Suspicious
Suspect

3e09851e283a9fd65ce69f3510587df6

PE Executable
MD5: 3e09851e283a9fd65ce69f3510587df6
Size: 274.43 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
Hash Value
MD5
3e09851e283a9fd65ce69f3510587df6
Sha1
f4448b19b8819beb1ff96f30e47b996d206884d9
Sha256
fee7a480a9b4883347bc7c6e7b383dc3ff8d2466b1c7f6941df9fa1edeb6f5f5
Sha384
5a0f3440223a72080c55fd4ad38c87cedd32ea64bb27ab8bcadbe3fd63ea688c78a56dbe94861726dbbe242bd4316222
Sha512
aefdefee7fe8c803634c0f2aa7fce4efe0eff23ef978622d51db341545a40d5d190d14a1d17f19324afdc948386e4ff9ad252f80f131c80119a5e7438fe2c4ce
SSDeep
6144:rM/PU6MYrEfeb+e0ixeykmfrzyMPayVst5cYIP:rME6MYrvb+e0IeifTrNP
TLSH
41449E97E9808D12CE6A1F35C82518042177BD9ABDB2FB4EE94475B88BF37D600B3857

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

server1.exe

Full Name

server1.exe

EntryPoint

System.Void server.Module2::main()

Scope Name

server1.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

server1

Assembly Version

3.2.8.7

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

15

Main Method

System.Void server.Module2::main()

Main IL Instruction Count

74

Main IL

nop <null> call System.String server.Module2::_5A56F178E490476C_() ldc.i4 -1147486209 br.s IL_000D: call System.String <Module>::_C2095FF20D5A46E8_<System.String>(System.IntPtr) call System.String <Module>::_C2095FF20D5A46E8_<System.String>(System.IntPtr) call System.String server.Module2::_7F79870F1AAC48D7_(System.String,System.String) stsfld System.String server.Module2::Hex ldc.i4 402047236 stloc.3 <null> ldloc.3 <null> not <null> not <null> neg <null> not <null> dup <null> stloc.2 <null> ldc.i4.6 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br IL_00F3: ret ldsfld System.String server.Module2::Hex call System.Byte[] server.Module2::_BAAD6C0B85E646CF_(System.String) stsfld System.Byte[] server.Module2::Bytes ldc.i4 -328298243 stloc.s V_4 ldloc.2 <null> ldc.i4 -364755 mul <null> ldloc.s V_4 xor <null> br.s IL_0021: stloc.3 ldloc.0 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_97FDA450D8D646D8_() call System.Object server.Module2::_C72B7D7F0E1E407D_(System.Object) call System.String server.Module2::_6A7CCC1F7AD24D86_(System.Object) call System.Boolean server.Module2::_E99A7FE4CA2843A0_(System.Object,System.Byte[],System.String) pop <null> call System.Object server.Module2::_01BBEAF95EE2468E_() stloc.1 <null> ldc.i4 -830592652 stloc.s V_6 ldloc.2 <null> ldc.i4 -471521 mul <null> ldloc.s V_6 xor <null> br IL_0021: stloc.3 ldloc.1 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_97FDA450D8D646D8_() call System.Object server.Module2::_C72B7D7F0E1E407D_(System.Object) call System.String server.Module2::_6A7CCC1F7AD24D86_(System.Object) call System.Boolean server.Module2::_92E458EC13504211_(System.Object,System.Byte[],System.String) pop <null> ldc.i4 -533596665 stloc.s V_7 ldloc.2 <null> ldc.i4 -328142 mul <null> ldloc.s V_7 xor <null> br IL_0021: stloc.3 call System.Object server.Module2::_4453B619ABD4495D_() stloc.0 <null> ldc.i4 2025757721 stloc.s V_5 ldloc.2 <null> ldc.i4 -822056 mul <null> ldloc.s V_5 xor <null> br IL_0021: stloc.3 ret <null>

Module Name

server1.exe

Full Name

server1.exe

EntryPoint

System.Void server.Module2::main()

Scope Name

server1.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

server1

Assembly Version

3.2.8.7

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

15

Main Method

System.Void server.Module2::main()

Main IL Instruction Count

74

Main IL

nop <null> call System.String server.Module2::_5A56F178E490476C_() ldc.i4 -1147486209 br.s IL_000D: call System.String <Module>::_C2095FF20D5A46E8_<System.String>(System.IntPtr) call System.String <Module>::_C2095FF20D5A46E8_<System.String>(System.IntPtr) call System.String server.Module2::_7F79870F1AAC48D7_(System.String,System.String) stsfld System.String server.Module2::Hex ldc.i4 402047236 stloc.3 <null> ldloc.3 <null> not <null> not <null> neg <null> not <null> dup <null> stloc.2 <null> ldc.i4.6 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br IL_00F3: ret ldsfld System.String server.Module2::Hex call System.Byte[] server.Module2::_BAAD6C0B85E646CF_(System.String) stsfld System.Byte[] server.Module2::Bytes ldc.i4 -328298243 stloc.s V_4 ldloc.2 <null> ldc.i4 -364755 mul <null> ldloc.s V_4 xor <null> br.s IL_0021: stloc.3 ldloc.0 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_97FDA450D8D646D8_() call System.Object server.Module2::_C72B7D7F0E1E407D_(System.Object) call System.String server.Module2::_6A7CCC1F7AD24D86_(System.Object) call System.Boolean server.Module2::_E99A7FE4CA2843A0_(System.Object,System.Byte[],System.String) pop <null> call System.Object server.Module2::_01BBEAF95EE2468E_() stloc.1 <null> ldc.i4 -830592652 stloc.s V_6 ldloc.2 <null> ldc.i4 -471521 mul <null> ldloc.s V_6 xor <null> br IL_0021: stloc.3 ldloc.1 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_97FDA450D8D646D8_() call System.Object server.Module2::_C72B7D7F0E1E407D_(System.Object) call System.String server.Module2::_6A7CCC1F7AD24D86_(System.Object) call System.Boolean server.Module2::_92E458EC13504211_(System.Object,System.Byte[],System.String) pop <null> ldc.i4 -533596665 stloc.s V_7 ldloc.2 <null> ldc.i4 -328142 mul <null> ldloc.s V_7 xor <null> br IL_0021: stloc.3 call System.Object server.Module2::_4453B619ABD4495D_() stloc.0 <null> ldc.i4 2025757721 stloc.s V_5 ldloc.2 <null> ldc.i4 -822056 mul <null> ldloc.s V_5 xor <null> br IL_0021: stloc.3 ret <null>

3e09851e283a9fd65ce69f3510587df6 (274.43 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙