Deep Malware Analysis of 67fc8ad42d5a539471a6070dda1e4828 | md5: 67fc8ad42d5a539471a6070dda1e4828 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.15

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	67fc8ad42d5a539471a6070dda1e4828
Sha1	bceeab3e2a5a89f7f1b7bf9770c5f528e855acf7
Sha256	99c04e506e0bfa4ca0bbd3aa52020a7274c036769e95fa34573eb24e88530313
Sha384	ea7f5e211078a9f1a421acb62e2c47cdc190af6e381c8f86b44dbb7936d7c6a29d6243aa453006015d6981c4de01dabe
Sha512	a25123eab0bb16317e9ddd9604e5de8296a947b277c0216e206ce060d8b16d11727e3f286271bf69e7b73f4364b5b56a4d3d85def1175d45f133e35df7aab3b6
SSDeep	384:vz57Ngy0RmSJ4b1Pk5YS0CKmos0VzN7GOqHymZh7/ac5UqoQE4vaG5LCMThNH4qt:vz57Ngy0RbKbF7S0U/0VBDUH+qoYv4sy
TLSH	7BB2953DC6E5ACC0C7AF12F074AFBBC502AAE717BD2B4B6CB4C814461E60654AB74748

File Structure

Informations

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	GeneratedExe.exe
Full Name	GeneratedExe.exe
EntryPoint	System.Void Program::Main()
Scope Name	GeneratedExe.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	GeneratedExe
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	10
Main Method	System.Void Program::Main()
Main IL Instruction Count	291
Main IL	nop <null> ldc.i4 12715 newarr System.Byte dup <null> ldtoken <PrivateImplementationDetails>/__StaticArrayInitTypeSize=12715 <PrivateImplementationDetails>::1A5ED225EB295A8E957F905015FF367D3537D7FBE9876BF76989BBEDA560FC76 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.0 <null> newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor() stloc.s V_4 ldloc.s V_4 ldc.i4.5 <null> callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 ldc.i4.s 12 callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 ldc.i4.7 <null> callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 ldc.i4.s 20 callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 ldc.i4.3 <null> callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 ldc.i4.s 15 callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 ldc.i4.8 <null> callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 ldc.i4.s 11 callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 ldc.i4.s 14 callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32) nop <null> ldloc.s V_4 stloc.1 <null> ldloc.1 <null> ldsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0 dup <null> brtrue.s IL_0097: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>) pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Boolean Program/<>c::<Main>b__0_0(System.Int32) newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Int32,System.Boolean> Program/<>c::<>9__0_0 call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>) ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1 dup <null> brtrue.s IL_00BB: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>) pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Int32 Program/<>c::<Main>b__0_1(System.Int32) newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_1 call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>) ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2 dup <null> brtrue.s IL_00DF: call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>) pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Int32 Program/<>c::<Main>b__0_2(System.Int32) newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_2 call System.Linq.IOrderedEnumerable`1<System.Int32> System.Linq.Enumerable::OrderBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>) call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>) stloc.2 <null> call System.String System.IO.Path::GetTempPath() call System.Guid System.Guid::NewGuid() stloc.s V_5 ldloca.s V_5 constrained. System.Guid callvirt System.String System.Object::ToString() ldstr .bat call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> nop <null> ldloc.3 <null> ldloc.0 <null> call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) nop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_11 ldloc.s V_11 ldstr cmd.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> ldloc.s V_11 ldstr /C " ldloc.3 <null> ldstr " call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) nop <null> ldloc.s V_11 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) nop <null> ldloc.s V_11 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) nop <null> ldloc.s V_11 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) nop <null> ldloc.s V_11 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean) nop <null> ldloc.s V_11 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardError(System.Boolean) nop <null> ldloc.s V_11 stloc.s V_6 ldloc.2 <null> ldsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3 dup <null> brtrue.s IL_0199: call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>) pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Int32 Program/<>c::<Main>b__0_3(System.Int32) newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Int32,System.Int32> Program/<>c::<>9__0_3 call System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>> System.Linq.Enumerable::GroupBy<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>) ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4 dup <null> brtrue.s IL_01BD: ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5 pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Int32 Program/<>c::<Main>b__0_4(System.Linq.IGrouping`2<System.Int32,System.Int32>) newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32> Program/<>c::<>9__0_4 ldsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5 dup <null> brtrue.s IL_01DC: call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>) pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Collections.Generic.List`1<System.Int32> Program/<>c::<Main>b__0_5(System.Linq.IGrouping`2<System.Int32,System.Int32>) newobj System.Void System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>> Program/<>c::<>9__0_5 call System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Linq.Enumerable::ToDictionary<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32,System.Collections.Generic.List`1<System.Int32>>(System.Collections.Generic.IEnumerable`1<System.Linq.IGrouping`2<System.Int32,System.Int32>>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Int32>,System.Func`2<System.Linq.IGrouping`2<System.Int32,System.Int32>,System.Collections.Generic.List`1<System.Int32>>) stloc.s V_7 ldstr Grouped values: call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> ldloc.s V_7 callvirt System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::GetEnumerator() stloc.s V_12 br.s IL_0232: ldloca.s V_12 ldloca.s V_12 call System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>> System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Current() stloc.s V_13 nop <null> ldstr Key {0}: {1} ldloca.s V_13 call System.Int32 System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Key() box System.Int32 ldstr , ldloca.s V_13 call System.Collections.Generic.List`1<System.Int32> System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>::get_Value() call System.String System.String::Join<System.Int32>(System.String,System.Collections.Generic.IEnumerable`1<System.Int32>) call System.String System.String::Format(System.String,System.Object,System.Object) call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> ldloca.s V_12 call System.Boolean System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>>::MoveNext() brtrue.s IL_01FA: ldloca.s V_12 leave.s IL_024C: ldloc.s V_7 ldloca.s V_12 constrained. System.Collections.Generic.Dictionary`2/Enumerator<System.Int32,System.Collections.Generic.List`1<System.Int32>> callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ldloc.s V_7 ldsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6 dup <null> brtrue.s IL_026D: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>) pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Collections.Generic.IEnumerable`1<System.Int32> Program/<>c::<Main>b__0_6(System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>) newobj System.Void System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>> Program/<>c::<>9__0_6 call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::SelectMany<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>>,System.Func`2<System.Collections.Generic.KeyValuePair`2<System.Int32,System.Collections.Generic.List`1<System.Int32>>,System.Collections.Generic.IEnumerable`1<System.Int32>>) ldsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7 dup <null> brtrue.s IL_0291: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>) pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Int32 Program/<>c::<Main>b__0_7(System.Int32,System.Int32) newobj System.Void System.Func`3<System.Int32,System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`3<System.Int32,System.Int32,System.Int32> Program/<>c::<>9__0_7 call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`3<System.Int32,System.Int32,System.Int32>) call System.Collections.Generic.List`1<System.Int32> System.Linq.Enumerable::ToList<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>) stloc.s V_8 ldstr Flattened transformed values: call System.Void System.Console::WriteLine(System.String) nop <null> ldloc.s V_8 ldsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8 dup <null> brtrue.s IL_02C9: callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>) pop <null> ldsfld Program/<>c Program/<>c::<>9 ldftn System.Void Program/<>c::<Main>b__0_8(System.Int32) newobj System.Void System.Action`1<System.Int32>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.Int32> Program/<>c::<>9__0_8 callvirt System.Void System.Collections.Generic.List`1<System.Int32>::ForEach(System.Action`1<System.Int32>) nop <null> nop <null> nop <null> ldloc.s V_6 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_14 nop <null> ldloc.s V_14 callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardOutput() callvirt System.String System.IO.TextReader::ReadToEnd() stloc.s V_15 ldloc.s V_14 callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardError() callvirt System.String System.IO.TextReader::ReadToEnd() stloc.s V_16 ldloc.s V_14 callvirt System.Void System.Diagnostics.Process::WaitForExit() nop <null> nop <null> leave.s IL_030F: ldloc.s V_8 ldloc.s V_14 brfalse.s IL_030E: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ldloc.s V_8 call System.Int32 Program::<Main>g__ComputeSum\|0_9(System.Collections.Generic.IEnumerable`1<System.Int32>) stloc.s V_9 ldloc.s V_8 call System.Int32 Program::<Main>g__ComputeWeirdMetric\|0_10(System.Collections.Generic.IEnumerable`1<System.Int32>) stloc.s V_10 ldstr Sum (modded): {0} ldloc.s V_9 box System.Int32 call System.String System.String::Format(System.String,System.Object) call System.Void System.Console::WriteLine(System.String) nop <null> ldstr Weird metric: {0} ldloc.s V_10 box System.Int32 call System.String System.String::Format(System.String,System.Object) call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> leave.s IL_0365: ret nop <null> nop <null> ldloc.3 <null> call System.Void System.IO.File::Delete(System.String) nop <null> nop <null> leave.s IL_0363: nop pop <null> nop <null> nop <null> leave.s IL_0363: nop nop <null> endfinally <null> ret <null>

67fc8ad42d5a539471a6070dda1e4828 (24.06 KB)