Malicious
Malicious

6eaa48487ed8cc8291818568acec2412

PE Executable
|
MD5: 6eaa48487ed8cc8291818568acec2412
|
Size: 1.9 MB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
6eaa48487ed8cc8291818568acec2412
Sha1
4d1f0d2dc5ffe6d2e0d12b806e6bc2ff34d86db8
Sha256
cc6c49eaa6a236fd76d53aa8a92741e21270f7c3fdf87f54848d2076e0d1fcdb
Sha384
5073b1c8b96fcfb4d79c90095d76e12d7f632bb7912d3f8f02e19e1095dc75642e1dd7a3438a14e6cb5dd5a8289f9cd9
Sha512
def8c373134759c3c336b9817da7971ec8b2ede84b83336dbe86fa3831e0c1ddbe4011a690a7a7d8ee0db7e7b39fe8c4521b7f63ea0f23fd96c0566033e27706
SSDeep
24576:xAwh57di9uvDh9t/16jQDIXUq09DUy4zSVGHWuj4LH2uICYivdV+Oh7Ur1L:U9uvDh9ejQDSXy0TuYi0L
TLSH
C7958E07FB8687B2C2641777C9AB091CD364E7827713DE5E3D8A2B5A1CC37BA9941207

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ v6.0 DLL
Microsoft Visual Studio .NET
File Structure
6eaa48487ed8cc8291818568acec2412
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Zoiynwc.Properties.Resources.resources
Styujofsvqb
Informations
Name
 Value
Module Name

SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
Full Name

SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
EntryPoint

System.Void HidSharp.Conversion.ConfigParameter::WatchConverter()
Scope Name

SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

SAP Ariba ADNOC site Contract RQF 04082025-PDF
Assembly Version

1.0.277.15133
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

754
Main Method

System.Void HidSharp.Conversion.ConfigParameter::WatchConverter()
Main IL Instruction Count

32
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0059: ldsfld HidSharp.Conversion.ConfigParameter/<>c HidSharp.Conversion.ConfigParameter/<>c::_ScalableSelector ret <null> ldsfld System.Action`1<System.IO.MemoryStream> HidSharp.Conversion.ConfigParameter/<>c::m_SolverSelector dup <null> brfalse IL_0039: pop br IL_006F: call System.Void HidSharp.Conversion.ConfigParameter::ConvertHiddenConverter(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 0 ldsfld <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35} <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_2c6c5b4dee9546d9b0f6974a064bc588 ldfld System.Int32 <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_06b04bad3bbe49ea92d9faf51f441f47 brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0059,IL_0029,IL_0028) ldsfld HidSharp.Conversion.ConfigParameter/<>c HidSharp.Conversion.ConfigParameter/<>c::_ScalableSelector ldftn System.Void HidSharp.Conversion.ConfigParameter/<>c::FilterJoinedExplorer(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> HidSharp.Conversion.ConfigParameter/<>c::m_SolverSelector call System.Void HidSharp.Conversion.ConfigParameter::ConvertHiddenConverter(System.Action`1<System.IO.MemoryStream>) ldc.i4 1 ldsfld <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35} <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_2c6c5b4dee9546d9b0f6974a064bc588 ldfld System.Int32 <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_002e8f41611f4e9db68361d291160f1b brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 2 br IL_0012: switch(IL_0059,IL_0029,IL_0028)
Module Name

SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
Full Name

SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
EntryPoint

System.Void HidSharp.Conversion.ConfigParameter::WatchConverter()
Scope Name

SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

SAP Ariba ADNOC site Contract RQF 04082025-PDF
Assembly Version

1.0.277.15133
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

754
Main Method

System.Void HidSharp.Conversion.ConfigParameter::WatchConverter()
Main IL Instruction Count

32
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0059: ldsfld HidSharp.Conversion.ConfigParameter/<>c HidSharp.Conversion.ConfigParameter/<>c::_ScalableSelector ret <null> ldsfld System.Action`1<System.IO.MemoryStream> HidSharp.Conversion.ConfigParameter/<>c::m_SolverSelector dup <null> brfalse IL_0039: pop br IL_006F: call System.Void HidSharp.Conversion.ConfigParameter::ConvertHiddenConverter(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 0 ldsfld <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35} <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_2c6c5b4dee9546d9b0f6974a064bc588 ldfld System.Int32 <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_06b04bad3bbe49ea92d9faf51f441f47 brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0059,IL_0029,IL_0028) ldsfld HidSharp.Conversion.ConfigParameter/<>c HidSharp.Conversion.ConfigParameter/<>c::_ScalableSelector ldftn System.Void HidSharp.Conversion.ConfigParameter/<>c::FilterJoinedExplorer(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> HidSharp.Conversion.ConfigParameter/<>c::m_SolverSelector call System.Void HidSharp.Conversion.ConfigParameter::ConvertHiddenConverter(System.Action`1<System.IO.MemoryStream>) ldc.i4 1 ldsfld <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35} <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_2c6c5b4dee9546d9b0f6974a064bc588 ldfld System.Int32 <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_002e8f41611f4e9db68361d291160f1b brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 2 br IL_0012: switch(IL_0059,IL_0029,IL_0028)
6eaa48487ed8cc8291818568acec2412 (1.9 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙