
[Authenticode]_5e4e41f0.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ValueTuple.SR.resources
costura.wpf.ui.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Wpf.Ui.g.resources
Wpf.Ui.Controls.Anchor.Anchor.bmp
Wpf.Ui.Controls.Arc.Arc.bmp
Wpf.Ui.Controls.AutoSuggestBox.AutoSuggestBox.bmp
Wpf.Ui.Controls.Button.Badge.bmp
Wpf.Ui.Controls.CardExpander.CardExpander.bmp
Wpf.Ui.Controls.DynamicScrollBar.DynamicScrollBar.bmp
Wpf.Ui.Controls.MessageBox.MessageBox.bmp
Wpf.Ui.Controls.IconElement.FontIcon.bmp
Wpf.Ui.Controls.NavigationView.NavigationView.bmp
Wpf.Ui.Controls.NumberBox.NumberBox.bmp
Wpf.Ui.Controls.ProgressRing.ProgressRing.bmp
Wpf.Ui.Controls.RatingControl.RatingControl.bmp
Wpf.Ui.Controls.ThumbRate.ThumbRate.bmp
Wpf.Ui.Controls.ToggleSwitch.ToggleSwitch.bmp
Wpf.Ui.Controls.FluentWindow.FluentWindow.bmp
Wpf.Ui.Controls.VirtualizingItemsControl.VirtualizingItemsControl.bmp
costura.wpf.ui.pdb.compressed
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: ?
Module Name
stub.exe
Full Name
stub.exe
EntryPoint
System.Void Phantom.Stub.Program::<Main>()
Scope Name
stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
3224
Main Method
System.Void Phantom.Stub.Program::<Main>()
Main IL Instruction Count
6
Main IL
call System.Threading.Tasks.Task Phantom.Stub.Program::Main()
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.0 <null>
ldloca.s V_0
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ret <null>
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
costura.bouncycastle.cryptography.dll.compressed
[Authenticode]_d58937cb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.system.net.http.formatting.dll.compressed
[Authenticode]_fab616bb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
System.Net.Http.Properties.CommonWebApiResources.resources
System.Net.Http.Properties.Resources.resources
costura.microsoft.bcl.asyncinterfaces.dll.compressed
[Authenticode]_75086844.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.bcl.timeprovider.dll.compressed
[Authenticode]_72e88acd.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.Microsoft.Bcl.TimeProvider.SR.resources
ILLink.Substitutions.xml
costura.microsoft.data.sqlite.dll.compressed
[Authenticode]_42637b14.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Microsoft.Data.Sqlite.Properties.Resources.resources
costura.newtonsoft.json.dll.compressed
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.dll.compressed
[Authenticode]_977e1d63.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.pdb.compressed
costura.newtonsoft.json.bson.pdb
costura.passwordgenerator.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.dll.compressed
[Authenticode]_f15220e2.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.pdb.compressed
costura.polly.core.dll.compressed
[Authenticode]_9ad0d74b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.core.pdb.compressed
costura.icsharpcode.sharpziplib.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.icsharpcode.sharpziplib.pdb
costura.sqlitepclraw.batteries_v2.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sqlitepclraw.core.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILLink.Descriptors.xml
costura.e_sqlite3.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
costura.sqlitepclraw.provider.dynamic_cdecl.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.componentmodel.annotations.dll.compressed
[Authenticode]_d788dcd4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ComponentModel.Annotations.SR.resources
System.ComponentModel.Annotations.Resources.System.ComponentModel.Annotations.rd.xml
costura.system.diagnostics.diagnosticsource.dll.compressed
[Authenticode]_a4f4beae.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Diagnostics.DiagnosticSource.SR.resources
ILLink.Substitutions.xml
costura.system.memory.dll.compressed
[Authenticode]_15ab3250.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
[Authenticode]_ae030d4d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.runtime.compilerservices.unsafe.dll.compressed
[Authenticode]_81de04f4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.text.encodings.web.dll.compressed
[Authenticode]_06fd6b5d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Encodings.Web.SR.resources
ILLink.Substitutions.xml
costura.system.text.json.dll.compressed
[Authenticode]_b52de434.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Json.SR.resources
ILLink.Substitutions.xml
costura.system.threading.tasks.extensions.dll.compressed
[Authenticode]_7121b905.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.valuetuple.dll.compressed
[Authenticode]_5e4e41f0.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ValueTuple.SR.resources
costura.wpf.ui.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Wpf.Ui.g.resources
Wpf.Ui.Controls.Anchor.Anchor.bmp
Wpf.Ui.Controls.Arc.Arc.bmp
Wpf.Ui.Controls.AutoSuggestBox.AutoSuggestBox.bmp
Wpf.Ui.Controls.Button.Badge.bmp
Wpf.Ui.Controls.CardExpander.CardExpander.bmp
Wpf.Ui.Controls.DynamicScrollBar.DynamicScrollBar.bmp
Wpf.Ui.Controls.MessageBox.MessageBox.bmp
Wpf.Ui.Controls.IconElement.FontIcon.bmp
Wpf.Ui.Controls.NavigationView.NavigationView.bmp
Wpf.Ui.Controls.NumberBox.NumberBox.bmp
Wpf.Ui.Controls.ProgressRing.ProgressRing.bmp
Wpf.Ui.Controls.RatingControl.RatingControl.bmp
Wpf.Ui.Controls.ThumbRate.ThumbRate.bmp
Wpf.Ui.Controls.ToggleSwitch.ToggleSwitch.bmp
Wpf.Ui.Controls.FluentWindow.FluentWindow.bmp
Wpf.Ui.Controls.VirtualizingItemsControl.VirtualizingItemsControl.bmp
costura.wpf.ui.pdb.compressed
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙