Suspicious
Suspect

1073c20c06b4a9a1bedced0afff46058

PE Executable
|
MD5: 1073c20c06b4a9a1bedced0afff46058
|
Size: 433.66 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Medium

Hash
 Hash Value
MD5
1073c20c06b4a9a1bedced0afff46058
Sha1
663b81e5d344d68c0d028193e947c3e1a1b81b5a
Sha256
dfdd4cdf6dd89b4c50a2ad96be9f2aa4c6e1c08ae50eb1de8169827555b0ef89
Sha384
2322bac03ff8384f1389b5e841231df0cd31290a7cbe7b4877c64c4b9204a639ee67f6780932581152e3a770b51c3284
Sha512
4abafff79b45c74e73fe33df4a5202aa5fd8ec9be8f0f53396fb7441d2dccec25a415b1f76e05affd7022a092a620c179b1ee1a6ee168fc1839aace077636663
SSDeep
6144:rR76amUMYsqooXDvngI9WzeGReGrWzLaW6gM/d:rRua+YnpTYI9WyzLv6g8
TLSH
C79439A29F5B6E18E5D1A3F8A2253AD4E896BE351BF5D1FCAC2074145B3D361F0CE011

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
1073c20c06b4a9a1bedced0afff46058
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:000A
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

PDB Path: d:\ProjectMain\AutoCryptor\AutoCryptor\bin\Release\net8.0\GeneratedProject_c68acfe2\obj\x86\Release\HL7l8qUj0f.pdb
Module Name

HL7l8qUj0f.exe
Full Name

HL7l8qUj0f.exe
EntryPoint

System.Void PmJyv7gKoV.Program::Main(System.String[])
Scope Name

HL7l8qUj0f.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

HL7l8qUj0f
Assembly Version

6.4.6.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

6
Main Method

System.Void PmJyv7gKoV.Program::Main(System.String[])
Main IL Instruction Count

50
Main IL

newobj System.Void System.Random::.ctor() stloc.0 <null> ldloc.0 <null> ldc.i4 3000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean PmJyv7gKoV.Program::CheckRegion() brtrue.s IL_002E: ldc.i4 1000 ldstr Region check failed call System.Void System.Console::WriteLine(System.String) leave.s IL_00A3: ret ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Byte[] PmJyv7gKoV.Program::PYoJKWOCHiw51F() stloc.1 <null> ldloc.1 <null> brfalse.s IL_0046: ldstr "Decryption failed" ldloc.1 <null> ldlen <null> conv.i4 <null> brtrue.s IL_0052: call System.String System.IO.Path::GetTempPath() ldstr Decryption failed call System.Void System.Console::WriteLine(System.String) leave.s IL_00A3: ret call System.String System.IO.Path::GetTempPath() call System.Guid System.Guid::NewGuid() stloc.s V_4 ldloca.s V_4 constrained. System.Guid callvirt System.String System.Object::ToString() ldstr .exe call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) ldloc.2 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> leave.s IL_00A3: ret stloc.3 <null> ldstr Error: ldloc.3 <null> callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_00A3: ret ret <null>
Module Name

HL7l8qUj0f.exe
Full Name

HL7l8qUj0f.exe
EntryPoint

System.Void PmJyv7gKoV.Program::Main(System.String[])
Scope Name

HL7l8qUj0f.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

HL7l8qUj0f
Assembly Version

6.4.6.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

6
Main Method

System.Void PmJyv7gKoV.Program::Main(System.String[])
Main IL Instruction Count

50
Main IL

newobj System.Void System.Random::.ctor() stloc.0 <null> ldloc.0 <null> ldc.i4 3000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean PmJyv7gKoV.Program::CheckRegion() brtrue.s IL_002E: ldc.i4 1000 ldstr Region check failed call System.Void System.Console::WriteLine(System.String) leave.s IL_00A3: ret ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Byte[] PmJyv7gKoV.Program::PYoJKWOCHiw51F() stloc.1 <null> ldloc.1 <null> brfalse.s IL_0046: ldstr "Decryption failed" ldloc.1 <null> ldlen <null> conv.i4 <null> brtrue.s IL_0052: call System.String System.IO.Path::GetTempPath() ldstr Decryption failed call System.Void System.Console::WriteLine(System.String) leave.s IL_00A3: ret call System.String System.IO.Path::GetTempPath() call System.Guid System.Guid::NewGuid() stloc.s V_4 ldloca.s V_4 constrained. System.Guid callvirt System.String System.Object::ToString() ldstr .exe call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) ldloc.2 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> leave.s IL_00A3: ret stloc.3 <null> ldstr Error: ldloc.3 <null> callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_00A3: ret ret <null>
1073c20c06b4a9a1bedced0afff46058 (433.66 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙