Suspicious
Suspect

2f10e02299960048087bc92332af0efe

PE Executable
|
MD5: 2f10e02299960048087bc92332af0efe
|
Size: 1.37 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
Hash Value
MD5
2f10e02299960048087bc92332af0efe
Sha1
b053fda177f8d87a957b4b84407e90bce4fcc0b4
Sha256
7e4fe2503e3dd2028c230f5e0413423f1dbbcbda01a252d22c8ece243979e927
Sha384
60b3a001abe4ee182d33f2d54f305b962f2cede9a08fbf9483f929ebee885743025f935069524680fffd6126a8d12acf
Sha512
2361c13028347a02435f48246b613c8b49de0f8697b49e4d4332d1e08f110feee4ae8b80942edf6eebc952c883cd23ba74e214b346a5e1abcfc2d0eae336e512
SSDeep
24576:08KuS/22EWoRQN6jdLpPRcpw7UytG9NRdEpn87uoTbl6afrG3Exa508Ym0RxkO:6k2mRbLpc9NRdEpn6BTG3EwSm0vh
TLSH
F0553379E98848CEE6721D37E576D9EB51271E8303EDE44AB32954FEDC011328D2B84E

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
a
Informations
Name
Value
Module Name

temploader.exe

Full Name

temploader.exe

EntryPoint

System.Void a.a::Main()

Scope Name

temploader.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

temploader

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

3

Main Method

System.Void a.a::Main()

Main IL Instruction Count

37

Main IL

call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldstr GYZaCi3t+HcDfB3ScBgSzQ== ldstr WXfxCsbSWl4P7z6kAbj6v/Rd30/zzR95quzwTGT8RDg= ldstr LFUNEXGyykNT14e0/ltVIw== call System.String ꏭ緔菳꒑뎔ﯥ躚::襲醀鍭᮫졯㪆끯ꎞ᠚(System.String,System.String,System.String) callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.0 <null> newobj System.Void System.IO.MemoryStream::.ctor() stloc.1 <null> ldloc.0 <null> ldc.i4.0 <null> newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) leave IL_0046: ldloc.1 ldloc.2 <null> brfalse IL_0045: endfinally ldloc.2 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.1 <null> callvirt System.Byte[] System.IO.MemoryStream::ToArray() call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave IL_0070: ret ldloc.0 <null> brfalse IL_006F: endfinally ldloc.0 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>

Module Name

temploader.exe

Full Name

temploader.exe

EntryPoint

System.Void a.a::Main()

Scope Name

temploader.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

temploader

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

3

Main Method

System.Void a.a::Main()

Main IL Instruction Count

37

Main IL

call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldstr GYZaCi3t+HcDfB3ScBgSzQ== ldstr WXfxCsbSWl4P7z6kAbj6v/Rd30/zzR95quzwTGT8RDg= ldstr LFUNEXGyykNT14e0/ltVIw== call System.String ꏭ緔菳꒑뎔ﯥ躚::襲醀鍭᮫졯㪆끯ꎞ᠚(System.String,System.String,System.String) callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.0 <null> newobj System.Void System.IO.MemoryStream::.ctor() stloc.1 <null> ldloc.0 <null> ldc.i4.0 <null> newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) leave IL_0046: ldloc.1 ldloc.2 <null> brfalse IL_0045: endfinally ldloc.2 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.1 <null> callvirt System.Byte[] System.IO.MemoryStream::ToArray() call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave IL_0070: ret ldloc.0 <null> brfalse IL_006F: endfinally ldloc.0 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>

2f10e02299960048087bc92332af0efe (1.37 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
a
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙