Suspicious
Suspect

17810f72e40767287a21474d046a327a

PE Executable
|
MD5: 17810f72e40767287a21474d046a327a
|
Size: 50.18 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
17810f72e40767287a21474d046a327a
Sha1
070a743f1628bc273e7a58a012db2c706ff463d0
Sha256
31a41ec300e4c59521f0e3dd55191a602e20594eeac4c6c7d3c7022a90691cd2
Sha384
e71fb25d9eac59656f50a5db4ac75e80d1690ce434adbf98880aa5bb8ee1d659490cc80d797a76324d5b5d92609faf36
Sha512
b65d7f06f2af849595fb323b11956a5a803570b3b2b2867fbb89dfb843ab1a00235b1bd525b4f4fac5a9b9f74a6abba125639796394e6e4bcb3a07200fd1d63c
SSDeep
768:xRu5Fgi4inumVNz917J7URzU3FPu/H0ryyapqoo1Pc1/ZnEzwKllCV:7Euipj3UW14HUBwLog/a8KI
TLSH
0233490CEBCDAA72CAAC4ABFD8F2B6904B79C0F5E747E307248419150A177DB5801E97

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
17810f72e40767287a21474d046a327a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
{c65a834f-4679-4d52-9131-971b109a65c6}
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Nqztwc
Full Name

Nqztwc
EntryPoint

System.Void .::()
Scope Name

Nqztwc
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Nqztwc
Assembly Version

1.0.5001.19242
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

79
Main Method

System.Void .::()
Main IL Instruction Count

91
Main IL

nop <null> ldc.i4.1 <null> brfalse.s IL_0046: newobj System.Void .::.ctor() ldc.i4 4032 ldc.i4.2 <null> brtrue IL_00CB: call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) pop <null> nop <null> ldstr 1.4.1 br IL_00D5: newobj System.Void System.Version::.ctor(System.String) br IL_00DF: stloc.0 ldc.i4.0 <null> brtrue.s IL_0000: nop ldc.i4.0 <null> brtrue.s IL_0011: ldstr "1.4.1" ldnull <null> br IL_00E5: ldloc.0 br IL_00EB: newobj System.Void .::.ctor(System.String,System.Version) br IL_00F5: stloc.1 br IL_00FB: newobj System.Void .::.ctor() br IL_0105: stloc.2 br IL_010B: newobj System.Void .::.ctor() stloc.3 <null> newobj System.Void .::.ctor() stloc.s V_4 ldloc.2 <null> ldloc.3 <null> ldloc.s V_4 newobj System.Void .::.ctor(.,.,.) stloc.s V_5 nop <null> ldloc.1 <null> ldloc.s V_5 ldftn System.Void .::(System.Object,.) newobj System.Void System.EventHandler`1<.>::.ctor(System.Object,System.IntPtr) callvirt System.Void .::(System.EventHandler`1<.>) nop <null> ldloc.2 <null> ldloc.s V_5 ldftn System.Void .::(System.Object,.) newobj System.Void System.EventHandler`1<.>::.ctor(System.Object,System.IntPtr) callvirt System.Void .::(System.EventHandler`1<.>) nop <null> ldloc.3 <null> ldloc.s V_5 ldftn System.Void .::(System.Object,.) newobj System.Void System.EventHandler`1<.>::.ctor(System.Object,System.IntPtr) callvirt System.Void .::(System.EventHandler`1<.>) nop <null> ldloc.s V_4 ldloc.s V_5 ldftn System.Void .::(System.Object,.) newobj System.Void System.EventHandler`1<.>::.ctor(System.Object,System.IntPtr) callvirt System.Void .::(System.EventHandler`1<.>) nop <null> ldloc.1 <null> call System.Void .::(.) ldc.i4.8 <null> brfalse.s IL_0095: ldloc.s V_4 nop <null> nop <null> ldc.i4.2 <null> brfalse.s IL_0095: ldloc.s V_4 leave.s IL_00CA: ret ldloc.s V_5 brfalse.s IL_00C9: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() ldc.i4.0 <null> brtrue.s IL_00BE: ldloc.s V_5 nop <null> endfinally <null> ret <null> call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) br IL_0010: nop newobj System.Void System.Version::.ctor(System.String) br IL_001B: br IL_00DF stloc.0 <null> br IL_0020: ldc.i4.0 ldloc.0 <null> br IL_002C: br IL_00EB newobj System.Void .::.ctor(System.String,System.Version) br IL_0031: br IL_00F5 stloc.1 <null> br IL_0036: br IL_00FB newobj System.Void .::.ctor() br IL_003B: br IL_0105 stloc.2 <null> br IL_0040: br IL_010B newobj System.Void .::.ctor() br IL_0045: stloc.3
Module Name

Nqztwc
Full Name

Nqztwc
EntryPoint

System.Void .::()
Scope Name

Nqztwc
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Nqztwc
Assembly Version

1.0.5001.19242
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

79
Main Method

System.Void .::()
Main IL Instruction Count

91
Main IL

nop <null> ldc.i4.1 <null> brfalse.s IL_0046: newobj System.Void .::.ctor() ldc.i4 4032 ldc.i4.2 <null> brtrue IL_00CB: call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) pop <null> nop <null> ldstr 1.4.1 br IL_00D5: newobj System.Void System.Version::.ctor(System.String) br IL_00DF: stloc.0 ldc.i4.0 <null> brtrue.s IL_0000: nop ldc.i4.0 <null> brtrue.s IL_0011: ldstr "1.4.1" ldnull <null> br IL_00E5: ldloc.0 br IL_00EB: newobj System.Void .::.ctor(System.String,System.Version) br IL_00F5: stloc.1 br IL_00FB: newobj System.Void .::.ctor() br IL_0105: stloc.2 br IL_010B: newobj System.Void .::.ctor() stloc.3 <null> newobj System.Void .::.ctor() stloc.s V_4 ldloc.2 <null> ldloc.3 <null> ldloc.s V_4 newobj System.Void .::.ctor(.,.,.) stloc.s V_5 nop <null> ldloc.1 <null> ldloc.s V_5 ldftn System.Void .::(System.Object,.) newobj System.Void System.EventHandler`1<.>::.ctor(System.Object,System.IntPtr) callvirt System.Void .::(System.EventHandler`1<.>) nop <null> ldloc.2 <null> ldloc.s V_5 ldftn System.Void .::(System.Object,.) newobj System.Void System.EventHandler`1<.>::.ctor(System.Object,System.IntPtr) callvirt System.Void .::(System.EventHandler`1<.>) nop <null> ldloc.3 <null> ldloc.s V_5 ldftn System.Void .::(System.Object,.) newobj System.Void System.EventHandler`1<.>::.ctor(System.Object,System.IntPtr) callvirt System.Void .::(System.EventHandler`1<.>) nop <null> ldloc.s V_4 ldloc.s V_5 ldftn System.Void .::(System.Object,.) newobj System.Void System.EventHandler`1<.>::.ctor(System.Object,System.IntPtr) callvirt System.Void .::(System.EventHandler`1<.>) nop <null> ldloc.1 <null> call System.Void .::(.) ldc.i4.8 <null> brfalse.s IL_0095: ldloc.s V_4 nop <null> nop <null> ldc.i4.2 <null> brfalse.s IL_0095: ldloc.s V_4 leave.s IL_00CA: ret ldloc.s V_5 brfalse.s IL_00C9: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() ldc.i4.0 <null> brtrue.s IL_00BE: ldloc.s V_5 nop <null> endfinally <null> ret <null> call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) br IL_0010: nop newobj System.Void System.Version::.ctor(System.String) br IL_001B: br IL_00DF stloc.0 <null> br IL_0020: ldc.i4.0 ldloc.0 <null> br IL_002C: br IL_00EB newobj System.Void .::.ctor(System.String,System.Version) br IL_0031: br IL_00F5 stloc.1 <null> br IL_0036: br IL_00FB newobj System.Void .::.ctor() br IL_003B: br IL_0105 stloc.2 <null> br IL_0040: br IL_010B newobj System.Void .::.ctor() br IL_0045: stloc.3
17810f72e40767287a21474d046a327a (50.18 KB)
File Structure
17810f72e40767287a21474d046a327a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
{c65a834f-4679-4d52-9131-971b109a65c6}
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙