Suspicious
Suspect

20a894221d6a9cdc9369ca81b5a5f628

PE Executable
MD5: 20a894221d6a9cdc9369ca81b5a5f628
Size: 909.82 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 20a894221d6a9cdc9369ca81b5a5f628
Sha1 e0af1685b5340f70f4ce3dc33e8226be6dccc321
Sha256 b28e3757d340dbebfe720d7118fb575416f2fdf0ae88c8618dadc1d97e22643a
Sha384 518b7b1dbdb91af94becd6d8891db0d089e931c9c055d60e9387cd0bd609f3487117fc82e510a60640a4832a4eaea9c8
Sha512 6ad663b107c2cf2324ce9c20a7715718f366e5e4211bc368749aa71aeb1334483fd7cda693c17dbbf0bca6aa9f7538e309c9e5375754ca9cb13c78f47c4dba7d
SSDeep 12288:T7Xbiua9U4BTFTxQLp5YDvjpOeWtpSYdRin7IM3MNBaQe3hR5PmSHCmd:T7XbQ1jxwyDgeaXhM3MNchJPUmd
TLSH 0A15018963808D70CD6A9C3081311DB403775F5A3FA5F646AE78BC7337736DA28A6687
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
20a894221d6a9cdc9369ca81b5a5f628
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Module Name
server1.exe
Full Name
server1.exe
EntryPoint
System.Void _3795AC02FB0A4CEE_::_1ABB7B7D4C1446DC_()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
2.2.8.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
12
Main Method
System.Void _3795AC02FB0A4CEE_::_1ABB7B7D4C1446DC_()
Main IL Instruction Count
90
Main IL 
nop <null>
ldc.i4 1043263814
stloc.3 <null>
ldc.i4 -939919853
ldc.i4 -1861555733
mul <null>
ldc.i4 -1426490611
neg <null>
xor <null>
ldc.i4 -993437131
ldc.i4 -941524653
add <null>
ldc.i4 2006196458
ldc.i4 -771078197
add <null>
add <null>
sub <null>
ldloc.3 <null>
sub <null>
not <null>
ldc.i4 -489357749
mul <null>
ldc.i4 1165655007
add <null>
dup <null>
stloc.2 <null>
ldc.i4.6 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_012A: ret
call System.String _3795AC02FB0A4CEE_::_F3019E5D54BA42F5_()
ldc.i4 1304581957
br.s IL_0072: call System.String <Module>::_DA3926AF4DC942A9_<System.String>(System.IntPtr)
call System.String <Module>::_DA3926AF4DC942A9_<System.String>(System.IntPtr)
call System.String _3795AC02FB0A4CEE_::_6A8FE2470FBF48C0_(System.String,System.String)
stsfld System.String _3795AC02FB0A4CEE_::_A7C0917FEFB04B83_
ldc.i4 -2133695957
stloc.s V_4
ldloc.2 <null>
ldc.i4 -678822
mul <null>
ldloc.s V_4
xor <null>
br IL_0006: stloc.3
call System.Object _3795AC02FB0A4CEE_::_AB3580825CF14974_()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.Byte[] _3795AC02FB0A4CEE_::_B56EBAE79DD84ECC_
call System.Object _3795AC02FB0A4CEE_::_846DB82DD255499E_()
call System.Object _3795AC02FB0A4CEE_::_B62DEEC7687345DB_(System.Object)
call System.String _3795AC02FB0A4CEE_::_4E986E0421EA4BC4_(System.Object)
call System.Boolean _3795AC02FB0A4CEE_::_2BB271020A46425A_(System.Object,System.Byte[],System.String)
pop <null>
call System.Object _3795AC02FB0A4CEE_::_603433D6858B4E50_()
stloc.1 <null>
ldc.i4 1129974118
stloc.s V_6
ldloc.2 <null>
ldc.i4 -951238
mul <null>
ldloc.s V_6
xor <null>
br IL_0006: stloc.3
ldloc.1 <null>
ldsfld System.Byte[] _3795AC02FB0A4CEE_::_B56EBAE79DD84ECC_
call System.Object _3795AC02FB0A4CEE_::_846DB82DD255499E_()
call System.Object _3795AC02FB0A4CEE_::_B62DEEC7687345DB_(System.Object)
call System.String _3795AC02FB0A4CEE_::_4E986E0421EA4BC4_(System.Object)
call System.Boolean _3795AC02FB0A4CEE_::_B5B40D1F7D954F1B_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 1160978400
stloc.s V_7
ldloc.2 <null>
ldc.i4 -797723
mul <null>
ldloc.s V_7
xor <null>
br IL_0006: stloc.3
ldsfld System.String _3795AC02FB0A4CEE_::_A7C0917FEFB04B83_
call System.Byte[] _3795AC02FB0A4CEE_::_F5361E86325348F6_(System.String)
stsfld System.Byte[] _3795AC02FB0A4CEE_::_B56EBAE79DD84ECC_
ldc.i4 -225799671
stloc.s V_5
ldloc.2 <null>
ldc.i4 -955760
mul <null>
ldloc.s V_5
xor <null>
br IL_0006: stloc.3
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
server1.exe
Full Name
server1.exe
EntryPoint
System.Void _3795AC02FB0A4CEE_::_1ABB7B7D4C1446DC_()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
2.2.8.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
12
Main Method
System.Void _3795AC02FB0A4CEE_::_1ABB7B7D4C1446DC_()
Main IL Instruction Count
90
Main IL 
nop <null>
ldc.i4 1043263814
stloc.3 <null>
ldc.i4 -939919853
ldc.i4 -1861555733
mul <null>
ldc.i4 -1426490611
neg <null>
xor <null>
ldc.i4 -993437131
ldc.i4 -941524653
add <null>
ldc.i4 2006196458
ldc.i4 -771078197
add <null>
add <null>
sub <null>
ldloc.3 <null>
sub <null>
not <null>
ldc.i4 -489357749
mul <null>
ldc.i4 1165655007
add <null>
dup <null>
stloc.2 <null>
ldc.i4.6 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_012A: ret
call System.String _3795AC02FB0A4CEE_::_F3019E5D54BA42F5_()
ldc.i4 1304581957
br.s IL_0072: call System.String <Module>::_DA3926AF4DC942A9_<System.String>(System.IntPtr)
call System.String <Module>::_DA3926AF4DC942A9_<System.String>(System.IntPtr)
call System.String _3795AC02FB0A4CEE_::_6A8FE2470FBF48C0_(System.String,System.String)
stsfld System.String _3795AC02FB0A4CEE_::_A7C0917FEFB04B83_
ldc.i4 -2133695957
stloc.s V_4
ldloc.2 <null>
ldc.i4 -678822
mul <null>
ldloc.s V_4
xor <null>
br IL_0006: stloc.3
call System.Object _3795AC02FB0A4CEE_::_AB3580825CF14974_()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.Byte[] _3795AC02FB0A4CEE_::_B56EBAE79DD84ECC_
call System.Object _3795AC02FB0A4CEE_::_846DB82DD255499E_()
call System.Object _3795AC02FB0A4CEE_::_B62DEEC7687345DB_(System.Object)
call System.String _3795AC02FB0A4CEE_::_4E986E0421EA4BC4_(System.Object)
call System.Boolean _3795AC02FB0A4CEE_::_2BB271020A46425A_(System.Object,System.Byte[],System.String)
pop <null>
call System.Object _3795AC02FB0A4CEE_::_603433D6858B4E50_()
stloc.1 <null>
ldc.i4 1129974118
stloc.s V_6
ldloc.2 <null>
ldc.i4 -951238
mul <null>
ldloc.s V_6
xor <null>
br IL_0006: stloc.3
ldloc.1 <null>
ldsfld System.Byte[] _3795AC02FB0A4CEE_::_B56EBAE79DD84ECC_
call System.Object _3795AC02FB0A4CEE_::_846DB82DD255499E_()
call System.Object _3795AC02FB0A4CEE_::_B62DEEC7687345DB_(System.Object)
call System.String _3795AC02FB0A4CEE_::_4E986E0421EA4BC4_(System.Object)
call System.Boolean _3795AC02FB0A4CEE_::_B5B40D1F7D954F1B_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 1160978400
stloc.s V_7
ldloc.2 <null>
ldc.i4 -797723
mul <null>
ldloc.s V_7
xor <null>
br IL_0006: stloc.3
ldsfld System.String _3795AC02FB0A4CEE_::_A7C0917FEFB04B83_
call System.Byte[] _3795AC02FB0A4CEE_::_F5361E86325348F6_(System.String)
stsfld System.Byte[] _3795AC02FB0A4CEE_::_B56EBAE79DD84ECC_
ldc.i4 -225799671
stloc.s V_5
ldloc.2 <null>
ldc.i4 -955760
mul <null>
ldloc.s V_5
xor <null>
br IL_0006: stloc.3
ret <null>
20a894221d6a9cdc9369ca81b5a5f628
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙