Suspicious
Suspect

2cbd959c38fb466998473f8e5c2110f7

Share on LinkedIn Add to favorites
Re-Scan
Delete
PE Executable
MD5: 2cbd959c38fb466998473f8e5c2110f7
Size: 2.47 MB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
2cbd959c38fb466998473f8e5c2110f7
Sha1
5f4743958bfcd27ea81a1dbefb2910d3bcd45733
Sha256
f2c42c7641fcae4a61d7e6c183b06f9f828bd337f08ecba9f97033556540e52b
Sha384
d8e6478ddd5d797de3d3575c44a72f6ff46ee8e80d10a2b10b6ffe25ec11d841495c808b9f260377effbad689369768b
Sha512
b935b15c0bcca9949d377224d7dd1b6ff3d9b605a51277e69a89b5e21c00e5805283ab8cafd2d0750ef68955b24462419ca9a5f5417130dcecacb56bc56ffc8d
SSDeep
49152:k+DQS54uk9F8ktHgkcC7GSdHKC88Ro3m18m0Ar:k+DD4t9jTRo3q8Q
TLSH
54B533314A930924FC55A4B71BB3E2930E4DF426FD87424E6168E9AE7317E7279293F0

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
2cbd959c38fb466998473f8e5c2110f7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
tbgtj.Resources
COM Surrogate.exe
Runtime.exe
subdir.exe
svchost.exe
system.exe
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

chromedriver.exe
Full Name

chromedriver.exe
EntryPoint

System.Void Program::Main()
Scope Name

chromedriver.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

chromedriver
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

18
Main Method

System.Void Program::Main()
Main IL Instruction Count

39
Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007C: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_007A: br.s IL_0083 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007A: br.s IL_0083 br.s IL_0083: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>
Module Name

chromedriver.exe
Full Name

chromedriver.exe
EntryPoint

System.Void Program::Main()
Scope Name

chromedriver.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

chromedriver
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

18
Main Method

System.Void Program::Main()
Main IL Instruction Count

39
Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007C: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_007A: br.s IL_0083 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007A: br.s IL_0083 br.s IL_0083: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>
2cbd959c38fb466998473f8e5c2110f7 (2.47 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙