Suspicious
Suspect

5ee45764082ef60c997530a1b94233b8

PE Executable
|
MD5: 5ee45764082ef60c997530a1b94233b8
|
Size: 3.29 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
5ee45764082ef60c997530a1b94233b8
Sha1
b0c433c5c8e0f9a198fc31019fb587a2c9ae919d
Sha256
6e4f9663e0f5132a1213276c30bdbe5144d07b26edb65126d479c525128cf432
Sha384
167cddf35ef2fddc5a5a23606978799ad929ea2a87aa35c5b236605d4ab815c19d48d85e46e2048d9ca257a3e669ab00
Sha512
1107c6616d3d14cdc6c3f34dba8c3e215360df4564773e96c9cf8af0a196054bba3a40e3cfcd9449ab99ae2900e1db7f2514986be7db08ffaacd413e87232536
SSDeep
49152:5vlt62XlaSFNWPjljiFa2RoUYIoTxNESETk/i0LoGdrtyTHHB72eh2NT:5vX62XlaSFNWPjljiFXRoUYIsxi67t
TLSH
DBE55B143BF85F23E1BBE273D5B0041667F0E82AB3A3EB1B5191677E1C53B5058426AB

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
5ee45764082ef60c997530a1b94233b8
[Rebuild from dump]_5337a276.exe
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
Informations
Name
 Value
Info

PE Detect: PeReader FAIL, AsmResolver Mapped OK
Info

Remap: Mapped -> FileLayout (RAM only) as [Rebuild from dump]_5337a276.exe
Module Name

Client
Full Name

Client
EntryPoint

System.Void 둛歛컎쬝Ꝏ삦♽⟴쮻䉚쥕ߞ၆顯뺾⟸성퓷剙::Main(System.String[])
Scope Name

Client
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.4.1.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5.2
Total Strings

11123
Main Method

System.Void 둛歛컎쬝Ꝏ삦♽⟴쮻䉚쥕ߞ၆顯뺾⟸성퓷剙::Main(System.String[])
Main IL Instruction Count

19
Main IL

ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 둛歛컎쬝Ꝏ삦♽⟴쮻䉚쥕ߞ၆顯뺾⟸성퓷剙::띦䖖ㆃ褺췳首ㄾ�헜랿ﵮ瘭褨갎쾚ꃡ綐㌝駾ব(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 둛歛컎쬝Ꝏ삦♽⟴쮻䉚쥕ߞ၆顯뺾⟸성퓷剙::ﵵ屮쇰ⷑ檆긥¦ᱱ邿犟ᱨ묧뤌씷�괇趍쓈(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 榼ペ䇐″ṵŪ蛬핮꒔띾촱놣繐ꧠ楷練⣑볻츹::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Module Name

Client
Full Name

Client
EntryPoint

System.Void 둛歛컎쬝Ꝏ삦♽⟴쮻䉚쥕ߞ၆顯뺾⟸성퓷剙::Main(System.String[])
Scope Name

Client
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.4.1.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5.2
Total Strings

11123
Main Method

System.Void 둛歛컎쬝Ꝏ삦♽⟴쮻䉚쥕ߞ၆顯뺾⟸성퓷剙::Main(System.String[])
Main IL Instruction Count

19
Main IL

ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.2 <null> call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode) ldnull <null> ldftn System.Void 둛歛컎쬝Ꝏ삦♽⟴쮻䉚쥕ߞ၆顯뺾⟸성퓷剙::띦䖖ㆃ褺췳首ㄾ�헜랿ﵮ瘭褨갎쾚ꃡ綐㌝駾ব(System.Object,System.Threading.ThreadExceptionEventArgs) newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr) call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler) call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void 둛歛컎쬝Ꝏ삦♽⟴쮻䉚쥕ߞ၆顯뺾⟸성퓷剙::ﵵ屮쇰ⷑ檆긥¦ᱱ邿犟ᱨ묧뤌씷�괇趍쓈(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void 榼ペ䇐″ṵŪ蛬핮꒔띾촱놣繐ꧠ楷練⣑볻츹::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>
Artefacts
Name
 Value
PE Layout

MemoryMapped (process dump suspected)
PE Layout

MemoryMapped (process dump suspected)
5ee45764082ef60c997530a1b94233b8 (3.29 MB)
File Structure
5ee45764082ef60c997530a1b94233b8
[Rebuild from dump]_5337a276.exe
.Net Resources
Quasar.Client.Properties.Resources.resources
ILRepack.List
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
PE Layout

MemoryMapped (process dump suspected)

5ee45764082ef60c997530a1b94233b8
PE Layout

MemoryMapped (process dump suspected)

5ee45764082ef60c997530a1b94233b8 > [Rebuild from dump]_5337a276.exe
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙