Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 29b7d7098c137456b039d40bcceee37f
Size: 4.08 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 29b7d7098c137456b039d40bcceee37f
Sha1 1af8235226051d9c989e560e2acad99ce215ec6e
Sha256 a769cf974a67c6c99eca486ea834aaf1f601ddf1ddb3860eafb2e433dec469e9
Sha384 86f8ff36f0e413ed2d7822d3b7b9d9f6ddcdcf9666c3bf12d5b5164ffc91aed3768b243f28e66ddc3792e0eec46d8090
Sha512 d0b2d28472e1f678c5f9fc8582b520241f510c35b55c4a992d71577d69dba2df452a4e4480a0fea2b50371253919dc35f5e2af685644ae3e8d6f2f5edad74846
SSDeep 98304:2pZd+cenXoMJ8gok8btu95B0o+9kc0QlkfakUjr/:w+Hoi8pbwEOQOkjr/
TLSH 4C1623CD325075EDC953CD714A781CB4A7066EAA7F1A76469C633867B73F8C3AE040A2
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
bK
;
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
server1.exe
Full Name
server1.exe
EntryPoint
System.Void ‎‏‮‫‮‎‬‌‮‎‬‍‮‌‪‫‍‫‭‎‏‎‮‍‌‮::‮‎‏‮​‭‮‌‎‫‮‏‌‪‪‭‭‎‏‏​‬‮‫‫‎‌‬​‭‏‬‮()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
7.8.8.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
7
Main Method
System.Void ‎‏‮‫‮‎‬‌‮‎‬‍‮‌‪‫‍‫‭‎‏‎‮‍‌‮::‮‎‏‮​‭‮‌‎‫‮‏‌‪‪‭‭‎‏‏​‬‮‫‫‎‌‬​‭‏‬‮()
Main IL Instruction Count
0
Main IL
An error has occurred. This application may no longer respond until reloaded. Reload 🗙