Suspicious
Suspect

46790ea376ffc71d4f455525ff175ab5

PE Executable
MD5: 46790ea376ffc71d4f455525ff175ab5
Size: 3.42 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 46790ea376ffc71d4f455525ff175ab5
Sha1 25bfde7245fe9b54978eb0f523d0bf6515febf12
Sha256 fe81faa80cbe72b3c88c0f6df7e276bb09262308e59f2abc4b24bf634d728e36
Sha384 c573e7e1522e9a7af3034fe609067467b5d1663e00357cbc37c1e1c9067d9fe53511fc24ce78ae85293c3e7bba38604f
Sha512 3d15eb8398b7fb3d6e55e2ed96cbd5214ae0e7d0d8b4c73e0250d4d023a9eeda0aa70ab9659370330d4ec6cddd86f2abe57cd15d4ea46945bfcf43ce47061ad6
SSDeep 49152:t/2GmXlVPrqc39CjTjcyhHvY7rj2mm9DnFuEGKSf69wADER29BgRYi8Up:tpomc2TQyH4rjRm9Dlc69ctp
TLSH 2EF522DC366075AEC857C971CAA86C74A2207C7B570BC603A4637C9FBA3D1978F244B6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
46790ea376ffc71d4f455525ff175ab5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
server1.exe
Full Name
server1.exe
EntryPoint 
System.Void ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‬‪‪‫‮‮‪‭​‭‍‌‍‌‍​‬‎‏​‭‫‮()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
6.2.0.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
7
Main Method 
System.Void ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‬‪‪‫‮‮‪‭​‭‍‌‍‌‍​‬‎‏​‭‫‮()
Main IL Instruction Count
55
Main IL 
nop <null>
call System.String ‭‎‫‍‎‬‮‫‎‮‪‮‏‫‫‮‌‭‍‫‫‬‌‮‮​‮‮‮::‍‮‎‭‌‬‏‍​‍‪‍​‮‏​‫‭‪‪‮()
ldc.i4 -1843891028
call System.String <Module>::‭‬‬‬​‌‍‍‭‮‫‮‌‍​‮‪‬‮‍‎‌‮<System.String>(System.UInt32)
call System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‪‪‎‍‫‌‮‍‍‍‫‫‮‮‮‎‏‬‌‏‪‍‌‍‎‌​‮(System.String,System.String)
stsfld System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‪‭‌‎‬‪‫‮‭‪‌‬‬‎‬‏‪‬‏‌‪‏​‫‎‮
ldc.i4 694882155
ldc.i4 1616355699
xor <null>
dup <null>
stloc.2 <null>
ldc.i4.5 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00AA: ldloc.1
ldsfld System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‪‭‌‎‬‪‫‮‭‪‌‬‬‎‬‏‪‬‏‌‪‏​‫‎‮
call System.Byte[] ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‪‏‫‏‍​‌‎‬‍‮‬‪​‎‎‏‏‪‍‭‌‌‮(System.String)
stsfld System.Byte[] ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‌‫‍‭‮‮​‌‪‌‫‎‎‭‍​‬​‫‏​​‪‪‎‫‮‮
ldloc.2 <null>
ldc.i4 1259708248
mul <null>
ldc.i4 2000304456
xor <null>
br.s IL_001F: ldc.i4 1616355699
ldloc.0 <null>
ldsfld System.Byte[] ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‌‫‍‭‮‮​‌‪‌‫‎‎‭‍​‬​‫‏​​‪‪‎‫‮‮
call System.Diagnostics.Process ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‍​‏‫‭‭‪‭‪‮‎‫‌​‮‭‮‍‎‌‫‫‌‬​‌‮()
call System.Diagnostics.ProcessModule ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‎‫‫‍‬​‪‌‬‫‌‭‪‎‪‫​​‎‌‪‌‮‪‪‎‮(System.Diagnostics.Process)
call System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‏‮‬‎‎‭‪‌‏‬‫‭‏‬‌‍‮‏‍‎‏​‎‎‏‬‍‪‪‭‪‬‮(System.Diagnostics.ProcessModule)
callvirt System.Boolean ‌‬‮‌‌‌‍‮‪‮‌‏‌‏​‮‭‫‭​‍‪​‍‮::‌‍‎‮‌‮​‎‬‍‏‏‍‍‫‏‫‏‭‎‌‌‫‍‎​‪‍‮(System.Byte[],System.String)
pop <null>
newobj System.Void ‭‫‭‪‭‏‍‭‬‬‏‎‭‪‬‬‏‮::.ctor()
stloc.1 <null>
ldloc.2 <null>
ldc.i4 933675306
mul <null>
ldc.i4 -1648372074
xor <null>
br.s IL_001F: ldc.i4 1616355699
newobj System.Void ‌‬‮‌‌‌‍‮‪‮‌‏‌‏​‮‭‫‭​‍‪​‍‮::.ctor()
stloc.0 <null>
ldloc.2 <null>
ldc.i4 1301933155
mul <null>
ldc.i4 1291616623
xor <null>
br IL_001F: ldc.i4 1616355699
ldloc.1 <null>
ldsfld System.Byte[] ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‌‫‍‭‮‮​‌‪‌‫‎‎‭‍​‬​‫‏​​‪‪‎‫‮‮
call System.Diagnostics.Process ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‍​‏‫‭‭‪‭‪‮‎‫‌​‮‭‮‍‎‌‫‫‌‬​‌‮()
call System.Diagnostics.ProcessModule ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‎‫‫‍‬​‪‌‬‫‌‭‪‎‪‫​​‎‌‪‌‮‪‪‎‮(System.Diagnostics.Process)
call System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‏‮‬‎‎‭‪‌‏‬‫‭‏‬‌‍‮‏‍‎‏​‎‎‏‬‍‪‪‭‪‬‮(System.Diagnostics.ProcessModule)
callvirt System.Boolean ‭‫‭‪‭‏‍‭‬‬‏‎‭‪‬‬‏‮::‏‮‏‮‭‬‪‍‮‮​‭‍‫‫‪‌‫‎‮‎‭‍‍‮(System.Byte[],System.String)
pop <null>
ret <null>
Module Name
server1.exe
Full Name
server1.exe
EntryPoint 
System.Void ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‬‪‪‫‮‮‪‭​‭‍‌‍‌‍​‬‎‏​‭‫‮()
Scope Name
server1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
server1
Assembly Version
6.2.0.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
7
Main Method 
System.Void ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‬‪‪‫‮‮‪‭​‭‍‌‍‌‍​‬‎‏​‭‫‮()
Main IL Instruction Count
55
Main IL 
nop <null>
call System.String ‭‎‫‍‎‬‮‫‎‮‪‮‏‫‫‮‌‭‍‫‫‬‌‮‮​‮‮‮::‍‮‎‭‌‬‏‍​‍‪‍​‮‏​‫‭‪‪‮()
ldc.i4 -1843891028
call System.String <Module>::‭‬‬‬​‌‍‍‭‮‫‮‌‍​‮‪‬‮‍‎‌‮<System.String>(System.UInt32)
call System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‪‪‎‍‫‌‮‍‍‍‫‫‮‮‮‎‏‬‌‏‪‍‌‍‎‌​‮(System.String,System.String)
stsfld System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‪‭‌‎‬‪‫‮‭‪‌‬‬‎‬‏‪‬‏‌‪‏​‫‎‮
ldc.i4 694882155
ldc.i4 1616355699
xor <null>
dup <null>
stloc.2 <null>
ldc.i4.5 <null>
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00AA: ldloc.1
ldsfld System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‪‭‌‎‬‪‫‮‭‪‌‬‬‎‬‏‪‬‏‌‪‏​‫‎‮
call System.Byte[] ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‪‏‫‏‍​‌‎‬‍‮‬‪​‎‎‏‏‪‍‭‌‌‮(System.String)
stsfld System.Byte[] ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‌‫‍‭‮‮​‌‪‌‫‎‎‭‍​‬​‫‏​​‪‪‎‫‮‮
ldloc.2 <null>
ldc.i4 1259708248
mul <null>
ldc.i4 2000304456
xor <null>
br.s IL_001F: ldc.i4 1616355699
ldloc.0 <null>
ldsfld System.Byte[] ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‌‫‍‭‮‮​‌‪‌‫‎‎‭‍​‬​‫‏​​‪‪‎‫‮‮
call System.Diagnostics.Process ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‍​‏‫‭‭‪‭‪‮‎‫‌​‮‭‮‍‎‌‫‫‌‬​‌‮()
call System.Diagnostics.ProcessModule ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‎‫‫‍‬​‪‌‬‫‌‭‪‎‪‫​​‎‌‪‌‮‪‪‎‮(System.Diagnostics.Process)
call System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‏‮‬‎‎‭‪‌‏‬‫‭‏‬‌‍‮‏‍‎‏​‎‎‏‬‍‪‪‭‪‬‮(System.Diagnostics.ProcessModule)
callvirt System.Boolean ‌‬‮‌‌‌‍‮‪‮‌‏‌‏​‮‭‫‭​‍‪​‍‮::‌‍‎‮‌‮​‎‬‍‏‏‍‍‫‏‫‏‭‎‌‌‫‍‎​‪‍‮(System.Byte[],System.String)
pop <null>
newobj System.Void ‭‫‭‪‭‏‍‭‬‬‏‎‭‪‬‬‏‮::.ctor()
stloc.1 <null>
ldloc.2 <null>
ldc.i4 933675306
mul <null>
ldc.i4 -1648372074
xor <null>
br.s IL_001F: ldc.i4 1616355699
newobj System.Void ‌‬‮‌‌‌‍‮‪‮‌‏‌‏​‮‭‫‭​‍‪​‍‮::.ctor()
stloc.0 <null>
ldloc.2 <null>
ldc.i4 1301933155
mul <null>
ldc.i4 1291616623
xor <null>
br IL_001F: ldc.i4 1616355699
ldloc.1 <null>
ldsfld System.Byte[] ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‌‫‍‭‮‮​‌‪‌‫‎‎‭‍​‬​‫‏​​‪‪‎‫‮‮
call System.Diagnostics.Process ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‫‍​‏‫‭‭‪‭‪‮‎‫‌​‮‭‮‍‎‌‫‫‌‬​‌‮()
call System.Diagnostics.ProcessModule ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‎‫‫‍‬​‪‌‬‫‌‭‪‎‪‫​​‎‌‪‌‮‪‪‎‮(System.Diagnostics.Process)
call System.String ‌‭‎‌‮‪‪‫‎‬‫‌‍‬‭​‫‭‫‫‭‫‭‎‬‮::‏‮‬‎‎‭‪‌‏‬‫‭‏‬‌‍‮‏‍‎‏​‎‎‏‬‍‪‪‭‪‬‮(System.Diagnostics.ProcessModule)
callvirt System.Boolean ‭‫‭‪‭‏‍‭‬‬‏‎‭‪‬‬‏‮::‏‮‏‮‭‬‪‍‮‮​‭‍‫‫‪‌‫‎‮‎‭‍‍‮(System.Byte[],System.String)
pop <null>
ret <null>
46790ea376ffc71d4f455525ff175ab5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙