Suspicious
Suspect

289d29a9fedf2868c4e3575e7c3a16d7

PE Executable
|
MD5: 289d29a9fedf2868c4e3575e7c3a16d7
|
Size: 478.21 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
 Hash Value
MD5
289d29a9fedf2868c4e3575e7c3a16d7
Sha1
51f3172d48bfb5c21a25af036cdf9f8c5c1ab81e
Sha256
af429c283dcd245b61dd36bc463f32b80d12e88bcb2db1fa4ccf252756ee7287
Sha384
98808446109828574046983689e67c83e65f15ba7a0531f7ba671e821eca01a7cd0d68f39f8375a01dff18c689591fef
Sha512
2dabdeb2e95eb78aa2ca403b849e0ea968ffa06be458e71e5690d89da0ee65e548d3cfbc8ce19bd35be52487988fd93344a09be1c9414e7f8b1adb5dee0d030c
SSDeep
12288:aoIoLkq/s+veQ3kzchV0Vd0e0CwMAxU5SEIXWQwaw18i:hrQgs+veQUzcD0VGCJAC5SEEwh18
TLSH
8DA4232257F241F2E160A13EEC329586DF70B19A173C478F76A985A71B233119B193F9
File Structure
289d29a9fedf2868c4e3575e7c3a16d7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DllLoader.ShellcodeLoader.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ShellcodeLoader.redline.bin
ShellcodeLoader.shellcode.bin
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.metadata
Informations
Name
 Value
Module Name

DllLoader.exe
Full Name

DllLoader.exe
EntryPoint

System.Void DllLoader.Program::Main()
Scope Name

DllLoader.exe
Scope Type

ModuleDef
Kind

Console
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

DllLoader
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.7.2
Total Strings

5
Main Method

System.Void DllLoader.Program::Main()
Main IL Instruction Count

99
Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames() stloc.1 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_002C: ldloc.2 ldloc.1 <null> ldloc.2 <null> ldelem.ref <null> stloc.3 <null> nop <null> ldstr Found resource: ldloc.3 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldloc.1 <null> ldlen <null> conv.i4 <null> blt.s IL_0011: ldloc.1 ldstr DllLoader.ShellcodeLoader.dll stloc.0 <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.0 <null> callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_4 nop <null> ldloc.s V_4 ldnull <null> ceq <null> stloc.s V_9 ldloc.s V_9 brfalse.s IL_0062: newobj System.Void System.IO.MemoryStream::.ctor() nop <null> ldstr DLL resource tidak ditemukan! call System.Void System.Console::WriteLine(System.String) nop <null> leave IL_00E2: ret newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_10 nop <null> ldloc.s V_4 ldloc.s V_10 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) nop <null> ldloc.s V_10 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_5 nop <null> leave.s IL_008D: ldloc.s V_5 ldloc.s V_10 brfalse.s IL_008C: endfinally ldloc.s V_10 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ldloc.s V_5 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_6 ldloc.s V_6 ldstr ShellcodeLoader.Program callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.s V_7 ldloc.s V_7 ldstr Main ldc.i4.s 56 callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags) stloc.s V_8 ldloc.s V_8 brtrue.s IL_00BA: ldloc.s V_8 br.s IL_00D2: nop ldloc.s V_8 ldnull <null> ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.0 <null> newarr System.String stelem.ref <null> call System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> nop <null> leave.s IL_00E2: ret ldloc.s V_4 brfalse.s IL_00E1: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>
Artefacts
Name
 Value
PDB Path

D:\Crypter\C# SHellcode\DllLoader\obj\Debug\net472\DllLoader.pdb
PDB Path

D:\Crypter\C# SHellcode\Loader\obj\Debug\net472\ShellcodeLoader.pdb
PDB Path

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb
289d29a9fedf2868c4e3575e7c3a16d7 (478.21 KB)
File Structure
289d29a9fedf2868c4e3575e7c3a16d7
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
DllLoader.ShellcodeLoader.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ShellcodeLoader.redline.bin
ShellcodeLoader.shellcode.bin
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.metadata
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
PDB Path

D:\Crypter\C# SHellcode\DllLoader\obj\Debug\net472\DllLoader.pdb

289d29a9fedf2868c4e3575e7c3a16d7
PDB Path

D:\Crypter\C# SHellcode\Loader\obj\Debug\net472\ShellcodeLoader.pdb

289d29a9fedf2868c4e3575e7c3a16d7 > .Net Resources > DllLoader.ShellcodeLoader.dll
PDB Path

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

289d29a9fedf2868c4e3575e7c3a16d7 > .Net Resources > DllLoader.ShellcodeLoader.dll > .Net Resources > costura.costura.dll
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙