Suspicious
Suspect

2a94423e44e33658ea81f336e8cd33a3

PE Executable
|
MD5: 2a94423e44e33658ea81f336e8cd33a3
|
Size: 976.38 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
Hash Value
MD5
2a94423e44e33658ea81f336e8cd33a3
Sha1
290f223c4adc12f40abda0c47d409aaf0d88e651
Sha256
848a5affafea6d8247f56c301bc9c2996e51e26015183f1c979a82ff24c49013
Sha384
3e7a704a5ce159cfcf4c38b04c4b8b48a4201daf35834357b36776cc94c21348c0302a73c0c7cc6c82625feb93ebf0e2
Sha512
d3e766e246fd923aba894839731e52f8fb3987bf7b76aa71032fb0a3a8095a6d32fcfbbffe056a956ee753cefc0ec99525cda352a45660b2386755638df2c99f
SSDeep
12288:SmxJu6ZtwCj87I/B93fNsyPblIcUA6PBRMfknY09+bRKYOeepcaw0441A:v7u64Cj8cPNxPb+cUxifknj9DFZj1A
TLSH
9325AE1527986FE4E17F9F318565010047F2BD07CF32D79E69A4FAF8EEA2B849512223

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
TetraSite.demandflatteningrules
0KjfrpP34Jf.Jai1aX.resources
a7259f15bfcd03.Resources.resources
b39e0f030
[NBF]root.Data
b39e0f031
[NBF]root.Data
b39e0f0310
[NBF]root.Data
b39e0f0311
[NBF]root.Data
b39e0f0312
[NBF]root.Data
b39e0f0313
[NBF]root.Data
b39e0f0314
[NBF]root.Data
b39e0f0315
[NBF]root.Data
b39e0f0316
[NBF]root.Data
b39e0f0317
[NBF]root.Data
b39e0f0318
[NBF]root.Data
b39e0f0319
[NBF]root.Data
b39e0f032
[NBF]root.Data
b39e0f0320
[NBF]root.Data
b39e0f0321
[NBF]root.Data
b39e0f0322
[NBF]root.Data
b39e0f0323
[NBF]root.Data
b39e0f0324
[NBF]root.Data
b39e0f0325
[NBF]root.Data
b39e0f033
[NBF]root.Data
b39e0f034
[NBF]root.Data
b39e0f035
[NBF]root.Data
b39e0f036
[NBF]root.Data
b39e0f037
[NBF]root.Data
b39e0f038
[NBF]root.Data
b39e0f039
[NBF]root.Data
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

0KjfrpP34Jf

Full Name

0KjfrpP34Jf

EntryPoint

System.Void 0KjfrpP34Jf.9Nwsp/6qiNrTt8Ap7c2P.Cc2_d0wF1tMi::eMr9By0z7taH()

Scope Name

0KjfrpP34Jf

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

0KjfrpP34Jf

Assembly Version

17.20.14.106

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1175

Main Method

System.Void 0KjfrpP34Jf.9Nwsp/6qiNrTt8Ap7c2P.Cc2_d0wF1tMi::eMr9By0z7taH()

Main IL Instruction Count

32

Main IL

nop <null> nop <null> ldc.i4.s 20 stloc.0 <null> newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor() stloc.1 <null> ldloc.0 <null> stloc.2 <null> ldc.i4.1 <null> stloc.3 <null> br.s IL_001D: ldloc.3 ldloc.1 <null> ldloc.3 <null> callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.3 <null> ldc.i4.1 <null> add.ovf <null> stloc.3 <null> ldloc.3 <null> ldloc.2 <null> ble.s IL_0011: ldloc.1 ldstr demandflatteningrules call System.Void 0KjfrpP34Jf.9cnTD4::fr2S_4Zi(System.String) nop <null> leave.s IL_003B: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_003B: nop nop <null> ret <null>

Module Name

0KjfrpP34Jf

Full Name

0KjfrpP34Jf

EntryPoint

System.Void 0KjfrpP34Jf.9Nwsp/6qiNrTt8Ap7c2P.Cc2_d0wF1tMi::eMr9By0z7taH()

Scope Name

0KjfrpP34Jf

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

0KjfrpP34Jf

Assembly Version

17.20.14.106

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1175

Main Method

System.Void 0KjfrpP34Jf.9Nwsp/6qiNrTt8Ap7c2P.Cc2_d0wF1tMi::eMr9By0z7taH()

Main IL Instruction Count

32

Main IL

nop <null> nop <null> ldc.i4.s 20 stloc.0 <null> newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor() stloc.1 <null> ldloc.0 <null> stloc.2 <null> ldc.i4.1 <null> stloc.3 <null> br.s IL_001D: ldloc.3 ldloc.1 <null> ldloc.3 <null> callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.3 <null> ldc.i4.1 <null> add.ovf <null> stloc.3 <null> ldloc.3 <null> ldloc.2 <null> ble.s IL_0011: ldloc.1 ldstr demandflatteningrules call System.Void 0KjfrpP34Jf.9cnTD4::fr2S_4Zi(System.String) nop <null> leave.s IL_003B: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_003B: nop nop <null> ret <null>

2a94423e44e33658ea81f336e8cd33a3 (976.38 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
TetraSite.demandflatteningrules
0KjfrpP34Jf.Jai1aX.resources
a7259f15bfcd03.Resources.resources
b39e0f030
[NBF]root.Data
b39e0f031
[NBF]root.Data
b39e0f0310
[NBF]root.Data
b39e0f0311
[NBF]root.Data
b39e0f0312
[NBF]root.Data
b39e0f0313
[NBF]root.Data
b39e0f0314
[NBF]root.Data
b39e0f0315
[NBF]root.Data
b39e0f0316
[NBF]root.Data
b39e0f0317
[NBF]root.Data
b39e0f0318
[NBF]root.Data
b39e0f0319
[NBF]root.Data
b39e0f032
[NBF]root.Data
b39e0f0320
[NBF]root.Data
b39e0f0321
[NBF]root.Data
b39e0f0322
[NBF]root.Data
b39e0f0323
[NBF]root.Data
b39e0f0324
[NBF]root.Data
b39e0f0325
[NBF]root.Data
b39e0f033
[NBF]root.Data
b39e0f034
[NBF]root.Data
b39e0f035
[NBF]root.Data
b39e0f036
[NBF]root.Data
b39e0f037
[NBF]root.Data
b39e0f038
[NBF]root.Data
b39e0f039
[NBF]root.Data
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙