Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | c8dfb2a86f68e633baa5bf469dab803e
|
| Sha1 | 405744c30b42c2a439c76fa92b45832fc844c325
|
| Sha256 | 5a3b7f08013bcb3d40e4f885167e3aeae3b84ee9c4ac207df0eb83cccd7ac7b3
|
| Sha384 | 7b056831e6af79d592310209a787800ee4a61fd055d084736685db29c8e1286330c1384d3919b50b0572141b73412377
|
| Sha512 | 7d67bc0ac4cfcfe0b05f2d17139de9986740465298353ed911aafd4bb08d7d7dc9d5d7a0f1ab83357e0c68abaeeff856101b79e88caa7fd1a4f9d6eb7d4e1e75
|
| SSDeep | 384:gaM8+lCO/5vgQrMb+IZl9tZw9QOlg9cI3STt9fqKykOnL:tMtnpo9cQi2KyPnL
|
| TLSH | 2872F80233F44258F17FAB396DB201684972FD7A9D31EA4C1CD9506E0E62B849F50FB6
|
PeID
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | agent_fw_x64.exe |
| Full Name | agent_fw_x64.exe |
| EntryPoint | System.Void FleetAgent.Program::Main(System.String[]) |
| Scope Name | agent_fw_x64.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | agent_fw_x64 |
| Assembly Version | 0.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 155 |
| Main Method | System.Void FleetAgent.Program::Main(System.String[]) |
| Main IL Instruction Count | 39 |
| Main IL | call System.IntPtr FleetAgent.Program::GetConsoleWindow() stloc.0 <null> ldloc.0 <null> ldsfld System.IntPtr System.IntPtr::Zero call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr) brfalse.s IL_001B: ldsfld System.IntPtr System.IntPtr::Zero ldloc.0 <null> ldc.i4.0 <null> call System.Boolean FleetAgent.Program::ShowWindow(System.IntPtr,System.Int32) pop <null> ldsfld System.IntPtr System.IntPtr::Zero ldc.i4.1 <null> ldstr Global\FleetAgentFW_7F3A9B2C call System.IntPtr FleetAgent.Program::CreateMutex(System.IntPtr,System.Boolean,System.String) pop <null> call System.Int32 FleetAgent.Program::GetLastError() ldc.i4 183 bne.un.s IL_003A: call System.String FleetAgent.Program::GetMachineId() leave.s IL_0078: ret call System.String FleetAgent.Program::GetMachineId() stsfld System.String FleetAgent.Program::_machineId call System.String System.Environment::get_MachineName() stsfld System.String FleetAgent.Program::_hostname call System.Void FleetAgent.Program::AutoPersist() leave.s IL_006C: ldsfld System.Boolean FleetAgent.Program::_isRunning pop <null> leave.s IL_006C: ldsfld System.Boolean FleetAgent.Program::_isRunning call System.Void FleetAgent.Program::ConnectAndRun() leave.s IL_0062: ldc.i4 5000 pop <null> leave.s IL_0062: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.Boolean FleetAgent.Program::_isRunning brtrue.s IL_0058: call System.Void FleetAgent.Program::ConnectAndRun() leave.s IL_0078: ret pop <null> leave.s IL_0078: ret ret <null> |