18f03c9666e04261a675b72f0c2c080149dfbf3e577b81e8f50ab32a3ff197a0

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2081-Nov-07 05:08:46
Debug artifacts E:\universal\Copy of universarl tools\New folder\Drdecryptor for clients\EncryptDecryptFiles\obj\Release\Dr Decryptor.pdb
Comments
CompanyName
FileDescription dr decryptor
FileVersion 1.0.0.0
InternalName Dr Decryptor.exe
LegalCopyright Copyright © 2025
LegalTrademarks
OriginalFilename Dr Decryptor.exe
ProductName dr decryptor
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
Info Interesting strings found in the binary: Contains domain names:
  • google.com
  • www.google.com
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 160706a6e06e7e3a11aff0078c2ced95 🔍
SHA1 de9488ef95f77fa6ffcd507041460ebfcb70a528 🔍
SHA256 18f03c9666e04261a675b72f0c2c080149dfbf3e577b81e8f50ab32a3ff197a0 🔍
SHA3 bb1b661a56f8fe169f750760e6582b21e445c923b7fd5b9ca0640890a9a679e3 🔍
SSDeep 1536:QvfFSiNhpmroizTIEfTdrzl8iDRl8i/SnpqKm1:QvwiNhE0e/lxlzS0z 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2081-Nov-07 05:08:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 80.0
SizeOfCode 0x89600
SizeOfInitializedData 0x19a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0008B3FE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x8c000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa8000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4b289efd092a286630ce6bd2101d4075 🔍
SHA1 ea2b09fc6c059d8d8a8f904fc548529574a2d377 🔍
SHA256 3789abf4dd52fc86dfd0dd496021ad91b0bf400709abd82c33512eab55199f6b 🔍
SHA3 8822382f2e024f31960aed4b3675d36db80b337e9a645a0336811e03d3aca9b7 🔍
VirtualSize 0x89404
VirtualAddress 0x2000
SizeOfRawData 0x89600
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 1.72259

.rsrc

MD5 7c6fcc64e9d24d89a74963909512a860 🔍
SHA1 b0ad131b08b52202be6202df873ab3908750bd6d 🔍
SHA256 c3fdb6f4545f0efcd8567b74a0bb05e15809c78cd65de039eecb94e17e2d27d6 🔍
SHA3 e4361ed744805fdc288792ddb56459bdd0c8c7f09e354cc9ccbc2c9998da1c52 🔍
VirtualSize 0x19780
VirtualAddress 0x8c000
SizeOfRawData 0x19800
PointerToRawData 0x89800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.97844

.reloc

MD5 da0e2caf89f44b30b14738e4567dd10b 🔍
SHA1 2f81856ef461c4c4963e31d9c9743add40261af1 🔍
SHA256 6523da1d217f34a6b4027212bb37149ed40ffdf5108efb7c91bf8f17d10f75d5 🔍
SHA3 52d3c2523f9d32659d4223b39c89e368e53d983287f54b50a1c317bf15446ab5 🔍
VirtualSize 0xc
VirtualAddress 0xa6000
SizeOfRawData 0x200
PointerToRawData 0xa3000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.93923
MD5 5581f467fd5a41e7f7c11d7890a9ba41 🔍
SHA1 527240fdd8eb17cda84884c379ef1dfd029d7e23 🔍
SHA256 131a873dac83ab2366ed21d1ff487eab7ccb022766de0462fd9b3a726e2ded0d 🔍
SHA3 3b8e72614ca96010ab43465af6e55de90042c2fe48d2fd68fea2febd65cf8a7e 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.14432
MD5 55ae903ef5f2a955a61a89a09e19bdc3 🔍
SHA1 2a59707bcd5caefaecf280736edf556ec34b1d02 🔍
SHA256 05a41e9a9df8bf17109544ff8f181805f52c43f7eec9f021d30574a640fa330e 🔍
SHA3 f119e8856a08412acd4e57930829780b71a5922d6817d658c7e49f5b7bb12f51 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.00911
MD5 12f801769c9bf85ec3c4b22aa1ece863 🔍
SHA1 d4b02c86c079e808d8003fb29f875ab6fe0d9ab6 🔍
SHA256 804a88fbf7fa56a15bfb332fa0c7d6c687748bf46019fa9b4d08a885e8a7a0d6 🔍
SHA3 5460ac8afbc6fa9d120529ed95131be183feecce12f2db89486f12c31abc451f 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.80516
MD5 5bd126ac22d99f2858a5cddcb3edb9bf 🔍
SHA1 d1ca1d6f8bd7883f2e81cbce6e7f6169bdfc1244 🔍
SHA256 010a8e08fc70165dfefc824a5322b299a1d4b2732cb3d17d8bd7fd600ee8148f 🔍
SHA3 520117ba62fa797f45ae847ecabef5e94f0b45814fcd0d9ad74ea2ac12fb7d75 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.42426
MD5 fc90603e5bb0141d5f9d8eab7007547d 🔍
SHA1 c4052c6dee057f054d400e630d03cfe160864c6c 🔍
SHA256 098e5aaf278ae40564f1538b7640adf3cb9ccbfb409bd0d67ee600a6a13d898e 🔍
SHA3 d2b23738eec4e7ed00308b0634d2454e83ed4f31c551e8cd492ef00a3fddfd08 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.80283
Detected Filetype Icon file
MD5 da9b70665374e3394540c51191a2dfd6 🔍
SHA1 c91b3f6407149e322850f6a257923abb260adeb5 🔍
SHA256 9595be7d246f12c7356d15b8facc45ea482de63d316af484c99156170b9d7362 🔍
SHA3 d75e51b150e9bb574412de784a1ecf652c36717a52f920f529a2c01e2dfce6af 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x33c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.26171
MD5 53f7dce58eca4d7d1d85335e6ae8efcc 🔍
SHA1 f46081d842659900388e82e056060941183b0f4d 🔍
SHA256 57702092697068a75dc7a97c317b03f6c09c30bc758ddca6ddbf6dffac23d5a6 🔍
SHA3 d67ccda9c6e1833681b968b6b605d4590c844081ceda37021816b599531ea059 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0xcf9
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.97519
MD5 29d23947c137452c843252a713544539 🔍
SHA1 70348199504fb9d5781190747972ffd3b7bb3296 🔍
SHA256 77035ace5aba7cf553a58f7a513bf6bff49ed3af3d8f35ac61ee9d24a07baae3 🔍
SHA3 c41abe25494b11eb2d668bf23ee2f2d84bdeb8133184b7dcf0516c5bb6297980 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription dr decryptor
FileVersion (#2) 1.0.0.0
InternalName Dr Decryptor.exe
LegalCopyright Copyright © 2025
LegalTrademarks
OriginalFilename Dr Decryptor.exe
ProductName dr decryptor
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2055-Sep-23 01:02:57
Version 0.0
SizeofData 146
AddressOfRawData 0x8b318
PointerToRawData 0x89518
Referenced File E:\universal\Copy of universarl tools\New folder\Drdecryptor for clients\EncryptDecryptFiles\obj\Release\Dr Decryptor.pdb

UNKNOWN

Characteristics 0
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
SizeofData 0
AddressOfRawData 0
PointerToRawData 0

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.