6a9a99f210af867e852143e6a83189c9cc438deb43c3b11db5a0c3fe8ec7c2b4

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Sep-08 16:22:02
FileDescription
FileVersion 0.0.0.0
InternalName FlowrDeploymentTool.exe
LegalCopyright
OriginalFilename FlowrDeploymentTool.exe
ProductVersion 0.0.0.0
Assembly Version 0.0.0.0

Plugin Output

Info Matching compiler(s): Microsoft Visual C# v7.0 / Basic .NET
Suspicious Strings found in the binary may indicate undesirable behavior: Contains references to security software:
  • rshell.exe
 Contains domain names:
  • 377fc.azurewebsites.windows.net
  • asp-flowr-twelv-377fc.azurewebsites.windows.net
  • azure.net
  • azurewebsites.net
  • azurewebsites.windows.net
  • flowr-twelv-377fc.azurewebsites.windows.net
  • functionAppName.scm.azurewebsites.net
  • github.com
  • http://ipinfo.io
  • https://github.com
  • keyVaultName.vault.azure.net
  • scm.azurewebsites.net
  • twelv-377fc.azurewebsites.windows.net
  • vault.azure.net
  • windows.net
Info The PE is digitally signed. Signer: Encodian Solutions Ltd
Issuer: GlobalSign GCC R45 CodeSigning CA 2020
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 31f7fccf46c8245e8ac2cdeca23354fc 🔍
SHA1 6874624548d4917af984ad8a5912d4f2b7843b7c 🔍
SHA256 6a9a99f210af867e852143e6a83189c9cc438deb43c3b11db5a0c3fe8ec7c2b4 🔍
SHA3 cec66a79e284563fc8a9fe3557e6132921a7f6c68e37b66449aebea9fbd081d0 🔍
SSDeep 768:hwF9TdvfmRiS8b1S2ZEGlBVI5bolJnI4qXkfsdfR2Iv1zbJhKQ2HLNTRNprA+hLi:hwF9BORiS85lBV+lD3fK5pnQ 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2026-Sep-08 16:22:02
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 11.0
SizeOfCode 0x14400
SizeOfInitializedData 0x1800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x000163AE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x18000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0x1c000
SizeOfHeaders 0x200
Checksum 0x1ddbb
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 4f9a53a9c67ebaa55d41ec1381ba02d5 🔍
SHA1 52d3084f00547f37d508a86a6b55be5f944ac255 🔍
SHA256 36672a9de125442749fe9bc2a0320f6a679aa1f8060167880e62f525c9823a1c 🔍
SHA3 7ff18ddc4faaa86e0e5ace68e7a522d90c2cc5b8cf7bb907abec4ff86115846a 🔍
VirtualSize 0x143b4
VirtualAddress 0x2000
SizeOfRawData 0x14400
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.55457

.rsrc

MD5 5c92d59fb6c8e834577357c00ab30539 🔍
SHA1 f32aba997e7b032629ac6941eacede8d82011666 🔍
SHA256 10249a8723e9c72897905feacf5b00c9219c77b0dd18d708f6cf33bd4203d4d0 🔍
SHA3 b99b41474c857bf9a8df4676e5575a1d8e5e1dba286652106b00e237b3387f7e 🔍
VirtualSize 0x1600
VirtualAddress 0x18000
SizeOfRawData 0x1600
PointerToRawData 0x14600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.46713

.reloc

MD5 56e369620aa30be8c16309a25502a588 🔍
SHA1 cb71de04684e56aec5c178d58ea2274c1ec9b11c 🔍
SHA256 3071bcc0f2be1e936ef3239faa2401cb9e790b91f1a4676637bd8cfd8a96b23c 🔍
SHA3 05a92396372b0421d74c9fb408d4c83102725a5013f1ee164f0e51d3dbac85f9 🔍
VirtualSize 0xc
VirtualAddress 0x1a000
SizeOfRawData 0x200
PointerToRawData 0x15c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.10191

Imports

mscoree.dll _CorExeMain

Delayed Imports

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.81059
MD5 b0e88276420544c59f0543e29c592a03 🔍
SHA1 b9b256cfffe444ff0658e52c6ec74e81527b8382 🔍
SHA256 445268617df6b8130e5ddcf146e4f3c893a0601f4d98bdf44f5120ea34d4f1a3 🔍
SHA3 0fbf8ff3794c999d349279c28282a3a117e3d57f754fc18b7a68d1328807cc60 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.94375
Detected Filetype Icon file
MD5 d3bdbb19efa0630f837601a23f30ff3d 🔍
SHA1 f9513900fbb276100e1fcb1b798616c0ae0d4bc6 🔍
SHA256 852391035320228f8de3412c040f63d082abc6cc8ab8d715d1d5a92c243cbd97 🔍
SHA3 d64b14bf272ad71e0c7853722283bb1c1c821b983a886b63a7999ba1060420b6 🔍

1

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x274
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.18454
MD5 2eec44e69c8294548853b267d0e11aad 🔍
SHA1 cbad5922499fc143fe052564eab86a09488fdd7c 🔍
SHA256 2a713820b5f42a3133aa58209b9cbdcd2e0859fd1a65d9b582c86176dc9b0c86 🔍
SHA3 96e93c56fc0d3f574050ee59b9131d2deffdd009611b405eb0510ee6f6494205 🔍

1 (#2)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x193
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.9886
MD5 19d70dfcdeb812833de7ba67472845d5 🔍
SHA1 e8f6ebb0080572042c7cf97a8a3911e1aec364ad 🔍
SHA256 6a6690c7e7400672941c6ed0cdde6f5119e5bf49956706bea9d4a442b1213d7d 🔍
SHA3 2f85c1eb489631f2bf6527b77f95783569bcc288c4d1fbcdd6cb2ee7e7c68ab4 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 0.0.0.0
ProductVersion 0.0.0.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
FileDescription
FileVersion (#2) 0.0.0.0
InternalName FlowrDeploymentTool.exe
LegalCopyright
OriginalFilename FlowrDeploymentTool.exe
ProductVersion (#2) 0.0.0.0
Assembly Version 0.0.0.0
Resource LangID UNKNOWN

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.