Suspicious
Suspect

3823c59afe93ad5f687644b57664f81c

PE Executable
MD5: 3823c59afe93ad5f687644b57664f81c
Size: 235.01 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Medium

Hash
Hash Value
MD5
3823c59afe93ad5f687644b57664f81c
Sha1
b4718cda21f1645c0ef34f899c92ca31c21b124e
Sha256
f220e60f655d3e78bf22d140c2f2d1b5f9332ac3785eab6add91eb1588cbbafb
Sha384
451b18a26331622cd408196815d155197c483616999cc68d8f04d986f0d8616f53395ba31d2ad57c3bdd36295313a6cd
Sha512
ccea77ef0f7265f2c170685b7df3838c6db759797eb1535890d33f5f19a7dda09da4ff82d02ad9ddbd42a1953f9ab483c2f8240d6f8c398c103a7fb74ee5e3ac
SSDeep
6144:FloZMsrIkd8g+EtXHkv/iD4p+rX+8D/0gVA+Pv+ekb8e1m4i:HoZrL+EP8p+rX+8D/0gVA+Pv+zi
TLSH
5E346B5937B88B17E25F8FBED5B0148F87B1F103E90AF78E1C8895E82411B42E949E57

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

PDB Path: ?

Module Name

Umbral.payload.exe

Full Name

Umbral.payload.exe

EntryPoint

System.Void 꼂ዼ葆�ጤꠋᦹ聩ܟ冷펜ᐞ墉餚䪵ꢁࡇ⏕濗::藢곫�즾䓁鵏㤬혣볧骈ᖳ遊朘ꍙ�폅앂蘹સ(System.String[])

Scope Name

Umbral.payload.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Umbral.payload

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

964

Main Method

System.Void 꼂ዼ葆�ጤꠋᦹ聩ܟ冷펜ᐞ墉餚䪵ꢁࡇ⏕濗::藢곫�즾䓁鵏㤬혣볧骈ᖳ遊朘ꍙ�폅앂蘹સ(System.String[])

Main IL Instruction Count

7

Main IL

ldarg.0 <null> call System.Threading.Tasks.Task 꼂ዼ葆�ጤꠋᦹ聩ܟ冷펜ᐞ墉餚䪵ꢁࡇ⏕濗::Main(System.String[]) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>

Module Name

Umbral.payload.exe

Full Name

Umbral.payload.exe

EntryPoint

System.Void 꼂ዼ葆�ጤꠋᦹ聩ܟ冷펜ᐞ墉餚䪵ꢁࡇ⏕濗::藢곫�즾䓁鵏㤬혣볧骈ᖳ遊朘ꍙ�폅앂蘹સ(System.String[])

Scope Name

Umbral.payload.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Umbral.payload

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

964

Main Method

System.Void 꼂ዼ葆�ጤꠋᦹ聩ܟ冷펜ᐞ墉餚䪵ꢁࡇ⏕濗::藢곫�즾䓁鵏㤬혣볧骈ᖳ遊朘ꍙ�폅앂蘹સ(System.String[])

Main IL Instruction Count

7

Main IL

ldarg.0 <null> call System.Threading.Tasks.Task 꼂ዼ葆�ጤꠋᦹ聩ܟ冷펜ᐞ墉餚䪵ꢁࡇ⏕濗::Main(System.String[]) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>

3823c59afe93ad5f687644b57664f81c (235.01 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙