Suspicious
Suspect

24e4486d679162817cba86e80d8f7b9f

PE Executable
|
MD5: 24e4486d679162817cba86e80d8f7b9f
|
Size: 83.97 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
24e4486d679162817cba86e80d8f7b9f
Sha1
96a7cad6f78b9d6e663c6795bd6ec278e4cf4c1a
Sha256
31ee08e0aad9297988beb54957c0fa5bce2d9b1d0d2c16e4932e247c73c19348
Sha384
63029017c7165c05e139a7b7a7d7cfbf506538b1feb60334ac66215a5680e01e460b5503cdd6e9ee172882d1e34f3dca
Sha512
4b52f7d1bbfc8de5de3a4c4a7a6218a5bb6ea5424caf7dba4d404d23f90a3f5e7101d701da2f66b6d7e7855887e448f59da94fed5ab1a53afb7b76a1554a7be1
SSDeep
1536:rpjMZKCDV5Ame6CUngfLFtxW1iMZv3ygA+03iQmgsmvhiS34ee/:NMrr1yfQAPyQmgs8V3C/
TLSH
5183C507BA4B8DB1C2485B76CD9F40880360D7C3F693D61A798AD35E1947FEE8941E8B

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
24e4486d679162817cba86e80d8f7b9f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
    ​    
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Ndvvjefnz
Full Name

Ndvvjefnz
EntryPoint

System.Void Ndvvjefnz.Diagnostics.TracerServer::TrackVisualTracer()
Scope Name

Ndvvjefnz
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ndvvjefnz
Assembly Version

1.0.7098.29603
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

0
Main Method

System.Void Ndvvjefnz.Diagnostics.TracerServer::TrackVisualTracer()
Main IL Instruction Count

96
Main IL

ldc.i4 5 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0034: ret ret <null> ldc.i4 1164798715 call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32) stloc.s V_1 ldc.i4 2 ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7 ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_5cbfcee2e1dd4f7fba7dbc9b1a291ec0 brfalse IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) pop <null> ldc.i4 0 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) ldc.i4 1164798744 call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32) stloc.s V_2 ldc.i4 3 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) newobj System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::.ctor() stloc.s V_3 ldc.i4 4 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) ldsfld System.Func`1<System.Byte[]> Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ContextProfile dup <null> brfalse IL_0097: pop br IL_00CD: newobj System.Void Ndvvjefnz.Explorers.AggregatorExplorer::.ctor(System.Func`1<System.Byte[]>) pop <null> ldc.i4 0 ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7 ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_8cb5fb6ff7c54d58af4f306881bb1c86 brtrue IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) pop <null> ldc.i4 1 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_IsolatedConnection ldftn System.Byte[] Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::ConnectSimpleConnection() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ContextProfile newobj System.Void Ndvvjefnz.Explorers.AggregatorExplorer::.ctor(System.Func`1<System.Byte[]>) ldloc.s V_3 ldloc.s V_1 ldloc.s V_2 newobj System.Void Ndvvjefnz.Decorators.ExternalDecorator::.ctor(System.String,System.String) stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::commonMember ldloc.s V_3 newobj System.Void Ndvvjefnz.Networking.ConnectionListener::.ctor() stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::groupedCollection ldloc.s V_3 ldc.i4 1164798765 call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32) ldc.i4 1164798809 call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32) newobj System.Void Ndvvjefnz.Mapping.ExecutorMapper::.ctor(System.String,System.String) stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::scheduledTemplate dup <null> ldloc.s V_3 ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::ExcludeCollection(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ndvvjefnz.Explorers.AggregatorExplorer::ExploreLocalExplorer(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::commonMember ldloc.s V_3 ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::AddControllableCollection(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ndvvjefnz.Decorators.ExternalDecorator::ArrangeDecorator(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::groupedCollection ldloc.s V_3 ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::CountResponsiveCollection(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ndvvjefnz.Networking.ConnectionListener::CloseExternalConnection(System.Action`1<System.Reflection.Assembly>) ldloc.s V_3 ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::scheduledTemplate ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ProfilerTag dup <null> brtrue IL_017C: callvirt System.Void Ndvvjefnz.Mapping.ExecutorMapper::MapJoinedMapper(System.Action) pop <null> ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_IsolatedConnection ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::ConnectActiveConnection() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ProfilerTag callvirt System.Void Ndvvjefnz.Mapping.ExecutorMapper::MapJoinedMapper(System.Action) callvirt System.Void Ndvvjefnz.Explorers.AggregatorExplorer::CancelExplorer() ldc.i4 0 ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7 ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_51bcd290357b4510877b317d0506fb8a brtrue IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) pop <null> ldc.i4 0 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
Module Name

Ndvvjefnz
Full Name

Ndvvjefnz
EntryPoint

System.Void Ndvvjefnz.Diagnostics.TracerServer::TrackVisualTracer()
Scope Name

Ndvvjefnz
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ndvvjefnz
Assembly Version

1.0.7098.29603
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

0
Main Method

System.Void Ndvvjefnz.Diagnostics.TracerServer::TrackVisualTracer()
Main IL Instruction Count

96
Main IL

ldc.i4 5 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0034: ret ret <null> ldc.i4 1164798715 call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32) stloc.s V_1 ldc.i4 2 ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7 ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_5cbfcee2e1dd4f7fba7dbc9b1a291ec0 brfalse IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) pop <null> ldc.i4 0 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) ldc.i4 1164798744 call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32) stloc.s V_2 ldc.i4 3 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) newobj System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::.ctor() stloc.s V_3 ldc.i4 4 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) ldsfld System.Func`1<System.Byte[]> Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ContextProfile dup <null> brfalse IL_0097: pop br IL_00CD: newobj System.Void Ndvvjefnz.Explorers.AggregatorExplorer::.ctor(System.Func`1<System.Byte[]>) pop <null> ldc.i4 0 ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7 ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_8cb5fb6ff7c54d58af4f306881bb1c86 brtrue IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) pop <null> ldc.i4 1 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_IsolatedConnection ldftn System.Byte[] Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::ConnectSimpleConnection() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ContextProfile newobj System.Void Ndvvjefnz.Explorers.AggregatorExplorer::.ctor(System.Func`1<System.Byte[]>) ldloc.s V_3 ldloc.s V_1 ldloc.s V_2 newobj System.Void Ndvvjefnz.Decorators.ExternalDecorator::.ctor(System.String,System.String) stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::commonMember ldloc.s V_3 newobj System.Void Ndvvjefnz.Networking.ConnectionListener::.ctor() stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::groupedCollection ldloc.s V_3 ldc.i4 1164798765 call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32) ldc.i4 1164798809 call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32) newobj System.Void Ndvvjefnz.Mapping.ExecutorMapper::.ctor(System.String,System.String) stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::scheduledTemplate dup <null> ldloc.s V_3 ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::ExcludeCollection(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ndvvjefnz.Explorers.AggregatorExplorer::ExploreLocalExplorer(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::commonMember ldloc.s V_3 ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::AddControllableCollection(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ndvvjefnz.Decorators.ExternalDecorator::ArrangeDecorator(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::groupedCollection ldloc.s V_3 ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::CountResponsiveCollection(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ndvvjefnz.Networking.ConnectionListener::CloseExternalConnection(System.Action`1<System.Reflection.Assembly>) ldloc.s V_3 ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::scheduledTemplate ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ProfilerTag dup <null> brtrue IL_017C: callvirt System.Void Ndvvjefnz.Mapping.ExecutorMapper::MapJoinedMapper(System.Action) pop <null> ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_IsolatedConnection ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::ConnectActiveConnection() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ProfilerTag callvirt System.Void Ndvvjefnz.Mapping.ExecutorMapper::MapJoinedMapper(System.Action) callvirt System.Void Ndvvjefnz.Explorers.AggregatorExplorer::CancelExplorer() ldc.i4 0 ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7 ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_51bcd290357b4510877b317d0506fb8a brtrue IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076) pop <null> ldc.i4 0 br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
24e4486d679162817cba86e80d8f7b9f (83.97 KB)
File Structure
24e4486d679162817cba86e80d8f7b9f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
    ​    
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙