Suspicious
Suspect

5e3a14c15c3f19441573607dc804dea9

PE Executable
|
MD5: 5e3a14c15c3f19441573607dc804dea9
|
Size: 584.19 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
5e3a14c15c3f19441573607dc804dea9
Sha1
33f8be954dd8117f1a7eebaa2bd02492472fb4ec
Sha256
e68cbefe7e20a42d764b2e6c4fb1a343d6dae85c9caac0e5788830b2afd1909d
Sha384
8a802397d5e8db5ee992ec34123b40e16007e2f2d035f49c0bfa8d5560a63502c397203b466346b9b11fb72685cbd4ba
Sha512
815042d2b43ed5dfb4ef5ded28955283d25aeb2ee8ccf9b915bb05c91217cc62ae08bc045cee2a85b3e7ff983e0dbe7d230c1dc785401710dcd810913f79fa57
SSDeep
12288:3GcsdgtrE0aPQ15EnVBYjkLpBbJynE1yfJIx+IezCL7Qi:2csU/WOEnTCkNB1yBm+I42
TLSH
EFC423193B39C63AC1AF113BCE93617272F5D01C5963937C7EA6D300180776EB562BA6

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
5e3a14c15c3f19441573607dc804dea9
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Dpiukp.Properties.Resources.resources
Lzjsilx
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Dpiukp.exe
Full Name

Dpiukp.exe
EntryPoint

System.Void Dpiukp.Ljajprzuxka::Main()
Scope Name

Dpiukp.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Dpiukp
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

5
Main Method

System.Void Dpiukp.Ljajprzuxka::Main()
Main IL Instruction Count

70
Main IL

nop <null> call System.Byte[] Dpiukp.Ljajprzuxka::oUyoft3Nm() call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Type[] System.Reflection.Assembly::GetExportedTypes() stloc.s V_0 ldc.i4 1 ldsfld <Module>{7524a511-de7c-48cc-8855-47581ffb825c} <Module>{7524a511-de7c-48cc-8855-47581ffb825c}::m_e7fad479819e401ba6a4b95db57d2749 ldfld System.Int32 <Module>{7524a511-de7c-48cc-8855-47581ffb825c}::m_7278d8e98de94a1d8ef61c89d9604671 brtrue IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) pop <null> ldc.i4 0 br IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) br IL_003F: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 990 beq IL_003F: ldloc V_2 br IL_00AC: br IL_0067 ldloc.s V_1 ldloc.s V_0 ldlen <null> conv.i4 <null> blt IL_00E3: ldloc.s V_0 ldc.i4 2 br IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) nop <null> ldloc.s V_3 ldstr y2jKEkRJE ldc.i4 256 ldnull <null> ldnull <null> ldnull <null> callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) pop <null> br IL_0097: leave IL_00B6 leave IL_00B6: ldloc.s V_1 pop <null> br IL_00A2: leave IL_00B6 leave IL_00B6: ldloc.s V_1 br IL_00B6: ldloc.s V_1 br IL_0067: ldloc.s V_1 br IL_00E3: ldloc.s V_0 ldloc.s V_1 ldc.i4.1 <null> add <null> stloc.s V_1 br IL_0067: ldloc.s V_1 ldc.i4.0 <null> stloc.s V_1 ldc.i4 1 ldsfld <Module>{7524a511-de7c-48cc-8855-47581ffb825c} <Module>{7524a511-de7c-48cc-8855-47581ffb825c}::m_e7fad479819e401ba6a4b95db57d2749 ldfld System.Int32 <Module>{7524a511-de7c-48cc-8855-47581ffb825c}::m_009e5529ad1249af80665de1eba33d39 brtrue IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) pop <null> ldc.i4 0 br IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) ldloc.s V_0 ldloc.s V_1 ldelem.ref <null> stloc.s V_3 br IL_007C: nop leave IL_0104: ret pop <null> br IL_00FA: leave IL_0104 leave IL_0104: ret br IL_0104: ret ret <null>
Module Name

Dpiukp.exe
Full Name

Dpiukp.exe
EntryPoint

System.Void Dpiukp.Ljajprzuxka::Main()
Scope Name

Dpiukp.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Dpiukp
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

5
Main Method

System.Void Dpiukp.Ljajprzuxka::Main()
Main IL Instruction Count

70
Main IL

nop <null> call System.Byte[] Dpiukp.Ljajprzuxka::oUyoft3Nm() call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Type[] System.Reflection.Assembly::GetExportedTypes() stloc.s V_0 ldc.i4 1 ldsfld <Module>{7524a511-de7c-48cc-8855-47581ffb825c} <Module>{7524a511-de7c-48cc-8855-47581ffb825c}::m_e7fad479819e401ba6a4b95db57d2749 ldfld System.Int32 <Module>{7524a511-de7c-48cc-8855-47581ffb825c}::m_7278d8e98de94a1d8ef61c89d9604671 brtrue IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) pop <null> ldc.i4 0 br IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) br IL_003F: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 990 beq IL_003F: ldloc V_2 br IL_00AC: br IL_0067 ldloc.s V_1 ldloc.s V_0 ldlen <null> conv.i4 <null> blt IL_00E3: ldloc.s V_0 ldc.i4 2 br IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) nop <null> ldloc.s V_3 ldstr y2jKEkRJE ldc.i4 256 ldnull <null> ldnull <null> ldnull <null> callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) pop <null> br IL_0097: leave IL_00B6 leave IL_00B6: ldloc.s V_1 pop <null> br IL_00A2: leave IL_00B6 leave IL_00B6: ldloc.s V_1 br IL_00B6: ldloc.s V_1 br IL_0067: ldloc.s V_1 br IL_00E3: ldloc.s V_0 ldloc.s V_1 ldc.i4.1 <null> add <null> stloc.s V_1 br IL_0067: ldloc.s V_1 ldc.i4.0 <null> stloc.s V_1 ldc.i4 1 ldsfld <Module>{7524a511-de7c-48cc-8855-47581ffb825c} <Module>{7524a511-de7c-48cc-8855-47581ffb825c}::m_e7fad479819e401ba6a4b95db57d2749 ldfld System.Int32 <Module>{7524a511-de7c-48cc-8855-47581ffb825c}::m_009e5529ad1249af80665de1eba33d39 brtrue IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) pop <null> ldc.i4 0 br IL_0043: switch(IL_00C1,IL_00AC,IL_00EF) ldloc.s V_0 ldloc.s V_1 ldelem.ref <null> stloc.s V_3 br IL_007C: nop leave IL_0104: ret pop <null> br IL_00FA: leave IL_0104 leave IL_0104: ret br IL_0104: ret ret <null>
5e3a14c15c3f19441573607dc804dea9 (584.19 KB)
File Structure
5e3a14c15c3f19441573607dc804dea9
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Dpiukp.Properties.Resources.resources
Lzjsilx
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙