Suspicious
Suspect

5123d3cc830d4acd49dafb1ba472a90e

Share on LinkedIn
Print
PE Executable
MD5: 5123d3cc830d4acd49dafb1ba472a90e
Size: 7.37 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 5123d3cc830d4acd49dafb1ba472a90e
Sha1 4bc13337342c06f7b156904544be65bc74e5a0b9
Sha256 93759d6cfbfdd0d5018f197461a25ac2361bc57c6d8eea5e3ee044bb146f071a
Sha384 de66d26299df9ba7bf55195723fba7a3d542bc117dd8d8c93957c3ec7f1d7a096590ef7f7e63d31a9971851af3b07afa
Sha512 5d1138ce1cebc0383c30d3cbf0ae373f50a60a8f2dc9fa59c0dcad816e13b55f4b5d824c31c9149fe3ea925a6c8f7df3e6ae26a04f09606515c50b6aa410c410
SSDeep 196608:rr9uV25DeTD+oqzukSIlLtIY79n8SI75bWAXAkuujCPX9YG9he5GnQCAJKN:1A403qakSoR7tfI7ZtXADu8X9Y95GQLJ
TLSH EE76334463FC0659F1BF6B78E87162119E32B613D43AE78D198C119C0A72B82EDA1F77
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
5123d3cc830d4acd49dafb1ba472a90e
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
costura.bouncycastle.cryptography.dll.compressed
costura.bouncycastle.cryptography.dll
[Authenticode]_d58937cb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.system.net.http.formatting.dll.compressed
costura.system.net.http.formatting.dll
[Authenticode]_fab616bb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
System.Net.Http.Properties.CommonWebApiResources.resources
System.Net.Http.Properties.Resources.resources
costura.microsoft.bcl.asyncinterfaces.dll.compressed
costura.microsoft.bcl.asyncinterfaces.dll
[Authenticode]_75086844.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.bcl.timeprovider.dll.compressed
costura.microsoft.bcl.timeprovider.dll
[Authenticode]_72e88acd.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.Microsoft.Bcl.TimeProvider.SR.resources
ILLink.Substitutions.xml
costura.microsoft.data.sqlite.dll.compressed
costura.microsoft.data.sqlite.dll
[Authenticode]_42637b14.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Microsoft.Data.Sqlite.Properties.Resources.resources
costura.newtonsoft.json.dll.compressed
costura.newtonsoft.json.dll
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.dll.compressed
costura.newtonsoft.json.bson.dll
[Authenticode]_977e1d63.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.pdb.compressed
costura.newtonsoft.json.bson.pdb
costura.passwordgenerator.dll.compressed
costura.passwordgenerator.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.dll.compressed
costura.polly.dll
[Authenticode]_f15220e2.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.pdb.compressed
costura.polly.pdb
costura.polly.core.dll.compressed
costura.polly.core.dll
[Authenticode]_9ad0d74b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.core.pdb.compressed
costura.polly.core.pdb
costura.icsharpcode.sharpziplib.dll.compressed
costura.icsharpcode.sharpziplib.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.icsharpcode.sharpziplib.pdb
costura.sqlitepclraw.batteries_v2.dll.compressed
costura.sqlitepclraw.batteries_v2.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sqlitepclraw.core.dll.compressed
costura.sqlitepclraw.core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILLink.Descriptors.xml
costura.e_sqlite3.dll.compressed
costura.e_sqlite3.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
costura.sqlitepclraw.provider.dynamic_cdecl.dll.compressed
costura.sqlitepclraw.provider.dynamic_cdecl.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
costura.system.buffers.dll
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.componentmodel.annotations.dll.compressed
costura.system.componentmodel.annotations.dll
[Authenticode]_d788dcd4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ComponentModel.Annotations.SR.resources
System.ComponentModel.Annotations.Resources.System.ComponentModel.Annotations.rd.xml
costura.system.diagnostics.diagnosticsource.dll.compressed
costura.system.diagnostics.diagnosticsource.dll
[Authenticode]_a4f4beae.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Diagnostics.DiagnosticSource.SR.resources
ILLink.Substitutions.xml
costura.system.memory.dll.compressed
costura.system.memory.dll
[Authenticode]_15ab3250.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
costura.system.numerics.vectors.dll
[Authenticode]_ae030d4d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.runtime.compilerservices.unsafe.dll.compressed
costura.system.runtime.compilerservices.unsafe.dll
[Authenticode]_81de04f4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.text.encodings.web.dll.compressed
costura.system.text.encodings.web.dll
[Authenticode]_06fd6b5d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Encodings.Web.SR.resources
ILLink.Substitutions.xml
costura.system.text.json.dll.compressed
costura.system.text.json.dll
[Authenticode]_b52de434.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Json.SR.resources
ILLink.Substitutions.xml
costura.system.threading.tasks.extensions.dll.compressed
costura.system.threading.tasks.extensions.dll
[Authenticode]_7121b905.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.valuetuple.dll.compressed
costura.system.valuetuple.dll
[Authenticode]_5e4e41f0.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ValueTuple.SR.resources
costura.wpf.ui.dll.compressed
costura.wpf.ui.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Wpf.Ui.g.resources
Wpf.Ui.Controls.Anchor.Anchor.bmp
Wpf.Ui.Controls.Arc.Arc.bmp
Wpf.Ui.Controls.AutoSuggestBox.AutoSuggestBox.bmp
Wpf.Ui.Controls.Button.Badge.bmp
Wpf.Ui.Controls.CardExpander.CardExpander.bmp
Wpf.Ui.Controls.DynamicScrollBar.DynamicScrollBar.bmp
Wpf.Ui.Controls.MessageBox.MessageBox.bmp
Wpf.Ui.Controls.IconElement.FontIcon.bmp
Wpf.Ui.Controls.NavigationView.NavigationView.bmp
Wpf.Ui.Controls.NumberBox.NumberBox.bmp
Wpf.Ui.Controls.ProgressRing.ProgressRing.bmp
Wpf.Ui.Controls.RatingControl.RatingControl.bmp
Wpf.Ui.Controls.ThumbRate.ThumbRate.bmp
Wpf.Ui.Controls.ToggleSwitch.ToggleSwitch.bmp
Wpf.Ui.Controls.FluentWindow.FluentWindow.bmp
Wpf.Ui.Controls.VirtualizingItemsControl.VirtualizingItemsControl.bmp
costura.wpf.ui.pdb.compressed
costura.wpf.ui.pdb
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: ?
Module Name
stub.exe
Full Name
stub.exe
EntryPoint
System.Void Phantom.Stub.Program::<Main>()
Scope Name
stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
3224
Main Method
System.Void Phantom.Stub.Program::<Main>()
Main IL Instruction Count
6
Main IL 
call System.Threading.Tasks.Task Phantom.Stub.Program::Main()
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.0 <null>
ldloca.s V_0
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙