aacb4ea51663d606f4ab72a35c42c9a4
PE Executable | MD5: aacb4ea51663d606f4ab72a35c42c9a4 | Size: 44.03 KB | application/x-dosexec
Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | aacb4ea51663d606f4ab72a35c42c9a4
|
| Sha1 | 7fbfca8d150f7ff1a98e7e6fbe46250a0302549b
|
| Sha256 | 0b60084165ab8cc4903f331615f4918b4d8b7e18780523e2cea95baf72f6ab48
|
| Sha384 | f86226eef3c9bea84bab9aa660c0709057ecfcabd38c7d0fa1d5bed80b1572b2ce9f17a34c75aa77b072b129bb10e0ca
|
| Sha512 | ee7903bca047d41e8f39fb339991c3008599e6fc7170f748fbb93a578ac1a804f96d4ef9e171d96be3a18313cc5c90dbd0742e873923039d9a363623275f127c
|
| SSDeep | 384:EZyZYFgpWoy7ytndq+sEJI3AknzYIij+ZsNO3PlpJKkkjh/TzF7pWnd/greT0pqD:y9Wol7UndZ+wMuXQ/og/+L
|
| TLSH | 3F13D88CB794E174D5FF8BF1B4A2B2890B71A017A806930F99F154D94BB3EC09611EE7
|
PeID
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | True |
| directory [DR] | TEMP |
| executable_name [EXE] | Dllhost.exe |
| icn | #ic |
| is_dir_defined [Idr] | True |
| is_startup_folder [IsF] | True |
| RegistrySt | True |
| cnc_port [P] | 8595 |
| xDlol1 | Java update |
| Sleep | False |
| Sleep1 | 1 |
| reg_key [RG] | Windows Update |
| task [Task] | True |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| Hide | False |
| HP | True |
| SPR | false |
| victim_name [VN] | HacKed |
| version [VR] | Njrat 0.7 Golden By Hassan Amiri |
| splitter [Y] | |Hassan| |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void Stub.OK.j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 436 |
| Main Method | System.Void Stub.OK.j.A::main() |
| Main IL Instruction Count | 20 |
| Main IL | ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null> |
| Module Name | Stub.exe |
| Full Name | Stub.exe |
| EntryPoint | System.Void Stub.OK.j.A::main() |
| Scope Name | Stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 436 |
| Main Method | System.Void Stub.OK.j.A::main() |
| Main IL Instruction Count | 20 |
| Main IL | ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runx ldnull <null> ldftn System.Void Stub.OK.j.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thx ldsfld System.Threading.Thread Stub.OK.j.A::thx callvirt System.Void System.Threading.Thread::Start() ldc.i4.1 <null> stsfld System.Boolean Stub.OK.j.A::runy ldnull <null> ldftn System.Void Stub.OK.j.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.OK.j.A::thy ldsfld System.Threading.Thread Stub.OK.j.A::thy callvirt System.Void System.Threading.Thread::Start() call System.Void Stub.OK.j.OK::ko() ret <null> |
|
Name0 | Value |
|---|---|
| Port | 8595 |
|
Config. Field0 | Value |
|---|---|
| packet_size [b] | 5121 |
| BD [BD] | True |
| directory [DR] | TEMP |
| executable_name [EXE] | Dllhost.exe |
| icn | #ic |
| is_dir_defined [Idr] | True |
| is_startup_folder [IsF] | True |
| RegistrySt | True |
| cnc_port [P] | 8595 |
| xDlol1 | Java update |
| Sleep | False |
| Sleep1 | 1 |
| reg_key [RG] | Windows Update |
| task [Task] | True |
| reg_path [sf] | Software\Microsoft\Windows\CurrentVersion\Run |
| Hide | False |
| HP | True |
| SPR | false |
| victim_name [VN] | HacKed |
| version [VR] | Njrat 0.7 Golden By Hassan Amiri |
| splitter [Y] | |Hassan| |
|
Name0 | Value | Location |
|---|---|---|
| Port | 8595 Malicious |
aacb4ea51663d606f4ab72a35c42c9a4 |