Suspicious
Suspect

4558d2235e5b0377cb9f1be81a0c8884

PE Executable
|
MD5: 4558d2235e5b0377cb9f1be81a0c8884
|
Size: 1.68 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
Hash Value
MD5
4558d2235e5b0377cb9f1be81a0c8884
Sha1
95c0ebccd0c6e98d3b919e05c4a84a496e7a6188
Sha256
cf1153dad2c1b9920dbe8104f86a915b2bff536cc8553993d21321f6470421d3
Sha384
35f282f57c22399bc853aea40d875cf760701b23a08bda027dd1d5ec6f0e1be2971753c5846dd1f2d333a0327b3383ba
Sha512
05487ca8893adf8ff237f6710d197bd5e8f2ac34b44d922f071395188feaaf1c10efa6ad4b34f32358b7c8649583215c8f24d8e181f2eb36bda6b1c03b71e2cd
SSDeep
24576:XkD+NQG15pbwtkL6Jw7nSChkwgHwcXUL7y84MZnxNbpqTsuJZIudc5kvoO2Ny/pT:e8DpMg6JwuChkMcXU6epbixZZmDux7
TLSH
A27533462DCCA0D3E6E8A33C2777880D1A7A6753E1F6F3835B11981978767EE0544B9C

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Rqqqjlp.Properties.Resources.resources
Zrquoigmjh
ILRepack.List
              
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

Cwivuyrp

Full Name

Cwivuyrp

EntryPoint

System.Void  ::()

Scope Name

Cwivuyrp

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Cwivuyrp

Assembly Version

1.0.3143.3571

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

0

Main Method

System.Void  ::()

Main IL Instruction Count

64

Main IL

newobj System.Void  /::.ctor() stloc.0 <null> ldc.i4 -384814184 call System.String ::(System.Int32) stloc.1 <null> ldc.i4 -384814465 call System.String ::(System.Int32) stloc.2 <null> ldsfld System.Func`1<System.Byte[]>  /:: dup <null> brtrue.s IL_003B: newobj System.Void  ::.ctor(System.Func`1<System.Byte[]>) pop <null> ldsfld  /  /:: ldftn System.Byte[]  /::() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]>  /:: newobj System.Void  ::.ctor(System.Func`1<System.Byte[]>) ldloc.0 <null> ldloc.1 <null> ldloc.2 <null> newobj System.Void  ::.ctor(System.String,System.String) stfld    /:: ldloc.0 <null> newobj System.Void  ::.ctor() stfld    /:: ldloc.0 <null> ldc.i4 -384814486 call System.String ::(System.Int32) ldc.i4 -384814530 call System.String ::(System.Int32) newobj System.Void  ::.ctor(System.String,System.String) stfld    /:: dup <null> ldloc.0 <null> ldftn System.Void  /::(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void  ::(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld    /:: ldloc.0 <null> ldftn System.Void  /::(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void  ::(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld    /:: ldloc.0 <null> ldftn System.Void  /::(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void  ::(System.Action`1<System.Reflection.Assembly>) ldloc.0 <null> ldfld    /:: ldsfld System.Action  /:: dup <null> brtrue.s IL_00DC: callvirt System.Void  ::(System.Action) pop <null> ldsfld  /  /:: ldftn System.Void  /::() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action  /:: callvirt System.Void  ::(System.Action) callvirt System.Void  ::() ret <null>

Module Name

Cwivuyrp

Full Name

Cwivuyrp

EntryPoint

System.Void  ::()

Scope Name

Cwivuyrp

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Cwivuyrp

Assembly Version

1.0.3143.3571

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

0

Main Method

System.Void  ::()

Main IL Instruction Count

64

Main IL

newobj System.Void  /::.ctor() stloc.0 <null> ldc.i4 -384814184 call System.String ::(System.Int32) stloc.1 <null> ldc.i4 -384814465 call System.String ::(System.Int32) stloc.2 <null> ldsfld System.Func`1<System.Byte[]>  /:: dup <null> brtrue.s IL_003B: newobj System.Void  ::.ctor(System.Func`1<System.Byte[]>) pop <null> ldsfld  /  /:: ldftn System.Byte[]  /::() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]>  /:: newobj System.Void  ::.ctor(System.Func`1<System.Byte[]>) ldloc.0 <null> ldloc.1 <null> ldloc.2 <null> newobj System.Void  ::.ctor(System.String,System.String) stfld    /:: ldloc.0 <null> newobj System.Void  ::.ctor() stfld    /:: ldloc.0 <null> ldc.i4 -384814486 call System.String ::(System.Int32) ldc.i4 -384814530 call System.String ::(System.Int32) newobj System.Void  ::.ctor(System.String,System.String) stfld    /:: dup <null> ldloc.0 <null> ldftn System.Void  /::(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void  ::(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld    /:: ldloc.0 <null> ldftn System.Void  /::(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void  ::(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld    /:: ldloc.0 <null> ldftn System.Void  /::(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void  ::(System.Action`1<System.Reflection.Assembly>) ldloc.0 <null> ldfld    /:: ldsfld System.Action  /:: dup <null> brtrue.s IL_00DC: callvirt System.Void  ::(System.Action) pop <null> ldsfld  /  /:: ldftn System.Void  /::() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action  /:: callvirt System.Void  ::(System.Action) callvirt System.Void  ::() ret <null>

4558d2235e5b0377cb9f1be81a0c8884 (1.68 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Rqqqjlp.Properties.Resources.resources
Zrquoigmjh
ILRepack.List
              
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙