Suspicious
Suspect

666e71c48bde753cfdd0a5f02fced2d3

PE Executable
|
MD5: 666e71c48bde753cfdd0a5f02fced2d3
|
Size: 95.23 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
666e71c48bde753cfdd0a5f02fced2d3
Sha1
ac2563121047c627065a8b5bf2ee31b0163c9a2c
Sha256
69b8f27f428b2a5a67f96155f9be8791805504c3d9efdd411e5f25f5c8d284f2
Sha384
7cc68b31fe2d25679af0f8cce0d01bdf937a7f910b6166b82296120c87bb1dc1e1959781ae22abf555ff46ab1d6f1277
Sha512
f7a19488f395f6847ce57020bb1a24d6b11efce4ac6709f56c838669a123f357fbaf713a0f70ede148193fcc60b1848dc8b9b3314f0a0e58205b81bb799b98cd
SSDeep
1536:7UwC+xhUa9urgOBPRNvM4jEwzGi1dDYD2gS:7UmUa9urgObdGi1dub
TLSH
D393E74977E52524E4BF56F79472F2004E34B44B1602E39E49F259EA0A33AC44F89FEB

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

Stub.exe

Full Name

Stub.exe

EntryPoint

System.Void Stub.A::main()

Scope Name

Stub.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v2.0.50727

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Stub

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

1272

Main Method

System.Void Stub.A::main()

Main IL Instruction Count

25

Main IL

nop <null> ldc.i4.1 <null> stsfld System.Boolean Stub.A::runx ldnull <null> ldftn System.Void Stub.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.A::thx ldsfld System.Threading.Thread Stub.A::thx callvirt System.Void System.Threading.Thread::Start() nop <null> ldc.i4.1 <null> stsfld System.Boolean Stub.A::runy ldnull <null> ldftn System.Void Stub.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.A::thy ldsfld System.Threading.Thread Stub.A::thy callvirt System.Void System.Threading.Thread::Start() nop <null> call System.Void Stub.Fransesco::ko() nop <null> nop <null> ret <null>

Module Name

Stub.exe

Full Name

Stub.exe

EntryPoint

System.Void Stub.A::main()

Scope Name

Stub.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v2.0.50727

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Stub

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

1272

Main Method

System.Void Stub.A::main()

Main IL Instruction Count

25

Main IL

nop <null> ldc.i4.1 <null> stsfld System.Boolean Stub.A::runx ldnull <null> ldftn System.Void Stub.A::timx_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.A::thx ldsfld System.Threading.Thread Stub.A::thx callvirt System.Void System.Threading.Thread::Start() nop <null> ldc.i4.1 <null> stsfld System.Boolean Stub.A::runy ldnull <null> ldftn System.Void Stub.A::timy_run() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stsfld System.Threading.Thread Stub.A::thy ldsfld System.Threading.Thread Stub.A::thy callvirt System.Void System.Threading.Thread::Start() nop <null> call System.Void Stub.Fransesco::ko() nop <null> nop <null> ret <null>

666e71c48bde753cfdd0a5f02fced2d3 (95.23 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙