Suspicious
Suspect

2d04e5c9b8152fd6de0cf2da859d08d1

PE Executable
MD5: 2d04e5c9b8152fd6de0cf2da859d08d1
Size: 911.36 KB
application/x-dosexec

This sample is a 890 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 8 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
bcc66716c96ca9eae509bb88f3a9279630f56d51af2783e1e8424a169ca59fcc
MD5
2d04e5c9b8152fd6de0cf2da859d08d1
Verdict
Inconclusive
File type
PE Executable · 890 KB

Cite this report: https://app.malva.re/sha256/bcc66716c96ca9eae509bb88f3a9279630f56d51af2783e1e8424a169ca59fcc

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
911.36 KB · 911,360 B
Hashes
MD5 2d04e5c9b8152fd6de0cf2da859d08d1 Sha1 18b51ac2f2e4bab26f26845711486810fe533ca8 Sha256 bcc66716c96ca9eae509bb88f3a9279630f56d51af2783e1e8424a169ca59fcc Sha384 0e756ea659b0bd373b22fc772a44b40331f49bc1f33e0fc2ada3606023510178cf2ee785824f07e9aad64b70e5d782cc Sha512 5c81441d0c2334e5249d3a865462bfdece4c9d1958b0a8d3409feadb021289f3d1fbcf74e796dabd1a7b17cd6ffa56f176ec642ccf29fca84c2eee1e3d0f6dff SSDeep 24576:tgddzl0yh7dU/ZJjafDMeNo4yml3fI2UYU:tg7zmyhBuZJjk4ee4ymO TLSH 9815028A23C08E71CD2A9D3450311CA403779F563F94F645EE64BDB337B39CA28A659B
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

9 files
EXE2d04e5c9b8152fd6de0cf2da859d08d1
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINRT_GROUP_CURSOR4
BINID:7F00
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name Value
Module Name
server1.exe
Full Name
server1.exe
EntryPoint
System.Void _D030B77448604227_::_9C750FB420AB4FA5_()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
3.2.8.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
12
Main Method
System.Void _D030B77448604227_::_9C750FB420AB4FA5_()
Main IL Instruction Count
60
Main IL 
nop <null>
ldc.i4 1233609767
stloc.3 <null>
ldloc.3 <null>
neg <null>
neg <null>
ldc.i4 -1550060159
neg <null>
add <null>
not <null>
dup <null>
stloc.2 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C8: ret
call System.String _D030B77448604227_::_690480E3E45C4857_()
ldc.i4 -2105413684
br.s IL_003C: call System.String <Module>::_952E52AC0EE24F8D_<System.String>(System.IntPtr)
call System.String <Module>::_952E52AC0EE24F8D_<System.String>(System.IntPtr)
call System.String _D030B77448604227_::_C9B8621DC206408B_(System.String,System.String)
stsfld System.String _D030B77448604227_::_C8A6FDCA5F2A48EE_
ldsfld System.String _D030B77448604227_::_C8A6FDCA5F2A48EE_
call System.Byte[] _D030B77448604227_::_AD9CDED6732A44CB_(System.String)
stsfld System.Byte[] _D030B77448604227_::_48686C422B344639_
call System.Object _D030B77448604227_::_B36A70C6A77B4ACA_()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.Byte[] _D030B77448604227_::_48686C422B344639_
call System.Object _D030B77448604227_::_16F47C1E64BC4E94_()
call System.Object _D030B77448604227_::_5BF8E239589F46C4_(System.Object)
call System.String _D030B77448604227_::_9043B9F6CC96449D_(System.Object)
call System.Boolean _D030B77448604227_::_C1D3FFB71EE349ED_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 1037543938
stloc.s V_4
ldloc.2 <null>
ldc.i4 -400782
mul <null>
ldloc.s V_4
xor <null>
br IL_0006: stloc.3
call System.Object _D030B77448604227_::_951E3D92DA9A4A8F_()
stloc.1 <null>
ldloc.1 <null>
ldsfld System.Byte[] _D030B77448604227_::_48686C422B344639_
call System.Object _D030B77448604227_::_16F47C1E64BC4E94_()
call System.Object _D030B77448604227_::_5BF8E239589F46C4_(System.Object)
call System.String _D030B77448604227_::_9043B9F6CC96449D_(System.Object)
call System.Boolean _D030B77448604227_::_66654B014CF9432D_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 66134493
stloc.s V_5
ldloc.2 <null>
ldc.i4 -280318
mul <null>
ldloc.s V_5
xor <null>
br IL_0006: stloc.3
ret <null>
Module Name
server1.exe
Full Name
server1.exe
EntryPoint
System.Void _D030B77448604227_::_9C750FB420AB4FA5_()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
3.2.8.9
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
12
Main Method
System.Void _D030B77448604227_::_9C750FB420AB4FA5_()
Main IL Instruction Count
60
Main IL 
nop <null>
ldc.i4 1233609767
stloc.3 <null>
ldloc.3 <null>
neg <null>
neg <null>
ldc.i4 -1550060159
neg <null>
add <null>
not <null>
dup <null>
stloc.2 <null>
ldc.i4.4 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C8: ret
call System.String _D030B77448604227_::_690480E3E45C4857_()
ldc.i4 -2105413684
br.s IL_003C: call System.String <Module>::_952E52AC0EE24F8D_<System.String>(System.IntPtr)
call System.String <Module>::_952E52AC0EE24F8D_<System.String>(System.IntPtr)
call System.String _D030B77448604227_::_C9B8621DC206408B_(System.String,System.String)
stsfld System.String _D030B77448604227_::_C8A6FDCA5F2A48EE_
ldsfld System.String _D030B77448604227_::_C8A6FDCA5F2A48EE_
call System.Byte[] _D030B77448604227_::_AD9CDED6732A44CB_(System.String)
stsfld System.Byte[] _D030B77448604227_::_48686C422B344639_
call System.Object _D030B77448604227_::_B36A70C6A77B4ACA_()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.Byte[] _D030B77448604227_::_48686C422B344639_
call System.Object _D030B77448604227_::_16F47C1E64BC4E94_()
call System.Object _D030B77448604227_::_5BF8E239589F46C4_(System.Object)
call System.String _D030B77448604227_::_9043B9F6CC96449D_(System.Object)
call System.Boolean _D030B77448604227_::_C1D3FFB71EE349ED_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 1037543938
stloc.s V_4
ldloc.2 <null>
ldc.i4 -400782
mul <null>
ldloc.s V_4
xor <null>
br IL_0006: stloc.3
call System.Object _D030B77448604227_::_951E3D92DA9A4A8F_()
stloc.1 <null>
ldloc.1 <null>
ldsfld System.Byte[] _D030B77448604227_::_48686C422B344639_
call System.Object _D030B77448604227_::_16F47C1E64BC4E94_()
call System.Object _D030B77448604227_::_5BF8E239589F46C4_(System.Object)
call System.String _D030B77448604227_::_9043B9F6CC96449D_(System.Object)
call System.Boolean _D030B77448604227_::_66654B014CF9432D_(System.Object,System.Byte[],System.String)
pop <null>
ldc.i4 66134493
stloc.s V_5
ldloc.2 <null>
ldc.i4 -280318
mul <null>
ldloc.s V_5
xor <null>
br IL_0006: stloc.3
ret <null>

9 files
EXE2d04e5c9b8152fd6de0cf2da859d08d1
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙