Suspicious
Suspect

717a9267f1f4b00c0b8e44e9abca7fc0

PE Executable
|
MD5: 717a9267f1f4b00c0b8e44e9abca7fc0
|
Size: 12.53 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
717a9267f1f4b00c0b8e44e9abca7fc0
Sha1
c2695d7a54e7447e61c735c8a5b005ec4b84b618
Sha256
2308bb46acec261999dd1455b9586ac7ebf3f677630e04256807130a6322e62e
Sha384
4f8a6549d9c99fc8061bfc6d2638075033fe3d22faa17a82120e41f5804976f70ecccc28f1b350a718a8013e7fe9b892
Sha512
be2e8a3cfb5166ea43720147fbc5e26221b4915bda91898b5c1d4259b494536f24f720ccb3c251e2427df47a56d6b1958864c6f53008d52a96ad95ffebc4d1e0
SSDeep
196608:dzzsBBZe/a8EEt3ldx2ug2RfzbWXCfGX7h+F0W80g71JrrhEgAfjslz9lQatycWx:9mrEaitu6a0KC8r/rhQfqzDQ
TLSH
97C633768A8DCF5CF37984BE71726323831F7C7A9621C919F085BA468FD0E570E92186

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual Studio .NET
File Structure
717a9267f1f4b00c0b8e44e9abca7fc0
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
eki.Resources
Install.exe
svchost.exe
thor64.exe
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

thor64.exe
Full Name

thor64.exe
EntryPoint

System.Void Program::Main()
Scope Name

thor64.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

thor64
Assembly Version

10.7.17.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

15
Main Method

System.Void Program::Main()
Main IL Instruction Count

39
Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007C: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_007A: br.s IL_0083 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007A: br.s IL_0083 br.s IL_0083: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>
Module Name

thor64.exe
Full Name

thor64.exe
EntryPoint

System.Void Program::Main()
Scope Name

thor64.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

thor64
Assembly Version

10.7.17.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

15
Main Method

System.Void Program::Main()
Main IL Instruction Count

39
Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007C: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_007A: br.s IL_0083 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007A: br.s IL_0083 br.s IL_0083: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>
717a9267f1f4b00c0b8e44e9abca7fc0 (12.53 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙