Suspicious
Suspect

1df258927442afd405ebf4f679c15849

PE Executable
|
MD5: 1df258927442afd405ebf4f679c15849
|
Size: 81.92 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
1df258927442afd405ebf4f679c15849
Sha1
29d9fa88306073db4e89861b78ac2cfa1d5a8e1c
Sha256
703621d1a012bd342c6725513a74b3233892675fda7ac066103db12f340ffd54
Sha384
efb1af038e0d2159a0745a7d7586301fb1a40ce378f5037c0dbcfdd5ef972e6ea302225686e08505a6114cb9f6e87927
Sha512
478cbeea7b6c04fac6c49b899459721f1a2019dd5f31044dad5334bc305361a88da33904546b33f50b7550d2dad206684bc2641ed4416dcf626710f5e8e0d908
SSDeep
1536:A+S8BldFGTSZfXf56gHo0ZM7hhfMTRdcOPNjg6iDWYFIaRbQBWnolFb:ArSZfhdrqhhfMTRdbgxWUI0YWnoT
TLSH
B183A237BA4A83B1C7445FFAC59B44000366D7C9B6A3DE1A798E136B5B0B7EEC94014B

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
1df258927442afd405ebf4f679c15849
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
 ​       
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Ttyvchqtxna
Full Name

Ttyvchqtxna
EntryPoint

System.Void Ttyvchqtxna.Processing.ProcessorModule::ProcessTransformableProcessor()
Scope Name

Ttyvchqtxna
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ttyvchqtxna
Assembly Version

1.0.6542.9980
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

0
Main Method

System.Void Ttyvchqtxna.Processing.ProcessorModule::ProcessTransformableProcessor()
Main IL Instruction Count

101
Main IL

ldc.i4 3 stloc V_3 br IL_000E: ldloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_00CC: ldsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_RecordNotifier ldc.i4 1686296409 call System.String Ttyvchqtxna.Factories.FactoryBuilder::CreateCentralFactory(System.Int32) stloc.s V_1 ldc.i4 1 ldsfld <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240} <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_6d393c79d8c84eb7b8b2f8128d86c3de ldfld System.Int32 <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_358590c9ae3741bb84a7e66fecd451fa brfalse IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) pop <null> ldc.i4 0 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) ret <null> ldc.i4 1686296250 call System.String Ttyvchqtxna.Factories.FactoryBuilder::CreateCentralFactory(System.Int32) stloc.s V_2 ldc.i4 5 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) newobj System.Void Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::.ctor() stloc.s V_0 ldc.i4 2 ldsfld <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240} <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_6d393c79d8c84eb7b8b2f8128d86c3de ldfld System.Int32 <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_3d1f936f8b954249bbb44e5f25bc1127 brtrue IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) pop <null> ldc.i4 1 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) ldsfld System.Func`1<System.Byte[]> Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_AttachedRecord dup <null> brfalse IL_00AC: pop br IL_00E2: newobj System.Void Ttyvchqtxna.Processing.ProcessorInterpreter::.ctor(System.Func`1<System.Byte[]>) pop <null> ldc.i4 0 ldsfld <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240} <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_6d393c79d8c84eb7b8b2f8128d86c3de ldfld System.Int32 <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_f27178f3a01e477781c559656e41df03 brtrue IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) pop <null> ldc.i4 0 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) ldsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_RecordNotifier ldftn System.Byte[] Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::ConcatRecord() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_AttachedRecord newobj System.Void Ttyvchqtxna.Processing.ProcessorInterpreter::.ctor(System.Func`1<System.Byte[]>) ldloc.s V_0 ldloc.s V_1 ldloc.s V_2 newobj System.Void Ttyvchqtxna.Structures.EvaluatorRecord::.ctor(System.String,System.String) stfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::_ExtendedInspector ldloc.s V_0 newobj System.Void Ttyvchqtxna.Procedures.ResponderEnumerator::.ctor() stfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::m_SpecProcessor ldloc.s V_0 ldc.i4 1686296199 call System.String Ttyvchqtxna.Factories.FactoryBuilder::CreateCentralFactory(System.Int32) ldc.i4 1686296315 call System.String Ttyvchqtxna.Factories.FactoryBuilder::CreateCentralFactory(System.Int32) newobj System.Void Ttyvchqtxna.Processing.IterableProcessor::.ctor(System.String,System.String) stfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::m_ProviderWatcher dup <null> ldloc.s V_0 ldftn System.Void Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::SortProcessor(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ttyvchqtxna.Processing.ProcessorInterpreter::ProcessScalableProcessor(System.Action`1<System.IO.MemoryStream>) ldloc.s V_0 ldfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::_ExtendedInspector ldloc.s V_0 ldftn System.Void Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::HandleSequentialProcessor(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ttyvchqtxna.Structures.EvaluatorRecord::LogDividedRecord(System.Action`1<System.IO.MemoryStream>) ldloc.s V_0 ldfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::m_SpecProcessor ldloc.s V_0 ldftn System.Void Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::ExecuteVirtualProcessor(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ttyvchqtxna.Procedures.ResponderEnumerator::ExecuteDetachedProc(System.Action`1<System.Reflection.Assembly>) ldloc.s V_0 ldfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::m_ProviderWatcher ldsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::filteredRecord dup <null> brtrue IL_0191: callvirt System.Void Ttyvchqtxna.Processing.IterableProcessor::ExecuteAdaptableProcessor(System.Action) pop <null> ldsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_RecordNotifier ldftn System.Void Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::SetupRecord() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::filteredRecord callvirt System.Void Ttyvchqtxna.Processing.IterableProcessor::ExecuteAdaptableProcessor(System.Action) callvirt System.Void Ttyvchqtxna.Processing.ProcessorInterpreter::ProcessExternalProcessor() ldc.i4 4 ldsfld <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240} <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_6d393c79d8c84eb7b8b2f8128d86c3de ldfld System.Int32 <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_1ad81767f5494f4b8fa7c1799339eac0 brtrue IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) pop <null> ldc.i4 0 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C)
Module Name

Ttyvchqtxna
Full Name

Ttyvchqtxna
EntryPoint

System.Void Ttyvchqtxna.Processing.ProcessorModule::ProcessTransformableProcessor()
Scope Name

Ttyvchqtxna
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ttyvchqtxna
Assembly Version

1.0.6542.9980
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

0
Main Method

System.Void Ttyvchqtxna.Processing.ProcessorModule::ProcessTransformableProcessor()
Main IL Instruction Count

101
Main IL

ldc.i4 3 stloc V_3 br IL_000E: ldloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_00CC: ldsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_RecordNotifier ldc.i4 1686296409 call System.String Ttyvchqtxna.Factories.FactoryBuilder::CreateCentralFactory(System.Int32) stloc.s V_1 ldc.i4 1 ldsfld <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240} <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_6d393c79d8c84eb7b8b2f8128d86c3de ldfld System.Int32 <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_358590c9ae3741bb84a7e66fecd451fa brfalse IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) pop <null> ldc.i4 0 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) ret <null> ldc.i4 1686296250 call System.String Ttyvchqtxna.Factories.FactoryBuilder::CreateCentralFactory(System.Int32) stloc.s V_2 ldc.i4 5 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) newobj System.Void Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::.ctor() stloc.s V_0 ldc.i4 2 ldsfld <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240} <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_6d393c79d8c84eb7b8b2f8128d86c3de ldfld System.Int32 <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_3d1f936f8b954249bbb44e5f25bc1127 brtrue IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) pop <null> ldc.i4 1 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) ldsfld System.Func`1<System.Byte[]> Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_AttachedRecord dup <null> brfalse IL_00AC: pop br IL_00E2: newobj System.Void Ttyvchqtxna.Processing.ProcessorInterpreter::.ctor(System.Func`1<System.Byte[]>) pop <null> ldc.i4 0 ldsfld <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240} <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_6d393c79d8c84eb7b8b2f8128d86c3de ldfld System.Int32 <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_f27178f3a01e477781c559656e41df03 brtrue IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) pop <null> ldc.i4 0 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) ldsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_RecordNotifier ldftn System.Byte[] Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::ConcatRecord() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_AttachedRecord newobj System.Void Ttyvchqtxna.Processing.ProcessorInterpreter::.ctor(System.Func`1<System.Byte[]>) ldloc.s V_0 ldloc.s V_1 ldloc.s V_2 newobj System.Void Ttyvchqtxna.Structures.EvaluatorRecord::.ctor(System.String,System.String) stfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::_ExtendedInspector ldloc.s V_0 newobj System.Void Ttyvchqtxna.Procedures.ResponderEnumerator::.ctor() stfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::m_SpecProcessor ldloc.s V_0 ldc.i4 1686296199 call System.String Ttyvchqtxna.Factories.FactoryBuilder::CreateCentralFactory(System.Int32) ldc.i4 1686296315 call System.String Ttyvchqtxna.Factories.FactoryBuilder::CreateCentralFactory(System.Int32) newobj System.Void Ttyvchqtxna.Processing.IterableProcessor::.ctor(System.String,System.String) stfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::m_ProviderWatcher dup <null> ldloc.s V_0 ldftn System.Void Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::SortProcessor(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ttyvchqtxna.Processing.ProcessorInterpreter::ProcessScalableProcessor(System.Action`1<System.IO.MemoryStream>) ldloc.s V_0 ldfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::_ExtendedInspector ldloc.s V_0 ldftn System.Void Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::HandleSequentialProcessor(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ttyvchqtxna.Structures.EvaluatorRecord::LogDividedRecord(System.Action`1<System.IO.MemoryStream>) ldloc.s V_0 ldfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::m_SpecProcessor ldloc.s V_0 ldftn System.Void Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::ExecuteVirtualProcessor(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ttyvchqtxna.Procedures.ResponderEnumerator::ExecuteDetachedProc(System.Action`1<System.Reflection.Assembly>) ldloc.s V_0 ldfld System.Object Ttyvchqtxna.Processing.ProcessorModule/ProcessorSchema::m_ProviderWatcher ldsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::filteredRecord dup <null> brtrue IL_0191: callvirt System.Void Ttyvchqtxna.Processing.IterableProcessor::ExecuteAdaptableProcessor(System.Action) pop <null> ldsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::m_RecordNotifier ldftn System.Void Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::SetupRecord() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Object Ttyvchqtxna.Processing.ProcessorModule/DetailedRecord::filteredRecord callvirt System.Void Ttyvchqtxna.Processing.IterableProcessor::ExecuteAdaptableProcessor(System.Action) callvirt System.Void Ttyvchqtxna.Processing.ProcessorInterpreter::ProcessExternalProcessor() ldc.i4 4 ldsfld <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240} <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_6d393c79d8c84eb7b8b2f8128d86c3de ldfld System.Int32 <Module>{8862eedd-e3f8-4751-b62e-d4be63b09240}::m_1ad81767f5494f4b8fa7c1799339eac0 brtrue IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C) pop <null> ldc.i4 0 br IL_0012: switch(IL_00CC,IL_0060,IL_0034,IL_0076,IL_005F,IL_009C)
1df258927442afd405ebf4f679c15849 (81.92 KB)
File Structure
1df258927442afd405ebf4f679c15849
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
 ​       
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙