General
Structural Analysis
Config.0
Yara Rules99+
Sync
Community
Summary by MalvaGPT
Characteristics
Symbol Obfuscation Score
Low
|
Hash | Hash Value |
|---|---|
| MD5 | 646586043c05831046852c8b8e48f15f
|
| Sha1 | 0b4f2816ae6598763e3f243979157aa9c67ccb3b
|
| Sha256 | cea61b4a9b33918afab25a788717902248193ede839dc572428d7a6dcbc4e069
|
| Sha384 | 127d20309d43c84afb76f12db51358c043ed62cb37c760d5d877b3bef7b28ac265678b56b64959f638450562545ed7c3
|
| Sha512 | 73c6f8669bee8c45f3a4f54c301b3b1f26512aecc4d38530531e5d5298111dc06d7e0c1787aa277763dc7550d6f622963c62424756d418eadeb2692f2d89ce87
|
| SSDeep | 12288:H9aNWvkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabm3NUW6:H9RkqjVnlqud+/2P+ATAS/JYec3NUn
|
| TLSH | ADF4DF6873F85A00F1FF5BB294B59D51AB35B513A962D71E11C081C80E72B918F8AF3B
|
PeID
.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ v6.0 DLL
Microsoft Visual Studio .NET
File Structure
646586043c05831046852c8b8e48f15f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Properties.Resources.resources
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.newtonsoft.json.dll.compressed
costura.newtonsoft.json.dll
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.dll.compressed
costura.icsharpcode.sharpziplib.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.system.diagnostics.diagnosticsource.dll.compressed
costura.system.diagnostics.diagnosticsource.dll
[Authenticode]_50c89911.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
Informations
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | PDB Path: ? |
| Module Name | stub.exe |
| Full Name | stub.exe |
| EntryPoint | System.Void Stub.Program::<Main>() |
| Scope Name | stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.8 |
| Total Strings | 3177 |
| Main Method | System.Void Stub.Program::<Main>() |
| Main IL Instruction Count | 6 |
| Main IL | call System.Threading.Tasks.Task Stub.Program::Main() callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null> |
| Module Name | stub.exe |
| Full Name | stub.exe |
| EntryPoint | System.Void Stub.Program::<Main>() |
| Scope Name | stub.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | stub |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.8 |
| Total Strings | 3177 |
| Main Method | System.Void Stub.Program::<Main>() |
| Main IL Instruction Count | 6 |
| Main IL | call System.Threading.Tasks.Task Stub.Program::Main() callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null> |
646586043c05831046852c8b8e48f15f (750.59 KB)
File Structure
646586043c05831046852c8b8e48f15f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Stub.Properties.Resources.resources
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.newtonsoft.json.dll.compressed
costura.newtonsoft.json.dll
[Authenticode]_220cad77.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.dll.compressed
costura.icsharpcode.sharpziplib.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.icsharpcode.sharpziplib.pdb.compressed
costura.system.diagnostics.diagnosticsource.dll.compressed
costura.system.diagnostics.diagnosticsource.dll
[Authenticode]_50c89911.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
Resources.ProductVersion
Resources.CompanyName
Resources.ProductName
Resources.LegalCopyright
Resources.FileDescription
Resources.OriginalFilename
Resources.InternalName
Resources.BuildVersion
Resources.PrivateBuild
Resources.SYS_SVC_START
Resources.SYS_SVC_STOP
Resources.SYS_SVC_PAUSE
Resources.SYS_SVC_RESUME
Resources.SYS_NET_CONNECT
Resources.SYS_UPDATE_CHECK
Resources.SYS_SEC_SCAN
Resources.AppIcon
Resources.AppIcon-preview.png
Resources.Manifest
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
You need a premium account to access this feature.
You must be signed in to post a comment.