Suspicious
Suspect

6e81105dc43fa18489f8a9efc0bc9a0a

PE Executable
|
MD5: 6e81105dc43fa18489f8a9efc0bc9a0a
|
Size: 981.5 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
6e81105dc43fa18489f8a9efc0bc9a0a
Sha1
d8fc2259441c84f88d6547fa30712aa16e2e25e4
Sha256
4777649d5b0b588320a29efac60b61a094388e2b6523b3ad4bf6ec3424aebce2
Sha384
012e838a30aee7e397b61875aeee95c43f107004cd3c9b92491dacf7ae0bff4f44e0e6128f4e11aef5761974ef05e579
Sha512
42b9285e9bfb8783572b8cf5985237f0fbf99399c30075ada4f6b2dd2db49f0db9eabf2c4ed03e38db3635de83a7ffe7974cc192f2d2f481024457ae09d0dad8
SSDeep
3072:+WhlU9DmCls6gSsmjTk0MqHhO/dqubPBhwbvWDTI:+UU9HlsWsmj62JuLjw9
TLSH
B925FB518A639C25DC7613FA5035D9B952237FA93472D24C84F9BCA3F9F3B83089A583

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
6e81105dc43fa18489f8a9efc0bc9a0a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
.Net Resources
Ledger.MainForm.resources
$this.Icon
[NBF]root.IconData
pictureBoxFavicon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Ledger.Views.HideForm.resources
Ledger.Views.SeedPhrasesForm.resources
buttonBack.Image
[NBF]root.Data
[NBF]root.Data-preview.png
buttonContinue.Image
[NBF]root.Data
[NBF]root.Data-preview.png
panel1.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Ledger.exe
Full Name

Ledger.exe
EntryPoint

System.Void @ӕ::Main()
Scope Name

Ledger.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ledger
Assembly Version

0.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5.1
Total Strings

155
Main Method

System.Void @ӕ::Main()
Main IL Instruction Count

24
Main IL

ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.1 <null> ldstr LedgerAppMutex ldloca.s V_0 newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&) stloc.1 <null> ldloc.0 <null> brfalse.s IL_0032: ldc.i4.0 call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void Ledger.Views.HideForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) leave.s IL_0044: ret ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave.s IL_0044: ret ldloc.1 <null> brfalse.s IL_0043: endfinally ldloc.1 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
Module Name

Ledger.exe
Full Name

Ledger.exe
EntryPoint

System.Void @ӕ::Main()
Scope Name

Ledger.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ledger
Assembly Version

0.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.5.1
Total Strings

155
Main Method

System.Void @ӕ::Main()
Main IL Instruction Count

24
Main IL

ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4.1 <null> ldstr LedgerAppMutex ldloca.s V_0 newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&) stloc.1 <null> ldloc.0 <null> brfalse.s IL_0032: ldc.i4.0 call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void Ledger.Views.HideForm::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) leave.s IL_0044: ret ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave.s IL_0044: ret ldloc.1 <null> brfalse.s IL_0043: endfinally ldloc.1 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
6e81105dc43fa18489f8a9efc0bc9a0a (981.5 KB)
File Structure
6e81105dc43fa18489f8a9efc0bc9a0a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:1033
ID:1033-preview.png
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:1033-preview.png
RT_GROUP_CURSOR4
ID:0001
ID:1033
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
.Net Resources
Ledger.MainForm.resources
$this.Icon
[NBF]root.IconData
pictureBoxFavicon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Ledger.Views.HideForm.resources
Ledger.Views.SeedPhrasesForm.resources
buttonBack.Image
[NBF]root.Data
[NBF]root.Data-preview.png
buttonContinue.Image
[NBF]root.Data
[NBF]root.Data-preview.png
panel1.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙