Malicious
Malicious

6987dd345e6184116d42183e1f766442

PE Executable
|
MD5: 6987dd345e6184116d42183e1f766442
|
Size: 1.23 MB
|
application/x-msdownload

Executable
PE (Portable Executable)
Win 32 Exe
x86
.Net Obfuscator
.Net Reactor
.Net
SOS: 0.63
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
Hash Value
MD5
6987dd345e6184116d42183e1f766442
Sha1
70ce74ebba04f9ea328ffc2aea8d1e57454ec2da
Sha256
fd39a58ba08028b4464f587dfdf9de02bf3e68ed9d1ce834593d45acf6e13e0b
Sha384
1460c564cd966963425efe0d31a234af73e6e6a47e0e243a865ea504b634feac9c506591589e32fc9f68049b5fe1196a
Sha512
fe51abc9d898c69641c95199a5a4902c429a85bac0c0de9263f6b80a0d3d40a32d85009f200500d5555681c8d1df16578feaa78da75fade318bc821fbfe3b7cf
SSDeep
24576:rWyrazkMeoBMygR1+BPkfl5EZPSBwpLrV:rC97newVslVWL
TLSH
6F455B017E54CE11F0192233E2EF45484BB4AD5566A6E31B7DBA37AE25123A73C0DACF

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
6987dd345e6184116d42183e1f766442
Executable
PE (Portable Executable)
Win 32 Exe
x86
.Net Obfuscator
.Net Reactor
.Net
SOS: 0.63
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
yJVZZ2XkEUNpS8E2WJ.sJe0LVCAWhDcZsgFrs
0p3CK9jrJ4oqqBDhNw.Lg9DkEu8iAQIXbNaKh
Informations
Name
Value
Module Name

dZ6niM69UkeEEcRLcIN1RRC4BitxJhZ1hA

Full Name

dZ6niM69UkeEEcRLcIN1RRC4BitxJhZ1hA

EntryPoint

System.Void HMA3KxpXDPndNUrrcKo.QEaN9EpDsgl9AuUS7AA::Cm2GidDjuU()

Scope Name

dZ6niM69UkeEEcRLcIN1RRC4BitxJhZ1hA

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

eRShzaAEFer9X

Assembly Version

0.2.9.4

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

63

Main Method

System.Void HMA3KxpXDPndNUrrcKo.QEaN9EpDsgl9AuUS7AA::Cm2GidDjuU()

Main IL Instruction Count

14

Main IL

br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void BjrT5MGw7431AZ0CjER.me1OcjG5AuqxUJyKyTe::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object HMA3KxpXDPndNUrrcKo.QEaN9EpDsgl9AuUS7AA::QAQGjpt8tA callvirt System.Void jrfU2Np5EV8Bqeaqpjp.QUbYrhpo6jStqaMcI4k::zEIn18BTHx() nop <null> ret <null>

Module Name

dZ6niM69UkeEEcRLcIN1RRC4BitxJhZ1hA

Full Name

dZ6niM69UkeEEcRLcIN1RRC4BitxJhZ1hA

EntryPoint

System.Void HMA3KxpXDPndNUrrcKo.QEaN9EpDsgl9AuUS7AA::Cm2GidDjuU()

Scope Name

dZ6niM69UkeEEcRLcIN1RRC4BitxJhZ1hA

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

eRShzaAEFer9X

Assembly Version

0.2.9.4

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.0

Total Strings

63

Main Method

System.Void HMA3KxpXDPndNUrrcKo.QEaN9EpDsgl9AuUS7AA::Cm2GidDjuU()

Main IL Instruction Count

14

Main IL

br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void BjrT5MGw7431AZ0CjER.me1OcjG5AuqxUJyKyTe::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object HMA3KxpXDPndNUrrcKo.QEaN9EpDsgl9AuUS7AA::QAQGjpt8tA callvirt System.Void jrfU2Np5EV8Bqeaqpjp.QUbYrhpo6jStqaMcI4k::zEIn18BTHx() nop <null> ret <null>

Artefacts
Name
Value
Embedded Resources

2

Suspicious Type Names (1-2 chars)

0

6987dd345e6184116d42183e1f766442 (1.23 MB)
File Structure
6987dd345e6184116d42183e1f766442
Executable
PE (Portable Executable)
Win 32 Exe
x86
.Net Obfuscator
.Net Reactor
.Net
SOS: 0.63
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
yJVZZ2XkEUNpS8E2WJ.sJe0LVCAWhDcZsgFrs
0p3CK9jrJ4oqqBDhNw.Lg9DkEu8iAQIXbNaKh
Characteristics
No malware configuration were found at this point.
Artefacts
Name
Value Location
Embedded Resources

2

6987dd345e6184116d42183e1f766442

Suspicious Type Names (1-2 chars)

0

6987dd345e6184116d42183e1f766442

You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙