Suspicious
Suspect

4494bfdb290b6b1738c501fd06832376

PE Executable
|
MD5: 4494bfdb290b6b1738c501fd06832376
|
Size: 1.65 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
4494bfdb290b6b1738c501fd06832376
Sha1
51ca5babd3fc1d041694207ac24dd9d733aa79f3
Sha256
696352b6b7c282736cb240651682b07a5feaa68ac065e9128f946779db00b02b
Sha384
754dbc205ff3b1d52fbba1b82d61f9465c7a82540b37a74455db867c9f16e3289f850b0f385bd76f247b4d9afa911574
Sha512
32347a4fb45d4106c16f388b8e866fad888dcbcdf378482e151dfa89983998a55c58c6ff5719bfa5a95f6cbc4fdd3165e79f9db752887b49134f63dc94ee94fd
SSDeep
24576:15k7Q4akrcsB3eUAp0IrRDRtK/W+Z29LyicqNSQDVvL45rIZK:jrBkQs1eUAvpK/j29HNpVvL4xO
TLSH
AF753572A2987ED6F07716B5C461BA7085B5EC516C23750A63C4728CC6B03A8DB8DECF

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ v6.0 DLL
Microsoft Visual Studio .NET
UPolyX 0.3 -> delikon
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
PNG
ID:0000
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
ID:0011
ID:1033
ID:0012
ID:1033
ID:0013
ID:1033
RT_STRING
ID:00BC
ID:1033
ID:00BD
ID:1033
ID:00C4
ID:1033
ID:0178
ID:1033
ID:0179
ID:1033
ID:017A
ID:1033
ID:017B
ID:1033
ID:017C
ID:1033
ID:017D
ID:1033
ID:017E
ID:1033
ID:017F
ID:1033
ID:0180
ID:1033
ID:0181
ID:1033
ID:01BC
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
.Net Resources
aaa.Properties.Resources.resources
loader
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

PDB Path: C:\Users\PC\source\repos\VISTA\VISTA\obj\Release\aaa.pdb

Module Name

aaa.exe

Full Name

aaa.exe

EntryPoint

System.Void shllcde.Program::Main()

Scope Name

aaa.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

aaa

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

25

Main Method

System.Void shllcde.Program::Main()

Main IL Instruction Count

30

Main IL

call System.Guid System.Guid::NewGuid() stloc.1 <null> ldloca.s V_1 ldstr N call System.String System.Guid::ToString(System.String) stloc.0 <null> ldc.i4.0 <null> ldstr Global\ ldloc.0 <null> call System.String System.String::Concat(System.String,System.String) newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String) stloc.2 <null> ldloc.0 <null> call System.Void shllcde.Program::ExecuteControlFlow(System.String) leave.s IL_0055: ret stloc.3 <null> ldstr Error (GUID ldloc.0 <null> ldstr ): ldloc.3 <null> callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String,System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_0055: ret ldloc.2 <null> brfalse.s IL_0054: endfinally ldloc.2 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>

Module Name

aaa.exe

Full Name

aaa.exe

EntryPoint

System.Void shllcde.Program::Main()

Scope Name

aaa.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

aaa

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

25

Main Method

System.Void shllcde.Program::Main()

Main IL Instruction Count

30

Main IL

call System.Guid System.Guid::NewGuid() stloc.1 <null> ldloca.s V_1 ldstr N call System.String System.Guid::ToString(System.String) stloc.0 <null> ldc.i4.0 <null> ldstr Global\ ldloc.0 <null> call System.String System.String::Concat(System.String,System.String) newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String) stloc.2 <null> ldloc.0 <null> call System.Void shllcde.Program::ExecuteControlFlow(System.String) leave.s IL_0055: ret stloc.3 <null> ldstr Error (GUID ldloc.0 <null> ldstr ): ldloc.3 <null> callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String,System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_0055: ret ldloc.2 <null> brfalse.s IL_0054: endfinally ldloc.2 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>

4494bfdb290b6b1738c501fd06832376 (1.65 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
PNG
ID:0000
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
ID:0011
ID:1033
ID:0012
ID:1033
ID:0013
ID:1033
RT_STRING
ID:00BC
ID:1033
ID:00BD
ID:1033
ID:00C4
ID:1033
ID:0178
ID:1033
ID:0179
ID:1033
ID:017A
ID:1033
ID:017B
ID:1033
ID:017C
ID:1033
ID:017D
ID:1033
ID:017E
ID:1033
ID:017F
ID:1033
ID:0180
ID:1033
ID:0181
ID:1033
ID:01BC
ID:1033
RT_GROUP_CURSOR4
ID:0000
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
.Net Resources
aaa.Properties.Resources.resources
loader
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙