133bec08b9afa565fb34292e3155a4d9b06abcaec9e34291277967cab450e889

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2074-Mar-11 21:02:46
Debug artifacts C:\Compile\cwcontrol\Custom\Extensions\Agent Deployer\Source\SC.AgentDeployer.Client\obj\Release\SC.AgentDeployer.Client.pdb
Comments
CompanyName ConnectWise
FileDescription SC.AgentDeployer.Client
FileVersion 1.2.0.0
InternalName SC.AgentDeployer.Client.exe
LegalCopyright Copyright © ConnectWise 2019
LegalTrademarks
OriginalFilename SC.AgentDeployer.Client.exe
ProductName SC.AgentDeployer.Client
ProductVersion 1.2.0.0
Assembly Version 1.2.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C# v7.0 / Basic .NET
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to system / monitoring tools:
  • rundll32.exe
 Contains another PE executable:
  • This program cannot be run in DOS mode.
 Contains domain names:
  • cacerts.digicert.com
  • crl3.digicert.com
  • crl4.digicert.com
  • digicert.com
  • hq7g7m-relay.screenconnect.com
  • http://cacerts.digicert.com
  • http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
  • http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
  • http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt0_
  • http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
  • http://crl3.digicert.com
  • http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
  • http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
  • http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl0
  • http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
  • http://crl4.digicert.com
  • http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
  • http://ocsp.digicert.com0
  • http://ocsp.digicert.com0A
  • http://ocsp.digicert.com0C
  • http://ocsp.digicert.com0\
  • http://schemas.microsoft.com
  • http://schemas.microsoft.com/expression/blend/2008
  • http://schemas.microsoft.com/winfx/2006/xaml
  • http://schemas.microsoft.com/winfx/2006/xaml/presentation
  • http://schemas.openxmlformats.org
  • http://schemas.openxmlformats.org/markup-compatibility/2006
  • http://www.digicert.com
  • http://www.digicert.com/CPS0
  • instance-hq7g7m-relay.screenconnect.com
  • microsoft.com
  • openxmlformats.org
  • relay.screenconnect.com
  • schemas.microsoft.com
  • schemas.openxmlformats.org
  • screenconnect.com
  • www.digicert.com
Info Cryptographic algorithms detected in the binary: Uses constants related to SHA256
Suspicious The file contains overlay data. 20561920 bytes of data starting at offset 0x59c00.
The overlay data has an entropy of 7.98376 and is possibly compressed or encrypted.
Overlay data amounts for 98.2436% of the executable.
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 7a94966e356140ca46475797e8581d63 🔍
SHA1 2352f7ada802c327bf38ab23763285250bed6e71 🔍
SHA256 133bec08b9afa565fb34292e3155a4d9b06abcaec9e34291277967cab450e889 🔍
SHA3 e1cf2c6acc075c03a49bd583fc6a40407fc2aab61454d55df913a043e1eca11a 🔍
SSDeep 393216:Au6ohU+8bjJ8JQu9ySZ8EO6ohU+8bjJ8Y6ohU+8bjJ8h6ohU+8bjJ8X6ohU+8bjZ:koh0bjC9ySZzpoh0bjOoh0bjxoh0bjpT 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2074-Mar-11 21:02:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x56a00
SizeOfInitializedData 0x3000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0005884E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x60000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 3c18451254442809aa787e3162f60967 🔍
SHA1 57f799631eb417ec5f783d75a322eb4437ada4b7 🔍
SHA256 0aa4f3b4205c60c67fe64b350ede50aef8527e95df8717a6c2063f7c6dc561df 🔍
SHA3 fdd24b3d44b91d48bb3f23b19138343d14cb1e44dff6668318d531c31934b354 🔍
VirtualSize 0x56854
VirtualAddress 0x2000
SizeOfRawData 0x56a00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.49364

.rsrc

MD5 206e68992189f14ea77c1953c18a8c11 🔍
SHA1 5639fd23fce34d27172f37268f87d9225d7acba1 🔍
SHA256 8fefbb3b975aae82dda196191013c57cda95d608c186bb40aedf42193bace20b 🔍
SHA3 639a8938b30722cf239c8fd9bc6a8311328897d391c93321ce0422dc3efa5cf9 🔍
VirtualSize 0x2d08
VirtualAddress 0x5a000
SizeOfRawData 0x2e00
PointerToRawData 0x56c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.62956

.reloc

MD5 c71a05f706c4e632824d67ff55ae2efc 🔍
SHA1 19f754f3ef00304b726ea88d3ad531c66bac0d55 🔍
SHA256 da591223c4cbec38ab276a0fa93b9252d3c5673b4d091d3811fbf4b461240ac4 🔍
SHA3 50f65c75df0cb762ade0339bb6b8edd9ada23c7b8b7614b39a4fd88798efb8ab 🔍
VirtualSize 0xc
VirtualAddress 0x5e000
SizeOfRawData 0x200
PointerToRawData 0x59a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.79582
MD5 aeb95597e98fa1a43e819043d4f100c0 🔍
SHA1 965ed1b53ecd3e2b2f9fdc5c3182bc73b4c84854 🔍
SHA256 af97d1034f98798e503603b2099e17419e2d4cb076c0cda181a6e01630d11681 🔍
SHA3 fc555a8eb3ccaf0d4734adc10b72b54feac42bdfd03b7b47f135c1dfb51d8917 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.91924
Detected Filetype Icon file
MD5 6da8e7d5ae1d5d15e0230a67a7c16c6d 🔍
SHA1 678db52cbe5d617c33c6269bfd4b6d8d1a17f956 🔍
SHA256 6eb54801f91b6d8effccbfaefe6b2d7705a274a75940e6226e24e0d4ec58c396 🔍
SHA3 994fc217c7b8bc8008ac262ff58044403206de6eceafd424d4640ecad395eb2f 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x3b8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.32145
MD5 1fda9ad97aa3149079e4dbcb21c069b5 🔍
SHA1 9d3e6c704bf41f4dfbc991558411bbe35a57cf70 🔍
SHA256 46b0e4c3ae9d5648bfc1c67b9b116054c3fc779845c708c2972ea90d743f5712 🔍
SHA3 d37a187c7610c22224a3e99c8b09913076f36b2e6da4304556ff8a544e321de4 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x25e
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.98224
MD5 f718bc550d3f2c961e83edf327257290 🔍
SHA1 29837e9c65892c4ecfea930aeefc7b0f0437c385 🔍
SHA256 7491db6ee4ed391e3330248abc771b0ff56f3609c40b2f8883b8a61d1d8e9775 🔍
SHA3 5aeb9ed855953cbd4d616e950d809cbdb0d67071180143b26cc96d2d9bacdfa3 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.2.0.0
ProductVersion 1.2.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName ConnectWise
FileDescription SC.AgentDeployer.Client
FileVersion (#2) 1.2.0.0
InternalName SC.AgentDeployer.Client.exe
LegalCopyright Copyright © ConnectWise 2019
LegalTrademarks
OriginalFilename SC.AgentDeployer.Client.exe
ProductName SC.AgentDeployer.Client
ProductVersion (#2) 1.2.0.0
Assembly Version 1.2.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2074-Mar-11 21:02:46
Version 0.0
SizeofData 149
AddressOfRawData 0x58768
PointerToRawData 0x56968
Referenced File C:\Compile\cwcontrol\Custom\Extensions\Agent Deployer\Source\SC.AgentDeployer.Client\obj\Release\SC.AgentDeployer.Client.pdb

UNKNOWN

Characteristics 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0x569fd

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.