Suspicious
Suspect

5600ff015e553dd0de1f34ee5637bfd0

PE Executable
|
MD5: 5600ff015e553dd0de1f34ee5637bfd0
|
Size: 1.2 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
Hash Value
MD5
5600ff015e553dd0de1f34ee5637bfd0
Sha1
b401326990f163f75ccc3e070e55a0024df7765e
Sha256
a6cb841d8ae8fdf6631fa2e8235f07b946cc38fd08a67e542cdc697506faf462
Sha384
899d58bc76482a85493353eee02c30d23af3c17b2d750de15820129f671a612ae136eb94993f9b765c9fbf9fd74703f8
Sha512
aedcc908200ac9a9f788257543658e116646863b8452f2a8d72e06b19cc9ffc5bfabe6d8483d087f6c62e161a217ada0ef71f164c014568acf4dcbbb706b3919
SSDeep
24576:idZZzdCJvkYzllNkPbdb9tV2C599Otv810BX5rJWmA:ivZzdizzjepb962ktfNrA
TLSH
B545BEE023D88914F4BF5B38683545671AB3B82EDD34CA1D2D92BE8F2D71B458822777

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Yzj23cZba.g.resources
Yzj23cZba.Resources.resources
7372ad7d08ae49.Resources.resources
66b153dd0
[NBF]root.Data
66b153dd1
[NBF]root.Data
66b153dd10
[NBF]root.Data
66b153dd11
[NBF]root.Data
66b153dd12
[NBF]root.Data
66b153dd13
[NBF]root.Data
66b153dd14
[NBF]root.Data
66b153dd15
[NBF]root.Data
66b153dd16
[NBF]root.Data
66b153dd17
[NBF]root.Data
66b153dd18
[NBF]root.Data
66b153dd19
[NBF]root.Data
66b153dd2
[NBF]root.Data
66b153dd20
[NBF]root.Data
66b153dd21
[NBF]root.Data
66b153dd22
[NBF]root.Data
66b153dd23
[NBF]root.Data
66b153dd24
[NBF]root.Data
66b153dd25
[NBF]root.Data
66b153dd3
[NBF]root.Data
66b153dd4
[NBF]root.Data
66b153dd5
[NBF]root.Data
66b153dd6
[NBF]root.Data
66b153dd7
[NBF]root.Data
66b153dd8
[NBF]root.Data
66b153dd9
[NBF]root.Data
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

Yzj23cZba

Full Name

Yzj23cZba

EntryPoint

System.Void Yzj23cZba.Zce9in8ENto/wBa8i2Gn.Rp1p3Ztdg::3neE_7A()

Scope Name

Yzj23cZba

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Yzj23cZba

Assembly Version

10.28.1.188

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1195

Main Method

System.Void Yzj23cZba.Zce9in8ENto/wBa8i2Gn.Rp1p3Ztdg::3neE_7A()

Main IL Instruction Count

39

Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.0 <null> ldloc.0 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) stloc.3 <null> ldloc.3 <null> brfalse.s IL_0027: ldc.i4.s 100 ldstr 1.6.4.9 stloc.0 <null> ldc.i4.s 100 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr AppConfig.dat call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> newobj System.Void Yzj23cZba.Sk9jy0rP::.ctor() stloc.2 <null> ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> leave.s IL_0067: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0067: nop nop <null> ret <null>

Module Name

Yzj23cZba

Full Name

Yzj23cZba

EntryPoint

System.Void Yzj23cZba.Zce9in8ENto/wBa8i2Gn.Rp1p3Ztdg::3neE_7A()

Scope Name

Yzj23cZba

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Yzj23cZba

Assembly Version

10.28.1.188

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1195

Main Method

System.Void Yzj23cZba.Zce9in8ENto/wBa8i2Gn.Rp1p3Ztdg::3neE_7A()

Main IL Instruction Count

39

Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.0 <null> ldloc.0 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) stloc.3 <null> ldloc.3 <null> brfalse.s IL_0027: ldc.i4.s 100 ldstr 1.6.4.9 stloc.0 <null> ldc.i4.s 100 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr AppConfig.dat call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> newobj System.Void Yzj23cZba.Sk9jy0rP::.ctor() stloc.2 <null> ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> leave.s IL_0067: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0067: nop nop <null> ret <null>

5600ff015e553dd0de1f34ee5637bfd0 (1.2 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
ID:0033
ID:0
ID:0034
ID:0
ID:0035
ID:0
ID:0036
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Yzj23cZba.g.resources
Yzj23cZba.Resources.resources
7372ad7d08ae49.Resources.resources
66b153dd0
[NBF]root.Data
66b153dd1
[NBF]root.Data
66b153dd10
[NBF]root.Data
66b153dd11
[NBF]root.Data
66b153dd12
[NBF]root.Data
66b153dd13
[NBF]root.Data
66b153dd14
[NBF]root.Data
66b153dd15
[NBF]root.Data
66b153dd16
[NBF]root.Data
66b153dd17
[NBF]root.Data
66b153dd18
[NBF]root.Data
66b153dd19
[NBF]root.Data
66b153dd2
[NBF]root.Data
66b153dd20
[NBF]root.Data
66b153dd21
[NBF]root.Data
66b153dd22
[NBF]root.Data
66b153dd23
[NBF]root.Data
66b153dd24
[NBF]root.Data
66b153dd25
[NBF]root.Data
66b153dd3
[NBF]root.Data
66b153dd4
[NBF]root.Data
66b153dd5
[NBF]root.Data
66b153dd6
[NBF]root.Data
66b153dd7
[NBF]root.Data
66b153dd8
[NBF]root.Data
66b153dd9
[NBF]root.Data
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙