Suspicious
Suspect

17afe5f7aada2875c7f719faae2e1a2d

PE Executable
|
MD5: 17afe5f7aada2875c7f719faae2e1a2d
|
Size: 939.01 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
Hash Value
MD5
17afe5f7aada2875c7f719faae2e1a2d
Sha1
de726a13d0692b1cdb60e640c5f70a58918ab2f2
Sha256
d38fa4b7893995e5fc7e6d45024ffe0202b92769a4955cec29dc3bdb35d3c8ba
Sha384
4cec83ecc42f4681b0b9bcde5a117c67d5219a18871df808fce39ee479e099c928fc6365beabdf224e32d251e5f09dc4
Sha512
ef4ed2f55bfb5023a17fca6b64fa77517a5d0422d72e20c5b9f7c1362cee1245094de6d9c1067c8c3cdf9a3358c6780cb5f7f7226159438a09163dcf84abcb7f
SSDeep
12288:KeeZoL367f+BPfPG/1RR4dd0f3o5KpT/bG3K6zJtYSYLNSE/Je:KvZoLKDePKFx45yT/bG3K6XYLNSE
TLSH
8D157CF13AD9122DE5BFBB384C71092C5BFBEC5BC621C65E2C43309A5C21F899915B86

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
2Aprs9.Resources.resources
d0e5184099d727.Resources.resources
c7ee8fe40
[NBF]root.Data
c7ee8fe41
[NBF]root.Data
c7ee8fe410
[NBF]root.Data
c7ee8fe411
[NBF]root.Data
c7ee8fe412
[NBF]root.Data
c7ee8fe413
[NBF]root.Data
c7ee8fe414
[NBF]root.Data
c7ee8fe415
[NBF]root.Data
c7ee8fe416
[NBF]root.Data
c7ee8fe417
[NBF]root.Data
c7ee8fe418
[NBF]root.Data
c7ee8fe419
[NBF]root.Data
c7ee8fe42
[NBF]root.Data
c7ee8fe420
[NBF]root.Data
c7ee8fe421
[NBF]root.Data
c7ee8fe43
[NBF]root.Data
c7ee8fe44
[NBF]root.Data
c7ee8fe45
[NBF]root.Data
c7ee8fe46
[NBF]root.Data
c7ee8fe47
[NBF]root.Data
c7ee8fe48
[NBF]root.Data
c7ee8fe49
[NBF]root.Data
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

2Aprs9

Full Name

2Aprs9

EntryPoint

System.Void 2Aprs9.2r_Fw::3Cjwt()

Scope Name

2Aprs9

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

2Aprs9

Assembly Version

21.22.15.63

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1600

Main Method

System.Void 2Aprs9.2r_Fw::3Cjwt()

Main IL Instruction Count

131

Main IL

nop <null> newobj System.Void System.Random::.ctor() stloc.0 <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.2 <null> nop <null> ldloc.0 <null> ldc.i4.s -10 ldc.i4.s 10 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) stloc.3 <null> ldloc.3 <null> ldc.i4.0 <null> cgt <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0050: nop ldstr System.AppDomain call System.Type System.Type::GetType(System.String) stloc.s V_5 ldloc.s V_5 ldstr CurrentDomain ldc.i4.s 24 callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String,System.Reflection.BindingFlags) stloc.s V_6 ldloc.s V_6 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.1 <null> br.s IL_006E: nop nop <null> ldstr System.Object call System.Type System.Type::GetType(System.String) stloc.s V_7 ldloc.s V_7 call System.Object System.Activator::CreateInstance(System.Type) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.1 <null> nop <null> nop <null> br.s IL_000D: nop nop <null> ldloc.1 <null> ldnull <null> ldstr Load ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> call System.Byte[] 2Aprs9.0DwzmdT2b5::tHw96fnNa7K() call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Reverse<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 brfalse.s IL_009B: ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6 ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 br.s IL_00B1: call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>) ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6 ldftn System.Byte 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::yKz1Xx(System.Byte,System.Int32) newobj System.Void System.Func`3<System.Byte,System.Int32,System.Byte>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldnull <null> ldstr GetTypes ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.s 24 box System.Int32 stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldnull <null> ldstr GetMethods ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) castclass System.Collections.IEnumerable callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator() stloc.s V_8 br.s IL_013B: ldloc.s V_8 ldloc.s V_8 callvirt System.Object System.Collections.IEnumerator::get_Current() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_9 nop <null> ldloc.s V_9 castclass System.Reflection.MethodInfo ldnull <null> ldc.i4.0 <null> newarr System.Object callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0139: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0139: nop nop <null> nop <null> ldloc.s V_8 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() stloc.s V_11 ldloc.s V_11 brtrue.s IL_0104: ldloc.s V_8 leave.s IL_0161: ret ldloc.s V_8 isinst System.IDisposable brfalse.s IL_0160: endfinally ldloc.s V_8 isinst System.IDisposable callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>

Module Name

2Aprs9

Full Name

2Aprs9

EntryPoint

System.Void 2Aprs9.2r_Fw::3Cjwt()

Scope Name

2Aprs9

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

2Aprs9

Assembly Version

21.22.15.63

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1600

Main Method

System.Void 2Aprs9.2r_Fw::3Cjwt()

Main IL Instruction Count

131

Main IL

nop <null> newobj System.Void System.Random::.ctor() stloc.0 <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.2 <null> nop <null> ldloc.0 <null> ldc.i4.s -10 ldc.i4.s 10 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) stloc.3 <null> ldloc.3 <null> ldc.i4.0 <null> cgt <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0050: nop ldstr System.AppDomain call System.Type System.Type::GetType(System.String) stloc.s V_5 ldloc.s V_5 ldstr CurrentDomain ldc.i4.s 24 callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String,System.Reflection.BindingFlags) stloc.s V_6 ldloc.s V_6 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.1 <null> br.s IL_006E: nop nop <null> ldstr System.Object call System.Type System.Type::GetType(System.String) stloc.s V_7 ldloc.s V_7 call System.Object System.Activator::CreateInstance(System.Type) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.1 <null> nop <null> nop <null> br.s IL_000D: nop nop <null> ldloc.1 <null> ldnull <null> ldstr Load ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> call System.Byte[] 2Aprs9.0DwzmdT2b5::tHw96fnNa7K() call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Reverse<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 brfalse.s IL_009B: ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6 ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 br.s IL_00B1: call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>) ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6 ldftn System.Byte 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::yKz1Xx(System.Byte,System.Int32) newobj System.Void System.Func`3<System.Byte,System.Int32,System.Byte>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldnull <null> ldstr GetTypes ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.s 24 box System.Int32 stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldnull <null> ldstr GetMethods ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) castclass System.Collections.IEnumerable callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator() stloc.s V_8 br.s IL_013B: ldloc.s V_8 ldloc.s V_8 callvirt System.Object System.Collections.IEnumerator::get_Current() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_9 nop <null> ldloc.s V_9 castclass System.Reflection.MethodInfo ldnull <null> ldc.i4.0 <null> newarr System.Object callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0139: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0139: nop nop <null> nop <null> ldloc.s V_8 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() stloc.s V_11 ldloc.s V_11 brtrue.s IL_0104: ldloc.s V_8 leave.s IL_0161: ret ldloc.s V_8 isinst System.IDisposable brfalse.s IL_0160: endfinally ldloc.s V_8 isinst System.IDisposable callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>

17afe5f7aada2875c7f719faae2e1a2d (939.01 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
2Aprs9.Resources.resources
d0e5184099d727.Resources.resources
c7ee8fe40
[NBF]root.Data
c7ee8fe41
[NBF]root.Data
c7ee8fe410
[NBF]root.Data
c7ee8fe411
[NBF]root.Data
c7ee8fe412
[NBF]root.Data
c7ee8fe413
[NBF]root.Data
c7ee8fe414
[NBF]root.Data
c7ee8fe415
[NBF]root.Data
c7ee8fe416
[NBF]root.Data
c7ee8fe417
[NBF]root.Data
c7ee8fe418
[NBF]root.Data
c7ee8fe419
[NBF]root.Data
c7ee8fe42
[NBF]root.Data
c7ee8fe420
[NBF]root.Data
c7ee8fe421
[NBF]root.Data
c7ee8fe43
[NBF]root.Data
c7ee8fe44
[NBF]root.Data
c7ee8fe45
[NBF]root.Data
c7ee8fe46
[NBF]root.Data
c7ee8fe47
[NBF]root.Data
c7ee8fe48
[NBF]root.Data
c7ee8fe49
[NBF]root.Data
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙