Suspicious
Suspect

147d374cbef4dbf6eb75da016137199f

PE Executable
|
MD5: 147d374cbef4dbf6eb75da016137199f
|
Size: 999.94 KB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
Hash Value
MD5
147d374cbef4dbf6eb75da016137199f
Sha1
3c8f1bf657741a3f7c266efa0aadc630b346bd61
Sha256
2fa2803f39b96585fa885f4cf470206766b3306cb04ec06e13e4fab14dec3ecf
Sha384
7efd0c53962fa15b469cbd8d035ecbbc8f980ca382141b893a4562d6f289eab4defbbe9755241d5e3962d2b7baa30b09
Sha512
2176fa2c775949070802f587bfc0baed90f80211c0e527dc083f5c7ac05354bc1c8c859cafea4084cc89e4350021b74555dd6f744bdb9b90635de9b3af189c47
SSDeep
24576:EcD/f9Vg2kd/Q/K3t6S1FwB9oNX4ujA9KTpGFZOvWbmXns89YqyVHU:E49VZotHFwB9oNX4uMKTp+ZOOJ8UVH
TLSH
C22533148C434790D212FD77AEBF2490563172F254A4FCECF96B35960BB528CBA852BB

PeID

Microsoft Visual C++ DLL
Microsoft Visual C++ v6.0
File Structure
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ddqcljwrd.Properties.Resources.resources
Lzwgj
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

Qaezazudqio.exe

Full Name

Qaezazudqio.exe

EntryPoint

System.Void Ddqcljwrd.Collections.TransformableQueue::PrepareQueue()

Scope Name

Qaezazudqio.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Qaezazudqio

Assembly Version

1.0.3727.25888

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

6

Main Method

System.Void Ddqcljwrd.Collections.TransformableQueue::PrepareQueue()

Main IL Instruction Count

38

Main IL

ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0082: ret newobj System.Void Ddqcljwrd.EventManagement.ListenerCompiler::.ctor() call System.Byte[] Ddqcljwrd.EventManagement.ListenerCompiler::CollectListener() stloc.s V_2 ldc.i4 0 ldsfld <Module>{8951999b-7c8f-4e84-981c-842e805af57c} <Module>{8951999b-7c8f-4e84-981c-842e805af57c}::m_eadf769e219d4460aee008b1e8ef9ccb ldfld System.Int32 <Module>{8951999b-7c8f-4e84-981c-842e805af57c}::m_e638d00b23ca4e6795d5fd760352e676 brtrue IL_0012: switch(IL_0082,IL_0057,IL_0083,IL_002C) pop <null> ldc.i4 2 br IL_0012: switch(IL_0082,IL_0057,IL_0083,IL_002C) newobj System.Void Ddqcljwrd.Collections.RunnerEvent::.ctor() ldloc.s V_1 call System.Void Ddqcljwrd.Collections.RunnerEvent::AddIterableDictionary(System.Byte[]) ldc.i4 0 ldsfld <Module>{8951999b-7c8f-4e84-981c-842e805af57c} <Module>{8951999b-7c8f-4e84-981c-842e805af57c}::m_eadf769e219d4460aee008b1e8ef9ccb ldfld System.Int32 <Module>{8951999b-7c8f-4e84-981c-842e805af57c}::m_7f0ebc4b288d42b39c2ffb2e728e5e53 brfalse IL_0012: switch(IL_0082,IL_0057,IL_0083,IL_002C) pop <null> ldc.i4 0 br IL_0012: switch(IL_0082,IL_0057,IL_0083,IL_002C) ret <null> newobj System.Void Qaezazudqio.Annotations.AnnotationViewer::.ctor() ldloc.s V_2 call System.Byte[] Qaezazudqio.Annotations.AnnotationViewer::TrackAnnotation(System.Byte[]) stloc.s V_1 ldc.i4 1 ldsfld <Module>{8951999b-7c8f-4e84-981c-842e805af57c} <Module>{8951999b-7c8f-4e84-981c-842e805af57c}::m_eadf769e219d4460aee008b1e8ef9ccb ldfld System.Int32 <Module>{8951999b-7c8f-4e84-981c-842e805af57c}::m_488df805de594847859f5b386c805e28 brtrue IL_0012: switch(IL_0082,IL_0057,IL_0083,IL_002C) pop <null> ldc.i4 1 br IL_0012: switch(IL_0082,IL_0057,IL_0083,IL_002C)

147d374cbef4dbf6eb75da016137199f (999.94 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙