Malicious
Malicious

e8ecafa5df8c88701accf903bb147bfc

PE Executable
|
MD5: e8ecafa5df8c88701accf903bb147bfc
|
Size: 307.71 KB
|
application/x-dosexec


Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
e8ecafa5df8c88701accf903bb147bfc
Sha1
d898da3981d7dfeb12b79cc4d64d203eb4c09a46
Sha256
4eb9804a8558edab914ee49e62c0335b6bb77df7c2c0e7bcae1d69aa15180e6c
Sha384
402e2eac4ad97a284932f10171d8d0bdcd9e98ce5fb146ce8f0af75f69ee998e4dc54035039ed819bd099da1ae6f0cb5
Sha512
a99eb3a175abbe3406c272a172a75c4abf58795ddc689bf6205860b4044c773864db49b5d6004e3b01e65215c24e850b548c0d09897bfd4e98462294c98619eb
SSDeep
3072:ycZqf7D34ip/0+mAWkyYHcQQg3/B1fA0PuTVAtkxzI3REeqiOL2bBOA:ycZqf7DISnzXvB1fA0GTV8kqsL
TLSH
B8645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Form1.resources
Patterns.Properties.Resource1.resources
rootCert
Malware Configuration - RedLine Encoded Config.
Config. Field
Value
[Configuration Module Name]

Arguments

[Configuration Module Full Name]

Arguments

IP

late-operates.gl.at.ply.gg:32737

ID

a

Message

Key

Version

0

Malware Configuration - RedLine Decoded Config.
Config. Field
Value
[Configuration Module Name]

Arguments

[Configuration Module Full Name]

Arguments

Key

Version

0

Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

Steanings.exe

Full Name

Steanings.exe

EntryPoint

System.Void Program::Main()

Scope Name

Steanings.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Steanings

Assembly Version

1.1.21.1

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

301

Main Method

System.Void Program::Main()

Main IL Instruction Count

17

Main IL

nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0022: ret stloc.0 <null> nop <null> nop <null> leave.s IL_0022: ret ret <null>

Module Name

Steanings.exe

Full Name

Steanings.exe

EntryPoint

System.Void Program::Main()

Scope Name

Steanings.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Steanings

Assembly Version

1.1.21.1

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

301

Main Method

System.Void Program::Main()

Main IL Instruction Count

17

Main IL

nop <null> nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Form1::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> nop <null> leave.s IL_0022: ret stloc.0 <null> nop <null> nop <null> leave.s IL_0022: ret ret <null>

e8ecafa5df8c88701accf903bb147bfc (307.71 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙