Suspicious
Suspect

Orden de compra n.ø 2025-835436899DWSA[...]kb).com

PE Executable
|
MD5: 11e87a8ca0acfc2b0eed43978bfef395
|
Size: 1.38 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
Hash Value
MD5
11e87a8ca0acfc2b0eed43978bfef395
Sha1
bac4073f814540a27518965bb0768787d83d2b9a
Sha256
7ab3bc53197f4ab531bf0f24e2ad22f1f199a6f3225099506a49d57f03868dbe
Sha384
2968d16051dab2a2cda4912f4de5c70f4e7a787e5e8a0a5067e0f44e0381457ec4a27e557d054a5576633b0a9e158410
Sha512
728c4a22890b22f68aaac9d3a53d77e8003d81cf38efb0bbaf0c224f19bab4173aadfb73c6bfa1a7d33affe0b22edc45b9f616b549330fa0078db77e1ed60359
SSDeep
24576:zdZZzdCJvkYzllNkPbdb9tV2CCCnRveYepqMKDmfC4KOSSn2X6W:zvZzdizzjepb96kRveYkqM3fC41p2
TLSH
6455F12A23E94A14F1FF4B397A7805540BF0FD2B9A31EA6E6A5241DD4E60F44ED21373

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
im6LK4go5.g.resources
im6LK4go5.Resources.resources
930ab182bb61d6.Resources.resources
b367c5290
[NBF]root.Data
b367c5291
[NBF]root.Data
b367c52910
[NBF]root.Data
b367c52911
[NBF]root.Data
b367c52912
[NBF]root.Data
b367c52913
[NBF]root.Data
b367c52914
[NBF]root.Data
b367c52915
[NBF]root.Data
b367c52916
[NBF]root.Data
b367c52917
[NBF]root.Data
b367c52918
[NBF]root.Data
b367c52919
[NBF]root.Data
b367c5292
[NBF]root.Data
b367c52920
[NBF]root.Data
b367c52921
[NBF]root.Data
b367c52922
[NBF]root.Data
b367c52923
[NBF]root.Data
b367c52924
[NBF]root.Data
b367c52925
[NBF]root.Data
b367c52926
[NBF]root.Data
b367c52927
[NBF]root.Data
b367c52928
[NBF]root.Data
b367c52929
[NBF]root.Data
b367c5293
[NBF]root.Data
b367c52930
[NBF]root.Data
b367c52931
[NBF]root.Data
b367c52932
[NBF]root.Data
b367c52933
[NBF]root.Data
b367c52934
[NBF]root.Data
b367c52935
[NBF]root.Data
b367c52936
[NBF]root.Data
b367c52937
[NBF]root.Data
b367c52938
[NBF]root.Data
b367c52939
[NBF]root.Data
b367c5294
[NBF]root.Data
b367c52940
[NBF]root.Data
b367c52941
[NBF]root.Data
b367c5295
[NBF]root.Data
b367c5296
[NBF]root.Data
b367c5297
[NBF]root.Data
b367c5298
[NBF]root.Data
b367c5299
[NBF]root.Data
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

im6LK4go5

Full Name

im6LK4go5

EntryPoint

System.Void im6LK4go5.Efe3xx0M6tB/Ax1qm5.Xqy3p7::bw3GR1cjmnL2Hq()

Scope Name

im6LK4go5

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

im6LK4go5

Assembly Version

27.29.30.206

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1195

Main Method

System.Void im6LK4go5.Efe3xx0M6tB/Ax1qm5.Xqy3p7::bw3GR1cjmnL2Hq()

Main IL Instruction Count

39

Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.0 <null> ldloc.0 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) stloc.3 <null> ldloc.3 <null> brfalse.s IL_0027: ldc.i4.s 100 ldstr 1.6.4.9 stloc.0 <null> ldc.i4.s 100 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr AppConfig.dat call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> newobj System.Void im6LK4go5.5Lt_Ri::.ctor() stloc.2 <null> ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> leave.s IL_0067: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0067: nop nop <null> ret <null>

Module Name

im6LK4go5

Full Name

im6LK4go5

EntryPoint

System.Void im6LK4go5.Efe3xx0M6tB/Ax1qm5.Xqy3p7::bw3GR1cjmnL2Hq()

Scope Name

im6LK4go5

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

im6LK4go5

Assembly Version

27.29.30.206

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1195

Main Method

System.Void im6LK4go5.Efe3xx0M6tB/Ax1qm5.Xqy3p7::bw3GR1cjmnL2Hq()

Main IL Instruction Count

39

Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.0 <null> ldloc.0 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) stloc.3 <null> ldloc.3 <null> brfalse.s IL_0027: ldc.i4.s 100 ldstr 1.6.4.9 stloc.0 <null> ldc.i4.s 100 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr AppConfig.dat call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> newobj System.Void im6LK4go5.5Lt_Ri::.ctor() stloc.2 <null> ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> leave.s IL_0067: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0067: nop nop <null> ret <null>

Orden de compra n.ø 2025-835436899DWSA.xlsx(65kb).com (1.38 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
im6LK4go5.g.resources
im6LK4go5.Resources.resources
930ab182bb61d6.Resources.resources
b367c5290
[NBF]root.Data
b367c5291
[NBF]root.Data
b367c52910
[NBF]root.Data
b367c52911
[NBF]root.Data
b367c52912
[NBF]root.Data
b367c52913
[NBF]root.Data
b367c52914
[NBF]root.Data
b367c52915
[NBF]root.Data
b367c52916
[NBF]root.Data
b367c52917
[NBF]root.Data
b367c52918
[NBF]root.Data
b367c52919
[NBF]root.Data
b367c5292
[NBF]root.Data
b367c52920
[NBF]root.Data
b367c52921
[NBF]root.Data
b367c52922
[NBF]root.Data
b367c52923
[NBF]root.Data
b367c52924
[NBF]root.Data
b367c52925
[NBF]root.Data
b367c52926
[NBF]root.Data
b367c52927
[NBF]root.Data
b367c52928
[NBF]root.Data
b367c52929
[NBF]root.Data
b367c5293
[NBF]root.Data
b367c52930
[NBF]root.Data
b367c52931
[NBF]root.Data
b367c52932
[NBF]root.Data
b367c52933
[NBF]root.Data
b367c52934
[NBF]root.Data
b367c52935
[NBF]root.Data
b367c52936
[NBF]root.Data
b367c52937
[NBF]root.Data
b367c52938
[NBF]root.Data
b367c52939
[NBF]root.Data
b367c5294
[NBF]root.Data
b367c52940
[NBF]root.Data
b367c52941
[NBF]root.Data
b367c5295
[NBF]root.Data
b367c5296
[NBF]root.Data
b367c5297
[NBF]root.Data
b367c5298
[NBF]root.Data
b367c5299
[NBF]root.Data
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙