Suspicious
Suspect

008faa9f108e02c3303b7c6c5e2304c9

PE Executable
|
MD5: 008faa9f108e02c3303b7c6c5e2304c9
|
Size: 3.29 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
008faa9f108e02c3303b7c6c5e2304c9
Sha1
640f5c61e5acf83af17ae14a4899b940f313a26c
Sha256
edde1d6eb14cff85edf21df06743d2d800dd5b495721642d054d23a9a5aa1142
Sha384
43899eaabf9ef8d356e5dcd6f29de3a8171e37fc2901061618392dbc8565d0a34950a5870b234dde831f6f09b52b78be
Sha512
d60bdd2f97e6fa220b88ddea41987b1db450d094771ed9a39c399421830faea062c66aa77b4e15591ee505fffc3a9e56c23f2361c54eb1157f9b1db20222eb88
SSDeep
49152:Ni4/6vVlWdVWp4S4f9ESpHMj+mHpl+2fbITHHB72eh2NT:Ni4C9p4S4f9ESpsjl
TLSH
EDE56C5033F89E23E5AFE67295B1841263F1FC2AF3A3EB5B5481A37A1C43B5049417A7

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
008faa9f108e02c3303b7c6c5e2304c9
[Rebuild from dump]_6145e715.exe
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
Informations
Name
 Value
Info

PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info

Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_6145e715.exe
Module Name

Client
Full Name

Client
EntryPoint

System.Void ᐬ鯉≪묑鸩쬇ぇꪭ擄쥿ᣍက暶�袆몶藜⽚鍋쨿::Main(System.String[])
Scope Name

Client
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.4.1.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5.2
Total Strings

11130
Main Method

System.Void ᐬ鯉≪묑鸩쬇ぇꪭ擄쥿ᣍက暶�袆몶藜⽚鍋쨿::Main(System.String[])
Main IL Instruction Count

55
Main IL

ldstr payload.txt call System.Boolean System.IO.File::Exists(System.String) brtrue.s IL_0025: ldstr "payload.txt" ldstr Configuração não encontrada. ldstr Erro ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldstr payload.txt call System.String System.IO.File::ReadAllText(System.String) callvirt System.String System.String::Trim() call System.String ᐬ鯉≪묑鸩쬇ぇꪭ擄쥿ᣍက暶�袆몶藜⽚鍋쨿::䀚螄婏窘솘⁽䶳䂫ዢ匠樊졚镝䪽ᑀ퐧䃵헿饹師(System.String) call System.Byte[] System.Convert::FromBase64String(System.String) call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() stloc.0 <null> ldloc.0 <null> ldnull <null> call System.Boolean System.Reflection.MethodInfo::op_Inequality(System.Reflection.MethodInfo,System.Reflection.MethodInfo) brfalse.s IL_0064: leave.s IL_00A2 ldloc.0 <null> ldnull <null> ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldarg.0 <null> stelem.ref <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_00A2: ret stloc.1 <null> ldstr error.log call System.DateTime System.DateTime::get_Now() stloc.2 <null> ldloca.s V_2 call System.String System.DateTime::ToString() ldstr : ldloc.1 <null> dup <null> brtrue.s IL_0086: callvirt System.String System.Object::ToString() pop <null> ldnull <null> br.s IL_008B: ldstr "\r\n" callvirt System.String System.Object::ToString() ldstr call System.String System.String::Concat(System.String,System.String,System.String,System.String) call System.Void System.IO.File::AppendAllText(System.String,System.String) ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave.s IL_00A2: ret ret <null>
Module Name

Client
Full Name

Client
EntryPoint

System.Void ᐬ鯉≪묑鸩쬇ぇꪭ擄쥿ᣍက暶�袆몶藜⽚鍋쨿::Main(System.String[])
Scope Name

Client
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.4.1.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5.2
Total Strings

11130
Main Method

System.Void ᐬ鯉≪묑鸩쬇ぇꪭ擄쥿ᣍက暶�袆몶藜⽚鍋쨿::Main(System.String[])
Main IL Instruction Count

55
Main IL

ldstr payload.txt call System.Boolean System.IO.File::Exists(System.String) brtrue.s IL_0025: ldstr "payload.txt" ldstr Configuração não encontrada. ldstr Erro ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldstr payload.txt call System.String System.IO.File::ReadAllText(System.String) callvirt System.String System.String::Trim() call System.String ᐬ鯉≪묑鸩쬇ぇꪭ擄쥿ᣍက暶�袆몶藜⽚鍋쨿::䀚螄婏窘솘⁽䶳䂫ዢ匠樊졚镝䪽ᑀ퐧䃵헿饹師(System.String) call System.Byte[] System.Convert::FromBase64String(System.String) call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() stloc.0 <null> ldloc.0 <null> ldnull <null> call System.Boolean System.Reflection.MethodInfo::op_Inequality(System.Reflection.MethodInfo,System.Reflection.MethodInfo) brfalse.s IL_0064: leave.s IL_00A2 ldloc.0 <null> ldnull <null> ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldarg.0 <null> stelem.ref <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_00A2: ret stloc.1 <null> ldstr error.log call System.DateTime System.DateTime::get_Now() stloc.2 <null> ldloca.s V_2 call System.String System.DateTime::ToString() ldstr : ldloc.1 <null> dup <null> brtrue.s IL_0086: callvirt System.String System.Object::ToString() pop <null> ldnull <null> br.s IL_008B: ldstr "\r\n" callvirt System.String System.Object::ToString() ldstr call System.String System.String::Concat(System.String,System.String,System.String,System.String) call System.Void System.IO.File::AppendAllText(System.String,System.String) ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave.s IL_00A2: ret ret <null>
Artefacts
Name
 Value
PE Layout

MemoryMapped (process dump suspected)
PE Layout

MemoryMapped (process dump suspected)
008faa9f108e02c3303b7c6c5e2304c9 (3.29 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙