Suspicious
Suspect

320791912f5ce954dc1b4a3ce27be1ca

PE Executable
|
MD5: 320791912f5ce954dc1b4a3ce27be1ca
|
Size: 1.04 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
 Hash Value
MD5
320791912f5ce954dc1b4a3ce27be1ca
Sha1
a5be0bfcfa0d6df46e92ff5201c3298e4821f995
Sha256
2f4e209c6f1f1f5eedab708b4d6eb2af6767eed3e391d93972b38b3261627b6f
Sha384
54566e8ce3bef7c2e2527f9ea330d0b4b79f3fa1acda64acf24fd436f725ad0e73956020450b6521147ab46758aa4bed
Sha512
8e71cf5aa3eabf6fb2d712667be0cd51d11959ddf9ba95f506231c4926ca8e3c4727033f305d3938ea19375d192815986f55d27803c13eb94e8eb459dcefa06c
SSDeep
24576:AX6Q6oCgbSKHLmk5YsCyZvpx1+rG3on2x3MBr:yxCgNLmgYs7lpz+rYon2x3MBr
TLSH
9325E0D657910D32F1BE08F6498C2571675AECE66EE04D4AE44CB88227B036F21FE91F

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
UPolyX 0.3 -> delikon
File Structure
320791912f5ce954dc1b4a3ce27be1ca
[Authenticode]_54209be0.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Gsuijgpbn.Properties.Resources.resources
Vpbotvxs
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0xFC000 size 11896 bytes
Module Name

501yy.exe
Full Name

501yy.exe
EntryPoint

System.Void Gsuijgpbn.Bukse::Main()
Scope Name

501yy.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

501yy
Assembly Version

5.5.3.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

44
Main Method

System.Void Gsuijgpbn.Bukse::Main()
Main IL Instruction Count

75
Main IL

nop <null> ldnull <null> stloc.0 <null> br IL_001E: ldc.i4.1 nop <null> nop <null> call System.Byte[] Gsuijgpbn.Properties.Lzhmkfyi::get_Vpbotvxs() stloc.0 <null> leave IL_0022: ldloc.0 pop <null> nop <null> nop <null> leave IL_001D: nop nop <null> ldc.i4.1 <null> stloc.1 <null> br.s IL_0008: nop ldloc.0 <null> ldnull <null> cgt.un <null> stloc.2 <null> ldloc.2 <null> brfalse IL_00A9: ret nop <null> ldloc.0 <null> call System.Byte[] Gsuijgpbn.Bukse::Toyadsg(System.Byte[]) stloc.3 <null> ldloc.3 <null> ldlen <null> ldc.i4.0 <null> cgt.un <null> stloc.s V_4 ldloc.s V_4 brfalse IL_00A8: nop nop <null> ldloc.3 <null> call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_5 ldloc.s V_5 callvirt System.String System.Reflection.Assembly::get_CodeBase() call System.Boolean System.String::IsNullOrWhiteSpace(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_6 ldloc.s V_6 brfalse IL_00A7: nop nop <null> ldstr FaJMDfLm3oRDUiBDXA.q6WTQt4WJK7tY4376Z stloc.s V_7 ldloc.s V_5 ldloc.s V_7 callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.s V_8 ldloc.s V_8 callvirt System.String System.Type::get_FullName() call System.Boolean System.String::IsNullOrEmpty(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_9 ldloc.s V_9 brfalse IL_00A6: nop nop <null> ldloc.s V_8 ldstr e7GiYEIGq ldc.i4 256 ldnull <null> ldnull <null> ldnull <null> callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) pop <null> nop <null> nop <null> nop <null> nop <null> ret <null>
Module Name

501yy.exe
Full Name

501yy.exe
EntryPoint

System.Void Gsuijgpbn.Bukse::Main()
Scope Name

501yy.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

501yy
Assembly Version

5.5.3.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

44
Main Method

System.Void Gsuijgpbn.Bukse::Main()
Main IL Instruction Count

75
Main IL

nop <null> ldnull <null> stloc.0 <null> br IL_001E: ldc.i4.1 nop <null> nop <null> call System.Byte[] Gsuijgpbn.Properties.Lzhmkfyi::get_Vpbotvxs() stloc.0 <null> leave IL_0022: ldloc.0 pop <null> nop <null> nop <null> leave IL_001D: nop nop <null> ldc.i4.1 <null> stloc.1 <null> br.s IL_0008: nop ldloc.0 <null> ldnull <null> cgt.un <null> stloc.2 <null> ldloc.2 <null> brfalse IL_00A9: ret nop <null> ldloc.0 <null> call System.Byte[] Gsuijgpbn.Bukse::Toyadsg(System.Byte[]) stloc.3 <null> ldloc.3 <null> ldlen <null> ldc.i4.0 <null> cgt.un <null> stloc.s V_4 ldloc.s V_4 brfalse IL_00A8: nop nop <null> ldloc.3 <null> call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_5 ldloc.s V_5 callvirt System.String System.Reflection.Assembly::get_CodeBase() call System.Boolean System.String::IsNullOrWhiteSpace(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_6 ldloc.s V_6 brfalse IL_00A7: nop nop <null> ldstr FaJMDfLm3oRDUiBDXA.q6WTQt4WJK7tY4376Z stloc.s V_7 ldloc.s V_5 ldloc.s V_7 callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.s V_8 ldloc.s V_8 callvirt System.String System.Type::get_FullName() call System.Boolean System.String::IsNullOrEmpty(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_9 ldloc.s V_9 brfalse IL_00A6: nop nop <null> ldloc.s V_8 ldstr e7GiYEIGq ldc.i4 256 ldnull <null> ldnull <null> ldnull <null> callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) pop <null> nop <null> nop <null> nop <null> nop <null> ret <null>
Artefacts
Name
 Value
URLs in VB Code - #1

http://ocsp.globalsign.com/codesigningrootr450F
URLs in VB Code - #2

http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
URLs in VB Code - #3

http://crl.globalsign.com/codesigningrootr45.crl0U
URLs in VB Code - #4

https://www.globalsign.com/repository/0
URLs in VB Code - #5

http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0
URLs in VB Code - #6

http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
URLs in VB Code - #7

http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
URLs in VB Code - #8

http://ocsp.globalsign.com/ca/gstsacasha384g40C
URLs in VB Code - #9

http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
URLs in VB Code - #10

http://crl.globalsign.com/ca/gstsacasha384g4.crl0
URLs in VB Code - #11

http://ocsp2.globalsign.com/rootr606
URLs in VB Code - #12

http://crl.globalsign.com/root-r6.crl0G
320791912f5ce954dc1b4a3ce27be1ca (1.04 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙