Suspicious
Suspect

bc2472e883bddf055ee9f945dee71a21

PE Executable
|
MD5: bc2472e883bddf055ee9f945dee71a21
|
Size: 3.39 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
Hash Value
MD5
bc2472e883bddf055ee9f945dee71a21
Sha1
af9ee93d05e50c1814f00b1491c95cc37a2d5f1e
Sha256
e1b8b76b327b7253e25566550b8d05c711522e5174ac75da9c2409920e372e5e
Sha384
51b85bf5611dd4e0b73a60a5fe8899048d7075e71de954581c90a09b6154f737a1352e625c05e0c689c34e2ad399dacd
Sha512
d1cfd2a44e7cf64ed1643fe16a24f5bdac893a7edef54cea7b01366abca339f7028c1924bc25331034eb57c4269c419a97d977308767c4909477ff4e0254d480
SSDeep
49152:oRgVmjO5f37mY4hIpY/fyFKKLrD5PDH3gGGkWUBrJ2YT1zMk16mkHeLZlwyf/:LmjOf37mfIp9L/9H3g6WUr9T1zM4WZyH
TLSH
9EF5338DAA95DF61C72B7FB0C249507582B0D6B902E2F3E7F9D53EB409C137C641A982

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

server1.exe

Full Name

server1.exe

EntryPoint

System.Void server.Module2::main()

Scope Name

server1.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

server1

Assembly Version

6.8.7.9

Assembly Culture

<null>

Has PublicKey

True

PublicKey Token

7cb1a7dca8454ee8

Target Framework

.NETFramework,Version=v4.8

Total Strings

28

Main Method

System.Void server.Module2::main()

Main IL Instruction Count

62

Main IL

nop <null> ldc.i4 -884381130 stloc.3 <null> ldc.i4 -1575508382 ldc.i4 1412043918 ldc.i4 -2124750469 mul <null> ldloc.3 <null> neg <null> not <null> sub <null> sub <null> dup <null> stloc.2 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br IL_00D2: ret call System.String server.Module2::_2F4DCB4BEE8A405F_() ldc.i4 826340395 br.s IL_0046: call System.String <Module>::_DBD1BBE901C54051_<System.String>(System.IntPtr) call System.String <Module>::_DBD1BBE901C54051_<System.String>(System.IntPtr) call System.String server.Module2::_9C02E1C8C1BA4475_(System.String,System.String) stsfld System.String server.Module2::Hex ldsfld System.String server.Module2::Hex call System.Byte[] server.Module2::_E07A443FEB844780_(System.String) stsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_DA42074145544793_() stloc.0 <null> ldloc.0 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_EFE9DD8BB5C04D03_() call System.Object server.Module2::_B656A0E6A3034C4B_(System.Object) call System.String server.Module2::_A7BCBD1AA9D34043_(System.Object) call System.Boolean server.Module2::_AACB7E873C4E4EBC_(System.Object,System.Byte[],System.String) pop <null> ldc.i4 10799117 stloc.s V_4 ldloc.2 <null> ldc.i4 -715383 mul <null> ldloc.s V_4 xor <null> br IL_0006: stloc.3 call System.Object server.Module2::_FA4475E2155043A0_() stloc.1 <null> ldloc.1 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_EFE9DD8BB5C04D03_() call System.Object server.Module2::_B656A0E6A3034C4B_(System.Object) call System.String server.Module2::_A7BCBD1AA9D34043_(System.Object) call System.Boolean server.Module2::_DC7163E7BEC74A39_(System.Object,System.Byte[],System.String) pop <null> ldc.i4 437659232 stloc.s V_5 ldloc.2 <null> ldc.i4 -276357 mul <null> ldloc.s V_5 xor <null> br IL_0006: stloc.3 ret <null>

Module Name

server1.exe

Full Name

server1.exe

EntryPoint

System.Void server.Module2::main()

Scope Name

server1.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

server1

Assembly Version

6.8.7.9

Assembly Culture

<null>

Has PublicKey

True

PublicKey Token

7cb1a7dca8454ee8

Target Framework

.NETFramework,Version=v4.8

Total Strings

28

Main Method

System.Void server.Module2::main()

Main IL Instruction Count

62

Main IL

nop <null> ldc.i4 -884381130 stloc.3 <null> ldc.i4 -1575508382 ldc.i4 1412043918 ldc.i4 -2124750469 mul <null> ldloc.3 <null> neg <null> not <null> sub <null> sub <null> dup <null> stloc.2 <null> ldc.i4.4 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br IL_00D2: ret call System.String server.Module2::_2F4DCB4BEE8A405F_() ldc.i4 826340395 br.s IL_0046: call System.String <Module>::_DBD1BBE901C54051_<System.String>(System.IntPtr) call System.String <Module>::_DBD1BBE901C54051_<System.String>(System.IntPtr) call System.String server.Module2::_9C02E1C8C1BA4475_(System.String,System.String) stsfld System.String server.Module2::Hex ldsfld System.String server.Module2::Hex call System.Byte[] server.Module2::_E07A443FEB844780_(System.String) stsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_DA42074145544793_() stloc.0 <null> ldloc.0 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_EFE9DD8BB5C04D03_() call System.Object server.Module2::_B656A0E6A3034C4B_(System.Object) call System.String server.Module2::_A7BCBD1AA9D34043_(System.Object) call System.Boolean server.Module2::_AACB7E873C4E4EBC_(System.Object,System.Byte[],System.String) pop <null> ldc.i4 10799117 stloc.s V_4 ldloc.2 <null> ldc.i4 -715383 mul <null> ldloc.s V_4 xor <null> br IL_0006: stloc.3 call System.Object server.Module2::_FA4475E2155043A0_() stloc.1 <null> ldloc.1 <null> ldsfld System.Byte[] server.Module2::Bytes call System.Object server.Module2::_EFE9DD8BB5C04D03_() call System.Object server.Module2::_B656A0E6A3034C4B_(System.Object) call System.String server.Module2::_A7BCBD1AA9D34043_(System.Object) call System.Boolean server.Module2::_DC7163E7BEC74A39_(System.Object,System.Byte[],System.String) pop <null> ldc.i4 437659232 stloc.s V_5 ldloc.2 <null> ldc.i4 -276357 mul <null> ldloc.s V_5 xor <null> br IL_0006: stloc.3 ret <null>

bc2472e883bddf055ee9f945dee71a21 (3.39 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙