General
Structural Analysis
Config.0
Yara Rules99+
Sync
Community
Summary by MalvaGPT
Characteristics
Symbol Ofbuscation Score
Low
|
Hash | Hash Value |
|---|---|
| MD5 | 052777dbde7d784903467ed572f7aad7
|
| Sha1 | 147fa62741511afd3ffb50de85b1d3b861ed90bb
|
| Sha256 | 0ab6c12a0a788f13ae0d3cd079dd2c07bc5c3ce8e561a38f3f87ab3f7d86ae0d
|
| Sha384 | faedef8769a3357270b08d62c5ea4ebfb08d6d38990bdaed5d7196cc02bc8ec823b8611b899f492be1473136775d3cd8
|
| Sha512 | 7cf3f72fbfd21b45710f8d4412e7dfecc621fb8f06071efe909bb6800b9514a7efaed289c4cb19c46a23fac33210a2da50e8cb31f4d2fc52ba6b61a037b0ee5a
|
| SSDeep | 12288:19T7l/7kqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabdLdlLUwi:19BkqjVnlqud+/2P+ATAS/JYellLUx
|
| TLSH | B5F4DF68B3F84A01F1FF5B7194B19951AB34B513A961E71E15C080CC1EB2B919F8AF3B
|
PeID
.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ v6.0 DLL
Microsoft Visual Studio .NET
File Structure
052777dbde7d784903467ed572f7aad7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Properties.Resources.resources
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.newtonsoft.json.dll.compressed
costura.newtonsoft.json.dll
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.dll.compressed
costura.icsharpcode.sharpziplib.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.system.diagnostics.diagnosticsource.dll.compressed
costura.system.diagnostics.diagnosticsource.dll
[Authenticode]_50c89911.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
Informations
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | PDB Path: ? |
| Module Name | stub.exe |
| Full Name | stub.exe |
| EntryPoint | System.Void Stub.Program::<Main>() |
| Scope Name | stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.8 |
| Total Strings | 3155 |
| Main Method | System.Void Stub.Program::<Main>() |
| Main IL Instruction Count | 6 |
| Main IL | call System.Threading.Tasks.Task Stub.Program::Main() callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null> |
| Module Name | stub.exe |
| Full Name | stub.exe |
| EntryPoint | System.Void Stub.Program::<Main>() |
| Scope Name | stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.8 |
| Total Strings | 3155 |
| Main Method | System.Void Stub.Program::<Main>() |
| Main IL Instruction Count | 6 |
| Main IL | call System.Threading.Tasks.Task Stub.Program::Main() callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null> |
052777dbde7d784903467ed572f7aad7 (749.57 KB)
File Structure
052777dbde7d784903467ed572f7aad7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Properties.Resources.resources
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.newtonsoft.json.dll.compressed
costura.newtonsoft.json.dll
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.dll.compressed
costura.icsharpcode.sharpziplib.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.system.diagnostics.diagnosticsource.dll.compressed
costura.system.diagnostics.diagnosticsource.dll
[Authenticode]_50c89911.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
You need a premium account to access this feature.
You must be signed in to post a comment.