Suspicious
Suspect

4db4c4a2593416a92478a7e6cddd8bb1

PE Executable
|
MD5: 4db4c4a2593416a92478a7e6cddd8bb1
|
Size: 176.13 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
Hash Value
MD5
4db4c4a2593416a92478a7e6cddd8bb1
Sha1
ec48b8b1b82ca754140fc18bf76772203bddbf25
Sha256
74198831c9211b33775a6fb0b324731d701c44fd716484715453261252e5d6cb
Sha384
82ca4cc16cd8b759b03fc440c45821c0ef9c24e1e2521feadc917ee771bf1f6b78215f16771c8ae46d10632fd1646613
Sha512
575f00836d86a5c799b47dbb367d1f8317f5322b513767faf3b4c6b7266a5ab7193a18c7dc9247a2af169ec5a339af5a99d7e9472492f5a2f37238efa66c051c
SSDeep
3072:NFPrM5phEMIMpS4SG8Ju+za5t3RGrFSu1H9ZOy8ey5q0sV7Qzlx2P/vI:N12p/zpwdq5t3UI2H9ZOy8eAq032
TLSH
22045B1933FC9608F1FFCAB96CF121194AB5F9A79523D35E085216AD0C72B809A51FB3

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

output.exe

Full Name

output.exe

EntryPoint

System.Void StandaloneLoader::Main()

Scope Name

output.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

output

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

2

Main Method

System.Void StandaloneLoader::Main()

Main IL Instruction Count

31

Main IL

ldsfld System.Byte[] StandaloneLoader::stubBytes call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.0 <null> ldloc.0 <null> ldstr Class8 callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.1 <null> ldloc.1 <null> ldnull <null> call System.Boolean System.Type::op_Equality(System.Type,System.Type) brfalse.s IL_0022: ldloc.1 leave.s IL_0049: ret ldloc.1 <null> ldstr smethod_0 ldc.i4.s 56 callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags) stloc.2 <null> ldloc.2 <null> ldnull <null> call System.Boolean System.Reflection.MethodInfo::op_Equality(System.Reflection.MethodInfo,System.Reflection.MethodInfo) brfalse.s IL_003B: ldloc.2 leave.s IL_0049: ret ldloc.2 <null> ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0049: ret pop <null> leave.s IL_0049: ret ret <null>

Module Name

output.exe

Full Name

output.exe

EntryPoint

System.Void StandaloneLoader::Main()

Scope Name

output.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

output

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

2

Main Method

System.Void StandaloneLoader::Main()

Main IL Instruction Count

31

Main IL

ldsfld System.Byte[] StandaloneLoader::stubBytes call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.0 <null> ldloc.0 <null> ldstr Class8 callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.1 <null> ldloc.1 <null> ldnull <null> call System.Boolean System.Type::op_Equality(System.Type,System.Type) brfalse.s IL_0022: ldloc.1 leave.s IL_0049: ret ldloc.1 <null> ldstr smethod_0 ldc.i4.s 56 callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags) stloc.2 <null> ldloc.2 <null> ldnull <null> call System.Boolean System.Reflection.MethodInfo::op_Equality(System.Reflection.MethodInfo,System.Reflection.MethodInfo) brfalse.s IL_003B: ldloc.2 leave.s IL_0049: ret ldloc.2 <null> ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0049: ret pop <null> leave.s IL_0049: ret ret <null>

4db4c4a2593416a92478a7e6cddd8bb1 (176.13 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙