Suspicious
Suspect

493874cc7b52bf5a41955d1c8f0792cc

PE Executable
|
MD5: 493874cc7b52bf5a41955d1c8f0792cc
|
Size: 36.85 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
Hash Value
MD5
493874cc7b52bf5a41955d1c8f0792cc
Sha1
46d0b1dc9492e049dccef84a47180326a3b539e8
Sha256
ad3dcb6722af79aec9aad35c0c1a1b6b8c163b1a8ac4952d9f52a40c93591a71
Sha384
dbb4daac4e6aeaec7faca7fddf34787f9cc69f53dc59b56bee6ec5976ff03875abf0bafd482b4a1f944de31bd1a7161a
Sha512
27527cd2498ee7a0a4855a1c1c8bfa3bd03fa393370d3455e2636db6372e60cf349756aaa697ae86419236444e32ee07129fd82f3dc3811f8e702b5539f74bc5
SSDeep
768:OcICr1dsYT1XpQDEmasIzjzjaYRDaJ82ADXjAJB:OcLlT1DsIzjzja8DaJ8tDjkB
TLSH
65F25B45978C5E3BDA4D6EBC6CB2530207F58323A18AF75FACAC85A59A533D804243DB

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
[Authenticode]_bd396a06.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
java.Properties.Resources.resources
​         
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

Authenticode present at 0x7800 size 6128 bytes

Module Name

java.exe

Full Name

java.exe

EntryPoint

System.Void  ::()

Scope Name

java.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

java

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

0

Main Method

System.Void  ::()

Main IL Instruction Count

18

Main IL

call System.Boolean  ::() brtrue.s IL_0025: call System.Void  ::() ldc.i4 -1241187898 call System.String ::(System.Int32) ldc.i4 -1241187857 call System.String ::(System.Int32) ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ret <null> call System.Void  ::() call System.Threading.Tasks.Task  ::() callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>

Module Name

java.exe

Full Name

java.exe

EntryPoint

System.Void  ::()

Scope Name

java.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

java

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

0

Main Method

System.Void  ::()

Main IL Instruction Count

18

Main IL

call System.Boolean  ::() brtrue.s IL_0025: call System.Void  ::() ldc.i4 -1241187898 call System.String ::(System.Int32) ldc.i4 -1241187857 call System.String ::(System.Int32) ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ret <null> call System.Void  ::() call System.Threading.Tasks.Task  ::() callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null>

493874cc7b52bf5a41955d1c8f0792cc (36.85 KB)
File Structure
[Authenticode]_bd396a06.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
java.Properties.Resources.resources
​         
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙