Suspicious
Suspect

67b33978fb9bb8699480afe251acc15b

PE Executable
|
MD5: 67b33978fb9bb8699480afe251acc15b
|
Size: 986.11 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
Hash Value
MD5
67b33978fb9bb8699480afe251acc15b
Sha1
c017af13292d045e34c46d202dcc5b68764d29fb
Sha256
dcc9a87825692ae48ea938392908d1dcc6d1b002a7c8f89c348e5a2f8fee0e30
Sha384
90a6df851c7ea2de1e1b470f6579c0e48d909231221a82ab78126603bf56f967e7693d1f7f8a7cbb257449663e5cf7b6
Sha512
57e221e578ad2038d258397f2ddff26d752607331ab4de62824fdd848c8ec5065fe8afd7a7e35eb780319689cb9171503f746cbed307feedec587c51cb01bc2e
SSDeep
24576:6lT7O75DFs81h7m/CmTa7YjG+HoAQESPafEiHuocsTj:d75mw7eCOW+VHsESP+Ei5
TLSH
1A253383E7BFF0A2DAA2C6BDE1039B16086E316B0047C419301F27B5175AFDDD58E666

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ptrtoczmc.Properties.Resources.resources
Gmogfvc
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

Purchase Order List.exe

Full Name

Purchase Order List.exe

EntryPoint

System.Void PurchaseOrderList.Threading.ExternalSynchronizer::ChangeSynchronizer()

Scope Name

Purchase Order List.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Purchase Order List

Assembly Version

1.0.4819.6664

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.5

Total Strings

6

Main Method

System.Void PurchaseOrderList.Threading.ExternalSynchronizer::ChangeSynchronizer()

Main IL Instruction Count

33

Main IL

ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_002C: newobj System.Void Ptrtoczmc.Factories.ResponsiveCreator::.ctor() newobj System.Void Ptrtoczmc.Factories.ResponsiveCreator::.ctor() ldloc.s V_1 call System.Void Ptrtoczmc.Factories.ResponsiveCreator::CreateSequentialCreator(System.Byte[]) ldc.i4 0 ldsfld <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f} <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f}::m_9b8e3d03102b41be8bb44e90c22d0127 ldfld System.Int32 <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f}::m_e9dad785334141348841ccbb4cd8a11e brfalse IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058) pop <null> ldc.i4 1 br IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058) ret <null> newobj System.Void PurchaseOrderList.Parameters.IsolatedParameter::.ctor() call System.Byte[] PurchaseOrderList.Parameters.IsolatedParameter::AdjustOrderedParameter() stloc.s V_2 ldc.i4 2 br IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058) newobj System.Void PurchaseOrderList.Matching.SharerMatcher::.ctor() ldloc.s V_2 call System.Byte[] PurchaseOrderList.Matching.SharerMatcher::CompareCustomMatcher(System.Byte[]) stloc.s V_1 ldc.i4 0 ldsfld <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f} <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f}::m_9b8e3d03102b41be8bb44e90c22d0127 ldfld System.Int32 <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f}::m_190c611bafec4b83bc64ce5b3c6398ae brfalse IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058) pop <null> ldc.i4 0 br IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058)

Module Name

Purchase Order List.exe

Full Name

Purchase Order List.exe

EntryPoint

System.Void PurchaseOrderList.Threading.ExternalSynchronizer::ChangeSynchronizer()

Scope Name

Purchase Order List.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Purchase Order List

Assembly Version

1.0.4819.6664

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.5

Total Strings

6

Main Method

System.Void PurchaseOrderList.Threading.ExternalSynchronizer::ChangeSynchronizer()

Main IL Instruction Count

33

Main IL

ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_002C: newobj System.Void Ptrtoczmc.Factories.ResponsiveCreator::.ctor() newobj System.Void Ptrtoczmc.Factories.ResponsiveCreator::.ctor() ldloc.s V_1 call System.Void Ptrtoczmc.Factories.ResponsiveCreator::CreateSequentialCreator(System.Byte[]) ldc.i4 0 ldsfld <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f} <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f}::m_9b8e3d03102b41be8bb44e90c22d0127 ldfld System.Int32 <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f}::m_e9dad785334141348841ccbb4cd8a11e brfalse IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058) pop <null> ldc.i4 1 br IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058) ret <null> newobj System.Void PurchaseOrderList.Parameters.IsolatedParameter::.ctor() call System.Byte[] PurchaseOrderList.Parameters.IsolatedParameter::AdjustOrderedParameter() stloc.s V_2 ldc.i4 2 br IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058) newobj System.Void PurchaseOrderList.Matching.SharerMatcher::.ctor() ldloc.s V_2 call System.Byte[] PurchaseOrderList.Matching.SharerMatcher::CompareCustomMatcher(System.Byte[]) stloc.s V_1 ldc.i4 0 ldsfld <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f} <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f}::m_9b8e3d03102b41be8bb44e90c22d0127 ldfld System.Int32 <Module>{6d46445d-eed7-4ee6-ad91-856a979d670f}::m_190c611bafec4b83bc64ce5b3c6398ae brfalse IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058) pop <null> ldc.i4 0 br IL_0012: switch(IL_002C,IL_0057,IL_006E,IL_0058)

67b33978fb9bb8699480afe251acc15b (986.11 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Ptrtoczmc.Properties.Resources.resources
Gmogfvc
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙