7ad06ab934bdb604e572e8518d9c50aa

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2017-Sep-05 02:59:40
Debug artifacts C:\Data\BAD\badcode\ConsoleApplication1\ConsoleApplication2\obj\Debug\ConsoleApplication2.pdb
Comments
CompanyName
FileDescription ConsoleApplication2
FileVersion 1.0.0.0
InternalName ConsoleApplication2.exe
LegalCopyright Copyright © 2017
LegalTrademarks
OriginalFilename ConsoleApplication2.exe
ProductName ConsoleApplication2
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
.NET executable -> Microsoft
Malicious VirusTotal score: 11/65 (Scanned on 2017-09-08 04:20:29) McAfee: Trojan-FNEY!7AD06AB934BD
Kaspersky: UDS:DangerousObject.Multi.Generic
Avast: Win32:Malware-gen
McAfee-GW-Edition: Trojan-FNEY!7AD06AB934BD
Avira: TR/Dropper.MSIL.Gen
Endgame: malicious (high confidence)
ZoneAlarm: UDS:DangerousObject.Multi.Generic
ESET-NOD32: a variant of MSIL/Filecoder.Samas.B
SentinelOne: static engine - malicious
AVG: Win32:Malware-gen
CrowdStrike: malicious_confidence_100% (D)

Hashes

MD5 7ad06ab934bdb604e572e8518d9c50aa
SHA1 220802f5b1bd377d19d072f0436cffc3b526ebc4
SHA256 4b5f9b1e8c82e0b0a434a83a5d947a69860fd7846673570eb623af01876959ab
SHA3 3e6956b0c5c14bad10a7c00f71528b8b182ecbbd33e27171720787c50394ca30
SSDeep 768:XmZIivmqY/7daA+I+rb3vAsT0jxsQOCTwCppxf8t:XmZIivm5zvL+rb/RgjxxOCTwCppxo
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2017-Sep-05 02:59:40
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0xca00
SizeOfInitializedData 0x800
SizeOfUninitializedData 0
AddressOfEntryPoint 0xe84e (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x10000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x14000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 273e00714db4409bf4cb795d5587df10
SHA1 ebf3ad9fe22d4003f95666b26c2a0acd9211b76d
SHA256 842cb15edf8093f712760a00f854fb1f98ebd009c1d54f2e634ccc5139989ea3
SHA3 e42afedb3e2c3400c6450689475c718fab1b4e0b04b3eade56dc43a3b2bcd834
VirtualSize 0xc854
VirtualAddress 0x2000
SizeOfRawData 0xca00
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.29839

.rsrc

MD5 5cde1e142c00b05e6f96d8e75fce1afc
SHA1 20b31744a4ecbb40619ddde4def282d278396a77
SHA256 d8f8b8ec89f6d4e5befab3c58e7aa47afad2ec0c56af124491285b58b9c72d65
SHA3 318f18eca0a11c030a8ded1e09799ed6ce91e0cbe4deee311b9f4a9be769a229
VirtualSize 0x5fc
VirtualAddress 0x10000
SizeOfRawData 0x600
PointerToRawData 0xcc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.18793

.reloc

MD5 d831b74908d0104d1a64b8eee852ddd4
SHA1 dbbea29b8a1dcb4b3bcbe12cc923d13a1a3f4edc
SHA256 6a06e4c5ab2e09e54249479f5ff14842da8e403838e85175591921bde4e5af02
SHA3 8cfccb45f2edf590fcac1d125e48c201a9062073d81108c3977e19a71e4f98a4
VirtualSize 0xc
VirtualAddress 0x12000
SizeOfRawData 0x200
PointerToRawData 0xd200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x36c
Entropy 3.27583
MD5 7e60c342a4baafa075354b80b4ef180e
SHA1 6024ccbc8438cf0277e7c23285718b8b9d2c1e2e
SHA256 7a096125a944b4ff4f2571d01347e3825ca2dce37426c41d2a34431382b628c4
SHA3 7a9e802bebecd758ab91223780470f41b6dc128edb6bb27a1b4d7782df837a93

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a
SHA3 4f064a06b5bd7ab6005fc494d9f0fc8061d891da40dd0c3387a654047c6ff6ee

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.0.0.0
ProductVersion 1.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments
CompanyName
FileDescription ConsoleApplication2
FileVersion (#2) 1.0.0.0
InternalName ConsoleApplication2.exe
LegalCopyright Copyright © 2017
LegalTrademarks
OriginalFilename ConsoleApplication2.exe
ProductName ConsoleApplication2
ProductVersion (#2) 1.0.0.0
Assembly Version 1.0.0.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2017-Sep-05 02:59:40
Version 0.0
SizeofData 284
AddressOfRawData 0xe6e0
PointerToRawData 0xc8e0
Referenced File C:\Data\BAD\badcode\ConsoleApplication1\ConsoleApplication2\obj\Debug\ConsoleApplication2.pdb

TLS Callbacks

Load Configuration

Errors