Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 6d141be8566a768dec036c4a6a173f6b
Sha1 6b64adfa7ff55f72a024342e54f9cf34adbadf78
Sha256 6231e3ba7d5643ee173f92ef33d2dafa4bc2986954b16cd53195a3b87e3aa5a5
Sha384 05434fbf2b2e5fa29299e370f0aaeea7a98e048d69561ca3240a07631ea6cadfd94493c4202773e6f70a20eb568b9e8d
Sha512 d90c3c260675f71817d6337164fa4502445b75599722adb660719ac1bbe02743fa3d74e5d3785029750415ea6d8854c8d4adc4bb1abe56438ef4c25dc549baf1
SSDeep 196608:rr9uV25DeTD+oqzukSIlLtIY79n8SI75bWAXAkuujCPX9YG9he5GnQCAJKN:1A403qakSoR7tfI7ZtXADu8X9Y95GQLJ
TLSH 6776334463FC0659F1BF6B78E87162119E32B613D43AE78D198C119C0A72B82EDA1F77
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
costura.bouncycastle.cryptography.dll.compressed
[Authenticode]_d58937cb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.system.net.http.formatting.dll.compressed
[Authenticode]_fab616bb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
System.Net.Http.Properties.CommonWebApiResources.resources
System.Net.Http.Properties.Resources.resources
costura.microsoft.bcl.asyncinterfaces.dll.compressed
[Authenticode]_75086844.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.bcl.timeprovider.dll.compressed
[Authenticode]_72e88acd.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.Microsoft.Bcl.TimeProvider.SR.resources
ILLink.Substitutions.xml
costura.microsoft.data.sqlite.dll.compressed
[Authenticode]_42637b14.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Microsoft.Data.Sqlite.Properties.Resources.resources
costura.newtonsoft.json.dll.compressed
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.dll.compressed
[Authenticode]_977e1d63.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.pdb.compressed
costura.newtonsoft.json.bson.pdb
costura.passwordgenerator.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.dll.compressed
[Authenticode]_f15220e2.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.pdb.compressed
costura.polly.core.dll.compressed
[Authenticode]_9ad0d74b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.core.pdb.compressed
costura.icsharpcode.sharpziplib.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.icsharpcode.sharpziplib.pdb
costura.sqlitepclraw.batteries_v2.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sqlitepclraw.core.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILLink.Descriptors.xml
costura.e_sqlite3.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
costura.sqlitepclraw.provider.dynamic_cdecl.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.componentmodel.annotations.dll.compressed
[Authenticode]_d788dcd4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ComponentModel.Annotations.SR.resources
System.ComponentModel.Annotations.Resources.System.ComponentModel.Annotations.rd.xml
costura.system.diagnostics.diagnosticsource.dll.compressed
[Authenticode]_a4f4beae.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Diagnostics.DiagnosticSource.SR.resources
ILLink.Substitutions.xml
costura.system.memory.dll.compressed
[Authenticode]_15ab3250.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
[Authenticode]_ae030d4d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.runtime.compilerservices.unsafe.dll.compressed
[Authenticode]_81de04f4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.text.encodings.web.dll.compressed
[Authenticode]_06fd6b5d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Encodings.Web.SR.resources
ILLink.Substitutions.xml
costura.system.text.json.dll.compressed
[Authenticode]_b52de434.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Json.SR.resources
ILLink.Substitutions.xml
costura.system.threading.tasks.extensions.dll.compressed
[Authenticode]_7121b905.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.valuetuple.dll.compressed
[Authenticode]_5e4e41f0.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ValueTuple.SR.resources
costura.wpf.ui.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Wpf.Ui.g.resources
Wpf.Ui.Controls.Anchor.Anchor.bmp
Wpf.Ui.Controls.Arc.Arc.bmp
Wpf.Ui.Controls.AutoSuggestBox.AutoSuggestBox.bmp
Wpf.Ui.Controls.Button.Badge.bmp
Wpf.Ui.Controls.CardExpander.CardExpander.bmp
Wpf.Ui.Controls.DynamicScrollBar.DynamicScrollBar.bmp
Wpf.Ui.Controls.MessageBox.MessageBox.bmp
Wpf.Ui.Controls.IconElement.FontIcon.bmp
Wpf.Ui.Controls.NavigationView.NavigationView.bmp
Wpf.Ui.Controls.NumberBox.NumberBox.bmp
Wpf.Ui.Controls.ProgressRing.ProgressRing.bmp
Wpf.Ui.Controls.RatingControl.RatingControl.bmp
Wpf.Ui.Controls.ThumbRate.ThumbRate.bmp
Wpf.Ui.Controls.ToggleSwitch.ToggleSwitch.bmp
Wpf.Ui.Controls.FluentWindow.FluentWindow.bmp
Wpf.Ui.Controls.VirtualizingItemsControl.VirtualizingItemsControl.bmp
costura.wpf.ui.pdb.compressed
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: ?
Module Name
stub.exe
Full Name
stub.exe
EntryPoint
System.Void Phantom.Stub.Program::<Main>()
Scope Name
stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
3224
Main Method
System.Void Phantom.Stub.Program::<Main>()
Main IL Instruction Count
6
Main IL
call System.Threading.Tasks.Task Phantom.Stub.Program::Main()
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.0 <null>
ldloca.s V_0
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ret <null>
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
costura.bouncycastle.cryptography.dll.compressed
[Authenticode]_d58937cb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.system.net.http.formatting.dll.compressed
[Authenticode]_fab616bb.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
System.Net.Http.Properties.CommonWebApiResources.resources
System.Net.Http.Properties.Resources.resources
costura.microsoft.bcl.asyncinterfaces.dll.compressed
[Authenticode]_75086844.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.bcl.timeprovider.dll.compressed
[Authenticode]_72e88acd.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.Microsoft.Bcl.TimeProvider.SR.resources
ILLink.Substitutions.xml
costura.microsoft.data.sqlite.dll.compressed
[Authenticode]_42637b14.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Microsoft.Data.Sqlite.Properties.Resources.resources
costura.newtonsoft.json.dll.compressed
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.dll.compressed
[Authenticode]_977e1d63.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.bson.pdb.compressed
costura.newtonsoft.json.bson.pdb
costura.passwordgenerator.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.dll.compressed
[Authenticode]_f15220e2.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.pdb.compressed
costura.polly.core.dll.compressed
[Authenticode]_9ad0d74b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.polly.core.pdb.compressed
costura.icsharpcode.sharpziplib.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.icsharpcode.sharpziplib.pdb
costura.sqlitepclraw.batteries_v2.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.sqlitepclraw.core.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILLink.Descriptors.xml
costura.e_sqlite3.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
_RDATA
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
costura.sqlitepclraw.provider.dynamic_cdecl.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.componentmodel.annotations.dll.compressed
[Authenticode]_d788dcd4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ComponentModel.Annotations.SR.resources
System.ComponentModel.Annotations.Resources.System.ComponentModel.Annotations.rd.xml
costura.system.diagnostics.diagnosticsource.dll.compressed
[Authenticode]_a4f4beae.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Diagnostics.DiagnosticSource.SR.resources
ILLink.Substitutions.xml
costura.system.memory.dll.compressed
[Authenticode]_15ab3250.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
[Authenticode]_ae030d4d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.runtime.compilerservices.unsafe.dll.compressed
[Authenticode]_81de04f4.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.text.encodings.web.dll.compressed
[Authenticode]_06fd6b5d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Encodings.Web.SR.resources
ILLink.Substitutions.xml
costura.system.text.json.dll.compressed
[Authenticode]_b52de434.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Text.Json.SR.resources
ILLink.Substitutions.xml
costura.system.threading.tasks.extensions.dll.compressed
[Authenticode]_7121b905.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.valuetuple.dll.compressed
[Authenticode]_5e4e41f0.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.ValueTuple.SR.resources
costura.wpf.ui.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Wpf.Ui.g.resources
Wpf.Ui.Controls.Anchor.Anchor.bmp
Wpf.Ui.Controls.Arc.Arc.bmp
Wpf.Ui.Controls.AutoSuggestBox.AutoSuggestBox.bmp
Wpf.Ui.Controls.Button.Badge.bmp
Wpf.Ui.Controls.CardExpander.CardExpander.bmp
Wpf.Ui.Controls.DynamicScrollBar.DynamicScrollBar.bmp
Wpf.Ui.Controls.MessageBox.MessageBox.bmp
Wpf.Ui.Controls.IconElement.FontIcon.bmp
Wpf.Ui.Controls.NavigationView.NavigationView.bmp
Wpf.Ui.Controls.NumberBox.NumberBox.bmp
Wpf.Ui.Controls.ProgressRing.ProgressRing.bmp
Wpf.Ui.Controls.RatingControl.RatingControl.bmp
Wpf.Ui.Controls.ThumbRate.ThumbRate.bmp
Wpf.Ui.Controls.ToggleSwitch.ToggleSwitch.bmp
Wpf.Ui.Controls.FluentWindow.FluentWindow.bmp
Wpf.Ui.Controls.VirtualizingItemsControl.VirtualizingItemsControl.bmp
costura.wpf.ui.pdb.compressed
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙