Suspicious
Suspect

5138fc07ae7ee1bdca165f5619b7db2a

PE Executable
|
MD5: 5138fc07ae7ee1bdca165f5619b7db2a
|
Size: 73.73 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
5138fc07ae7ee1bdca165f5619b7db2a
Sha1
beb64a09c2a467256f98285ee756598a9d04c62b
Sha256
64e1f83d15ab71c256ba99e2d752051295c2e5086de8816ccf113e9fafa637fc
Sha384
345985d9add6cbb19c37c61a46d862127083850bbeff05f72a6829047d5a97d6612e3def62e8e51a29fc1e3e8541d89f
Sha512
1add1c0f83e6f39f7f953623797fcaac9c399c07a40d4bda97219d56dbf384a31070b958ce3286ff293f2ddcfd7eae49778281325d08c0457561035ce9504197
SSDeep
1536:vAWAjp+2X0wbL0YbuTei16vmXj0zfOnuaX9sWaE9L9CSeMMn:o/xbb43z6eXjE8u89XRNetn
TLSH
63733C0CEF945A11E69CC97F94910000E3F5E5A5320FEF6B6FE074BC8496FE92215A9B

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
5138fc07ae7ee1bdca165f5619b7db2a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hpaBe
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Toyuz.exe
Full Name

Toyuz.exe
EntryPoint

System.Void Zxwmv.Zvdoxvtgo::Main()
Scope Name

Toyuz.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Toyuz
Assembly Version

1.0.4126.3926
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

16
Main Method

System.Void Zxwmv.Zvdoxvtgo::Main()
Main IL Instruction Count

178
Main IL

nop <null> nop <null> br.s IL_003F: ldc.i4.s 71 ldloc.s V_7 ldc.i4.s 73 xor <null> stloc.s V_7 br.s IL_0034: ldc.i4.s 88 ldloc.s V_8 ldc.i4.s 80 xor <null> stloc.s V_8 br IL_010F: ldc.i4.s -25 ldloc.s V_8 ldc.i4.s 78 add <null> switch dnlib.DotNet.Emit.Instruction[] br IL_011A: ldc.i4.s 34 ldc.i4.s 88 call System.Int32 Zxwmv.Udlmyfc::b(System.Int32) stloc.s V_8 br.s IL_000D: ldloc.s V_8 ldc.i4.s 71 call System.Int32 Zxwmv.Udlmyfc::b(System.Int32) stloc.s V_7 br IL_0125: ldc.i4.s -43 ldc.i4.s -28 stloc.s V_8 br.s IL_000D: ldloc.s V_8 ldloc.s V_7 ldc.i4.s 68 add <null> switch dnlib.DotNet.Emit.Instruction[] ldc.i4.s -30 stloc.s V_8 br.s IL_000D: ldloc.s V_8 br IL_0004: ldloc.s V_7 nop <null> ldc.i4.s 83 call System.Int32 Zxwmv.Udlmyfc::b(System.Int32) stloc.s V_7 br IL_0004: ldloc.s V_7 ldc.i4 29543 call System.String v::a(System.Int32) newobj System.Void System.Version::.ctor(System.String) stloc.0 <null> ldc.i4.s -117 stloc.s V_7 br IL_0004: ldloc.s V_7 newobj System.Void i::.ctor() stloc.3 <null> ldc.i4.s -10 stloc.s V_7 br IL_0004: ldloc.s V_7 newobj System.Void j::.ctor() stloc.s V_4 ldc.i4.s -118 stloc.s V_7 br IL_0004: ldloc.s V_7 newobj System.Void h::.ctor() stloc.2 <null> ldc.i4.s -9 stloc.s V_7 br IL_0004: ldloc.s V_7 ldc.i4 4032 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.s -11 stloc.s V_7 br IL_0004: ldloc.s V_7 ldnull <null> ldloc.0 <null> newobj System.Void g::.ctor(System.String,System.Version) stloc.1 <null> ldc.i4.s -119 stloc.s V_7 br IL_0004: ldloc.s V_7 ldloc.2 <null> ldloc.3 <null> ldloc.s V_4 newobj System.Void k::.ctor(h,i,j) stloc.s V_5 br.s IL_012E: nop ldc.i4.s -25 ldc.i4.s -49 bgt IL_0019: ldloc.s V_8 br.s IL_012E: nop ldc.i4.s 34 ldc.i4.s 85 blt IL_0034: ldc.i4.s 88 br.s IL_012E: nop ldc.i4.s -43 ldc.i4.s -63 bgt IL_004D: ldc.i4.s -28 nop <null> ldloc.1 <null> ldloc.s V_5 ldftn System.Void k::a(System.Object,a) newobj System.Void System.EventHandler`1<a>::.ctor(System.Object,System.IntPtr) callvirt System.Void g::add_a(System.EventHandler`1<a>) br.s IL_0181: ldc.i4.s 77 ldloc.s V_6 ldc.i4.s 33 xor <null> stloc.s V_6 ldloc.s V_6 ldc.i4.s 38 add <null> switch dnlib.DotNet.Emit.Instruction[] ldc.i4.s 77 call System.Int32 Zxwmv.Udlmyfc::b(System.Int32) stloc.s V_6 br.s IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -62 stloc.s V_6 br.s IL_0144: ldloc.s V_6 ldloc.1 <null> callvirt System.Void g::a() ldc.i4.s -64 stloc.s V_6 br.s IL_0144: ldloc.s V_6 ldloc.s V_4 ldloc.s V_5 ldftn System.Void k::d(System.Object,d) newobj System.Void System.EventHandler`1<d>::.ctor(System.Object,System.IntPtr) callvirt System.Void j::add_a(System.EventHandler`1<d>) ldc.i4.s -4 stloc.s V_6 br.s IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -6 stloc.s V_6 br.s IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -3 stloc.s V_6 br IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -61 stloc.s V_6 br IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -59 stloc.s V_6 br IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -63 stloc.s V_6 br IL_0144: ldloc.s V_6 ldloc.3 <null> ldloc.s V_5 ldftn System.Void k::c(System.Object,c) newobj System.Void System.EventHandler`1<c>::.ctor(System.Object,System.IntPtr) callvirt System.Void i::add_a(System.EventHandler`1<c>) ldc.i4.m1 <null> stloc.s V_6 br IL_0144: ldloc.s V_6 ldloc.2 <null> ldloc.s V_5 ldftn System.Void k::b(System.Object,b) newobj System.Void System.EventHandler`1<b>::.ctor(System.Object,System.IntPtr) callvirt System.Void h::add_a(System.EventHandler`1<b>) ldc.i4.s -2 stloc.s V_6 br IL_0144: ldloc.s V_6 leave.s IL_0236: ret ldloc.s V_5 brfalse.s IL_0228: ldc.i4.1 ldc.i4.0 <null> br.s IL_022B: brtrue.s IL_0235 ldc.i4.1 <null> br.s IL_022B: brtrue.s IL_0235 brtrue.s IL_0235: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>
Module Name

Toyuz.exe
Full Name

Toyuz.exe
EntryPoint

System.Void Zxwmv.Zvdoxvtgo::Main()
Scope Name

Toyuz.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Toyuz
Assembly Version

1.0.4126.3926
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

16
Main Method

System.Void Zxwmv.Zvdoxvtgo::Main()
Main IL Instruction Count

178
Main IL

nop <null> nop <null> br.s IL_003F: ldc.i4.s 71 ldloc.s V_7 ldc.i4.s 73 xor <null> stloc.s V_7 br.s IL_0034: ldc.i4.s 88 ldloc.s V_8 ldc.i4.s 80 xor <null> stloc.s V_8 br IL_010F: ldc.i4.s -25 ldloc.s V_8 ldc.i4.s 78 add <null> switch dnlib.DotNet.Emit.Instruction[] br IL_011A: ldc.i4.s 34 ldc.i4.s 88 call System.Int32 Zxwmv.Udlmyfc::b(System.Int32) stloc.s V_8 br.s IL_000D: ldloc.s V_8 ldc.i4.s 71 call System.Int32 Zxwmv.Udlmyfc::b(System.Int32) stloc.s V_7 br IL_0125: ldc.i4.s -43 ldc.i4.s -28 stloc.s V_8 br.s IL_000D: ldloc.s V_8 ldloc.s V_7 ldc.i4.s 68 add <null> switch dnlib.DotNet.Emit.Instruction[] ldc.i4.s -30 stloc.s V_8 br.s IL_000D: ldloc.s V_8 br IL_0004: ldloc.s V_7 nop <null> ldc.i4.s 83 call System.Int32 Zxwmv.Udlmyfc::b(System.Int32) stloc.s V_7 br IL_0004: ldloc.s V_7 ldc.i4 29543 call System.String v::a(System.Int32) newobj System.Void System.Version::.ctor(System.String) stloc.0 <null> ldc.i4.s -117 stloc.s V_7 br IL_0004: ldloc.s V_7 newobj System.Void i::.ctor() stloc.3 <null> ldc.i4.s -10 stloc.s V_7 br IL_0004: ldloc.s V_7 newobj System.Void j::.ctor() stloc.s V_4 ldc.i4.s -118 stloc.s V_7 br IL_0004: ldloc.s V_7 newobj System.Void h::.ctor() stloc.2 <null> ldc.i4.s -9 stloc.s V_7 br IL_0004: ldloc.s V_7 ldc.i4 4032 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.s -11 stloc.s V_7 br IL_0004: ldloc.s V_7 ldnull <null> ldloc.0 <null> newobj System.Void g::.ctor(System.String,System.Version) stloc.1 <null> ldc.i4.s -119 stloc.s V_7 br IL_0004: ldloc.s V_7 ldloc.2 <null> ldloc.3 <null> ldloc.s V_4 newobj System.Void k::.ctor(h,i,j) stloc.s V_5 br.s IL_012E: nop ldc.i4.s -25 ldc.i4.s -49 bgt IL_0019: ldloc.s V_8 br.s IL_012E: nop ldc.i4.s 34 ldc.i4.s 85 blt IL_0034: ldc.i4.s 88 br.s IL_012E: nop ldc.i4.s -43 ldc.i4.s -63 bgt IL_004D: ldc.i4.s -28 nop <null> ldloc.1 <null> ldloc.s V_5 ldftn System.Void k::a(System.Object,a) newobj System.Void System.EventHandler`1<a>::.ctor(System.Object,System.IntPtr) callvirt System.Void g::add_a(System.EventHandler`1<a>) br.s IL_0181: ldc.i4.s 77 ldloc.s V_6 ldc.i4.s 33 xor <null> stloc.s V_6 ldloc.s V_6 ldc.i4.s 38 add <null> switch dnlib.DotNet.Emit.Instruction[] ldc.i4.s 77 call System.Int32 Zxwmv.Udlmyfc::b(System.Int32) stloc.s V_6 br.s IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -62 stloc.s V_6 br.s IL_0144: ldloc.s V_6 ldloc.1 <null> callvirt System.Void g::a() ldc.i4.s -64 stloc.s V_6 br.s IL_0144: ldloc.s V_6 ldloc.s V_4 ldloc.s V_5 ldftn System.Void k::d(System.Object,d) newobj System.Void System.EventHandler`1<d>::.ctor(System.Object,System.IntPtr) callvirt System.Void j::add_a(System.EventHandler`1<d>) ldc.i4.s -4 stloc.s V_6 br.s IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -6 stloc.s V_6 br.s IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -3 stloc.s V_6 br IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -61 stloc.s V_6 br IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -59 stloc.s V_6 br IL_0144: ldloc.s V_6 nop <null> ldc.i4.s -63 stloc.s V_6 br IL_0144: ldloc.s V_6 ldloc.3 <null> ldloc.s V_5 ldftn System.Void k::c(System.Object,c) newobj System.Void System.EventHandler`1<c>::.ctor(System.Object,System.IntPtr) callvirt System.Void i::add_a(System.EventHandler`1<c>) ldc.i4.m1 <null> stloc.s V_6 br IL_0144: ldloc.s V_6 ldloc.2 <null> ldloc.s V_5 ldftn System.Void k::b(System.Object,b) newobj System.Void System.EventHandler`1<b>::.ctor(System.Object,System.IntPtr) callvirt System.Void h::add_a(System.EventHandler`1<b>) ldc.i4.s -2 stloc.s V_6 br IL_0144: ldloc.s V_6 leave.s IL_0236: ret ldloc.s V_5 brfalse.s IL_0228: ldc.i4.1 ldc.i4.0 <null> br.s IL_022B: brtrue.s IL_0235 ldc.i4.1 <null> br.s IL_022B: brtrue.s IL_0235 brtrue.s IL_0235: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>
5138fc07ae7ee1bdca165f5619b7db2a (73.73 KB)
File Structure
5138fc07ae7ee1bdca165f5619b7db2a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hpaBe
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙