Suspicious
Suspect

6ca15ae2a25b14c69034980f2d445964

PE Executable
|
MD5: 6ca15ae2a25b14c69034980f2d445964
|
Size: 14.85 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
Hash Value
MD5
6ca15ae2a25b14c69034980f2d445964
Sha1
378fe603a6282826f421ae9a2fe7ef9d4b652dee
Sha256
264db8101d9eb600cae4013e3d0b0fd4fb9261e8495c86b1bac780f4e6e47c4d
Sha384
5e16cee64c40c69cc55d31024f8ff737a5692efa69ef8b0ac9d6239a9803c0ec40d2278bc88c5e383b8fc84021edfb0a
Sha512
e56646c9202d7aeee5ea81db0450166e5efd85af19c4acba2348bb74c3f68cf234d722ea48e7a213e8572fb9ab5c62bb160d2ee2de588543b645935170a515c4
SSDeep
384:NFdgDntl2ZHuuxwVKW+Zajm2+2ifzmK9j7Y:Tdgbn2GTjmgiqK17
TLSH
81622909F7D8EA62EAAE07346533026422B1D69F1429E78E1CC4145A9F373D01BA37F7
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

PDB Path: ?

Module Name

Installer.exe

Full Name

Installer.exe

EntryPoint

System.Void rrtsI6032vS.GCQOhJ::Main()

Scope Name

Installer.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

Installer

Assembly Version

0.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

27

Main Method

System.Void rrtsI6032vS.GCQOhJ::Main()

Main IL Instruction Count

3

Main IL

call System.Void rrtsI6032vS.GCQOhJ::K68DG() call System.Void rrtsI6032vS.GCQOhJ::ZwQMy() ret <null>

6ca15ae2a25b14c69034980f2d445964 (14.85 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙