

--------------------------------------------------------------------------------
File Information (time: 0:00:02.678551)
--------------------------------------------------------------------------------
filename         2sample01.exe
filetype         PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Wi
filesize         1023488
hash sha256      20c8a88fe7f680a0cdaf61fafbc9e6dcaf626f326c5392b4d2660fec9adc2bf1
virustotal       /
imagebase        0x400000
entrypoint       0xfb4be
imphash          f34d5f2d4577ed6d9ceec516c1f5a744
datetime         2022-03-30 17:07:30
dll              False
directories      import, tls, resources, relocations
sections         .text, .rsrc, .reloc
features         packer, crypto


--------------------------------------------------------------------------------
Yara Plugins
--------------------------------------------------------------------------------
IsPE32
IsNET EXE
IsWindowsGUI
CRC32 poly Constant


--------------------------------------------------------------------------------
Behavior
--------------------------------------------------------------------------------
Xor
screenshot


--------------------------------------------------------------------------------
Crypto
--------------------------------------------------------------------------------
CRC32 poly Constant


--------------------------------------------------------------------------------
Packer
--------------------------------------------------------------------------------
Microsoft Visual Studio NET
Microsoft Visual C v70 Basic NET additional
Microsoft Visual C Basic NET
Microsoft Visual Studio NET additional
Microsoft Visual C v70 Basic NET
NET executable 
NET executable


--------------------------------------------------------------------------------
Sections Suspicious
--------------------------------------------------------------------------------
For each section the value of entropy is less than 6


--------------------------------------------------------------------------------
Metadata
--------------------------------------------------------------------------------
ProductName      qn
CompanyName      jeSvDsIhjDbsclmYjqSeAuLZOt
InternalName     nkyBP6HbWUkCav5HaMO.exe
LegalCopyright   j4kMsHV
Comments         KQ2op9T8KBihf4rD9YljFYsN9R
OriginalFilename 39SZHaPfFwIese77ogpocwfNMZg.exe
ProductVersion   411.749.97.890
FileVersion      633.991.850.958


--------------------------------------------------------------------------------
Import function
--------------------------------------------------------------------------------
mscoree.dll      1


--------------------------------------------------------------------------------
File
--------------------------------------------------------------------------------
gdi32.dll        Library
kernel32.dll     Library
user32.dll       Library
winmm.dll        Library
mscoree.dll      Library
