5b8b46c494f0536e36a60b7d0599fc83fd3fed68f6190df493ab1e402c9ac7cf

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Oct-10 11:16:10
Comments
CompanyName
FileDescription dr decryptor
FileVersion 1.0.0.0
InternalName Dr Decryptor.exe
LegalCopyright Copyright © 2025
LegalTrademarks
OriginalFilename Dr Decryptor.exe
ProductName dr decryptor
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 ca228fe7a6636c461a024ebf8ec674a3 🔍
SHA1 2c574fe0a3bca46e7098dfb0b367c0cffc74fb23 🔍
SHA256 5b8b46c494f0536e36a60b7d0599fc83fd3fed68f6190df493ab1e402c9ac7cf 🔍
SHA3 663598ce9a93981e709ac310a8e356a8665073043a5f1c1c74528a87cc36f7d8 🔍
SSDeep 1536:EvWUjqIterdKcSsx4g79IZhOT4Kt92arNZHjkCbMtOb/zl8iLJnpqKm1:nj0eocS7g7SE0sXbDl/J0z 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2026-Oct-10 11:16:10
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0xfa00
SizeOfInitializedData 0x19a00
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0001192E (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x12000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x2e000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 6b406bfe67df1fd8933f52da31035f02 🔍
SHA1 8b904ec845ec2513df9a50adff5ce19ad1579284 🔍
SHA256 394ec523b09c60ca763321d9dfb71509c3783eebdee0d5af724378a534ec855a 🔍
SHA3 d5f495fe36c20a9fbcf71ac31ab4ae8fd60823b63cbf459fa58550c864ded9d4 🔍
VirtualSize 0xf934
VirtualAddress 0x2000
SizeOfRawData 0xfa00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 7.84164

.rsrc

MD5 27066a261bfe3d46cf4dbf8d54432255 🔍
SHA1 615334601049b48f61e9409bf405ee68c52d7849 🔍
SHA256 9a2e8174777633d854387eb848ac001e3f869c2160fbf201769273b38135f3fc 🔍
SHA3 5e3ffe07317aaddcc6a2987741f0d13a2035c0f3fa44fc8df414c404fcdeb9db 🔍
VirtualSize 0x19779
VirtualAddress 0x12000
SizeOfRawData 0x19800
PointerToRawData 0xfc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.97791

.reloc

MD5 b03cd33be682fbb35d655e15d7755f9b 🔍
SHA1 25939a0f53a0587222257faadeedc799565a2880 🔍
SHA256 475b404b71355e1ba8856b6707bab4ba200a84405a34b97ddd7bcf342130f3c7 🔍
SHA3 c569fa55477cf91da20d059ebc3e8568fac34c081a552917ad5d302a8ed443e4 🔍
VirtualSize 0xc
VirtualAddress 0x2c000
SizeOfRawData 0x200
PointerToRawData 0x29400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.93923
MD5 5581f467fd5a41e7f7c11d7890a9ba41 🔍
SHA1 527240fdd8eb17cda84884c379ef1dfd029d7e23 🔍
SHA256 131a873dac83ab2366ed21d1ff487eab7ccb022766de0462fd9b3a726e2ded0d 🔍
SHA3 3b8e72614ca96010ab43465af6e55de90042c2fe48d2fd68fea2febd65cf8a7e 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.14432
MD5 55ae903ef5f2a955a61a89a09e19bdc3 🔍
SHA1 2a59707bcd5caefaecf280736edf556ec34b1d02 🔍
SHA256 05a41e9a9df8bf17109544ff8f181805f52c43f7eec9f021d30574a640fa330e 🔍
SHA3 f119e8856a08412acd4e57930829780b71a5922d6817d658c7e49f5b7bb12f51 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.00911
MD5 12f801769c9bf85ec3c4b22aa1ece863 🔍
SHA1 d4b02c86c079e808d8003fb29f875ab6fe0d9ab6 🔍
SHA256 804a88fbf7fa56a15bfb332fa0c7d6c687748bf46019fa9b4d08a885e8a7a0d6 🔍
SHA3 5460ac8afbc6fa9d120529ed95131be183feecce12f2db89486f12c31abc451f 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.80516
MD5 5bd126ac22d99f2858a5cddcb3edb9bf 🔍
SHA1 d1ca1d6f8bd7883f2e81cbce6e7f6169bdfc1244 🔍
SHA256 010a8e08fc70165dfefc824a5322b299a1d4b2732cb3d17d8bd7fd600ee8148f 🔍
SHA3 520117ba62fa797f45ae847ecabef5e94f0b45814fcd0d9ad74ea2ac12fb7d75 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.42426
MD5 fc90603e5bb0141d5f9d8eab7007547d 🔍
SHA1 c4052c6dee057f054d400e630d03cfe160864c6c 🔍
SHA256 098e5aaf278ae40564f1538b7640adf3cb9ccbfb409bd0d67ee600a6a13d898e 🔍
SHA3 d2b23738eec4e7ed00308b0634d2454e83ed4f31c551e8cd492ef00a3fddfd08 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.80283
Detected Filetype Icon file
MD5 da9b70665374e3394540c51191a2dfd6 🔍
SHA1 c91b3f6407149e322850f6a257923abb260adeb5 🔍
SHA256 9595be7d246f12c7356d15b8facc45ea482de63d316af484c99156170b9d7362 🔍
SHA3 d75e51b150e9bb574412de784a1ecf652c36717a52f920f529a2c01e2dfce6af 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x33c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.26171
MD5 53f7dce58eca4d7d1d85335e6ae8efcc 🔍
SHA1 f46081d842659900388e82e056060941183b0f4d 🔍
SHA256 57702092697068a75dc7a97c317b03f6c09c30bc758ddca6ddbf6dffac23d5a6 🔍
SHA3 d67ccda9c6e1833681b968b6b605d4590c844081ceda37021816b599531ea059 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0xcf9
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.97519
MD5 29d23947c137452c843252a713544539 🔍
SHA1 70348199504fb9d5781190747972ffd3b7bb3296 🔍
SHA256 77035ace5aba7cf553a58f7a513bf6bff49ed3af3d8f35ac61ee9d24a07baae3 🔍
SHA3 c41abe25494b11eb2d668bf23ee2f2d84bdeb8133184b7dcf0516c5bb6297980 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription dr decryptor
FileVersion (#2) 1.0.0.0
InternalName Dr Decryptor.exe
LegalCopyright Copyright © 2025
LegalTrademarks
OriginalFilename Dr Decryptor.exe
ProductName dr decryptor
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.