Malicious
Malicious

a0b7bc594f9b0c8b1b93d3faf8b8d8ad

PE Executable
|
MD5: a0b7bc594f9b0c8b1b93d3faf8b8d8ad
|
Size: 307.71 KB
|
application/x-dosexec


Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
a0b7bc594f9b0c8b1b93d3faf8b8d8ad
Sha1
6e3eb817bd26351cb1eca22f4183010e21eeb74c
Sha256
6d869187927e0c562dd0ade47e3b39f580c59ae84808bd723c68e421ad747b6b
Sha384
5b4226248b2f7981400e08684800280621b8b9893037eb55d748b28149e16d524969fd390965b6e4ffb6dc448f5d4a66
Sha512
767149bc539d660428e752fc7efb1503a179b5e5005c7572712ca4316f4ec8438f1e9dae9a4f9ad1fac371586aae22aa026414464c2607cd9eb26246d722c459
SSDeep
3072:OcZqf7D34kp/0+mA6ky4mEQog8JB1fA0PuTVAtkxzO3RgeqiOL2bBOA:OcZqf7DIcnGfsB1fA0GTV8k4gL
TLSH
95645A5833E8C910DA7F4775D861D67193B0BCA3A552E70B4FC4ACAB3D32740EA50AB6

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Form1.resources
Patterns.Properties.Resource1.resources
rootCert
Malware Configuration - RedLine Encoded Config.
Config. Field
Value
[Configuration Module Name]

Arguments

[Configuration Module Full Name]

Arguments

IP

176.46.152.46:1912

ID

dcxwvcxv5

Message

Key

Version

1

Malware Configuration - RedLine Decoded Config.
Config. Field
Value
[Configuration Module Name]

Arguments

[Configuration Module Full Name]

Arguments

Key

Version

1

Informations
Name
Value
Module Name

Steanings.exe

Full Name

Steanings.exe

EntryPoint

System.Void Program::Main()

Scope Name

Steanings.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Steanings

Assembly Version

1.1.21.1

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

301

Main Method

System.Void Program::Main()

Main IL Instruction Count

17

Main IL

nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0022: ret stloc.0 <null> nop <null> nop <null> leave.s IL_0022: ret ret <null>

Module Name

Steanings.exe

Full Name

Steanings.exe

EntryPoint

System.Void Program::Main()

Scope Name

Steanings.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Steanings

Assembly Version

1.1.21.1

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

301

Main Method

System.Void Program::Main()

Main IL Instruction Count

17

Main IL

nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0022: ret stloc.0 <null> nop <null> nop <null> leave.s IL_0022: ret ret <null>

a0b7bc594f9b0c8b1b93d3faf8b8d8ad (307.71 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙