Malicious
Malicious

6736ae72c7437a2bd9a29b75a4c4c345

PE Executable
|
MD5: 6736ae72c7437a2bd9a29b75a4c4c345
|
Size: 307.71 KB
|
application/x-dosexec


Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
6736ae72c7437a2bd9a29b75a4c4c345
Sha1
e8e7cf291ce91cff16ef4c26ebd2b9cac7dff452
Sha256
2a9cd95dea7e44cba7056a7a0f38c002399e9af16d0773462f2dd9bb487da8af
Sha384
3e05d27b1b42c141d8cccf888411cca3fbd91fa7e79c7bb49c624350484ee947ec8d0bae410a499b8073447e3725650a
Sha512
a10ad613ea5d8fee306504e63f11976acca65bddc52e9f2f8b9e3978e5c8f811e08e1823443cdfe2e2ecbcd006ce5d60067182e64276c3b2af6b24f976d7c3d5
SSDeep
3072:2cZqf7D341p/0+mAIkygIQQUgWsB1fA0PuTVAtkxze3RoeqiOL2bBOA:2cZqf7DIvnyjPB1fA0GTV8kkoL
TLSH
18645A5833E8C910DA7F4775D861D67193B0BCA3A552E70B4FC4ACAB3D32740EA50AB6

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Form1.resources
Patterns.Properties.Resource1.resources
rootCert
Malware Configuration - RedLine Encoded Config.
Config. Field
Value
[Configuration Module Name]

Arguments

[Configuration Module Full Name]

Arguments

IP

LiwbUTQSMko0CT1JLhFMUzYSDAA3Nz0A

ID

AhU+EiEvExA=

Message

Key

cxx

Version

1

Malware Configuration - RedLine Decoded Config.
Config. Field
Value
[Configuration Module Name]

Arguments

[Configuration Module Full Name]

Arguments

IP (C2)

176.46.152.46:1911

ID

jajaja

Key

cxx

Version

1

Informations
Name
Value
Module Name

Steanings.exe

Full Name

Steanings.exe

EntryPoint

System.Void Program::Main()

Scope Name

Steanings.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Steanings

Assembly Version

1.1.21.1

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

301

Main Method

System.Void Program::Main()

Main IL Instruction Count

17

Main IL

nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0022: ret stloc.0 <null> nop <null> nop <null> leave.s IL_0022: ret ret <null>

Module Name

Steanings.exe

Full Name

Steanings.exe

EntryPoint

System.Void Program::Main()

Scope Name

Steanings.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Steanings

Assembly Version

1.1.21.1

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

301

Main Method

System.Void Program::Main()

Main IL Instruction Count

17

Main IL

nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0022: ret stloc.0 <null> nop <null> nop <null> leave.s IL_0022: ret ret <null>

6736ae72c7437a2bd9a29b75a4c4c345 (307.71 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙