Suspicious
Suspect

76482e447cfbe7caac0cac43125da2ac

PE Executable
|
MD5: 76482e447cfbe7caac0cac43125da2ac
|
Size: 1.59 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
76482e447cfbe7caac0cac43125da2ac
Sha1
3b302ec64a7ba735a6c84c981df21464de9807c1
Sha256
49dc8828403fab25387e57ef50ea2e5b92a61a54fbdaeec924a368ee4f35a60c
Sha384
aba9ba14cf506944a1ce76e8c784f2148402b8cd3c7dd62c2390bd67f3320f7cf5a97786f868bfd6da83f1b6cfb5160f
Sha512
6cefd5441a296403abe2af7c05d517b8e2cdc7c0a55c6b772aca0178384afdb6fc587fc9dbeb71e54b278d0afa9a936a4ce4a3a48ab41dbebfc8ec6b71c0022b
SSDeep
24576:aLmGWC2da6YIyCDA1CvBKwRHjK/7DAynt1ZRpqTr91cWqGIcMueZh8W/0spKK7JQ:Amrda6YIy6WpwKYWepqZtBag0skK7J
TLSH
857523C9FAC469A5ED1E57722632EC30116B7CB986B02A2C39CF3CB77DBB5028411597

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
76482e447cfbe7caac0cac43125da2ac
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Tznip.Properties.Resources.resources
Xhmaoeir
ILRepack.List
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

t1
Full Name

t1
EntryPoint

System.Void Tznip.Dyylgwlgw::Main()
Scope Name

t1
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

t1
Assembly Version

1.0.6164.29261
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

48
Main Method

System.Void Tznip.Dyylgwlgw::Main()
Main IL Instruction Count

60
Main IL

newobj System.Void Tznip.Dyylgwlgw/<>c__DisplayClass0_0::.ctor() stloc.0 <null> ldstr 2+jOEHN9o6cMzFIqoBYzfg== stloc.1 <null> ldstr SlCktjxUV6k= stloc.2 <null> ldsfld System.Func`1<System.Byte[]> Tznip.Dyylgwlgw/<>c::<>9__0_0 dup <null> brtrue.s IL_0031: newobj System.Void Tznip.Rcwtmyax::.ctor(System.Func`1<System.Byte[]>) pop <null> ldsfld Tznip.Dyylgwlgw/<>c Tznip.Dyylgwlgw/<>c::<>9 ldftn System.Byte[] Tznip.Dyylgwlgw/<>c::<Main>b__0_0() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Tznip.Dyylgwlgw/<>c::<>9__0_0 newobj System.Void Tznip.Rcwtmyax::.ctor(System.Func`1<System.Byte[]>) ldloc.0 <null> ldloc.1 <null> ldloc.2 <null> newobj System.Void Tznip.Fiknef::.ctor(System.String,System.String) stfld Tznip.Fiknef Tznip.Dyylgwlgw/<>c__DisplayClass0_0::decryptor ldloc.0 <null> newobj System.Void Tznip.Boqeibymq::.ctor() stfld Tznip.Boqeibymq Tznip.Dyylgwlgw/<>c__DisplayClass0_0::loader ldloc.0 <null> ldstr UY5IxflmccNK6gxpHk.PvUNq2W1RCGOJZjL2I ldstr m31H7rHg7 newobj System.Void Tznip.Ifndxp::.ctor(System.String,System.String) stfld Tznip.Ifndxp Tznip.Dyylgwlgw/<>c__DisplayClass0_0::invoker dup <null> ldloc.0 <null> ldftn System.Void Tznip.Dyylgwlgw/<>c__DisplayClass0_0::<Main>b__1(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Tznip.Rcwtmyax::add_DownloadCompleted(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld Tznip.Fiknef Tznip.Dyylgwlgw/<>c__DisplayClass0_0::decryptor ldloc.0 <null> ldftn System.Void Tznip.Dyylgwlgw/<>c__DisplayClass0_0::<Main>b__2(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Tznip.Fiknef::add_DecryptionCompleted(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld Tznip.Boqeibymq Tznip.Dyylgwlgw/<>c__DisplayClass0_0::loader ldloc.0 <null> ldftn System.Void Tznip.Dyylgwlgw/<>c__DisplayClass0_0::<Main>b__3(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Tznip.Boqeibymq::add_LoadCompleted(System.Action`1<System.Reflection.Assembly>) ldloc.0 <null> ldfld Tznip.Ifndxp Tznip.Dyylgwlgw/<>c__DisplayClass0_0::invoker ldsfld System.Action Tznip.Dyylgwlgw/<>c::<>9__0_4 dup <null> brtrue.s IL_00C8: callvirt System.Void Tznip.Ifndxp::add_InvocationCompleted(System.Action) pop <null> ldsfld Tznip.Dyylgwlgw/<>c Tznip.Dyylgwlgw/<>c::<>9 ldftn System.Void Tznip.Dyylgwlgw/<>c::<Main>b__0_4() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action Tznip.Dyylgwlgw/<>c::<>9__0_4 callvirt System.Void Tznip.Ifndxp::add_InvocationCompleted(System.Action) callvirt System.Void Tznip.Rcwtmyax::Kcdelaozco() ret <null>
Module Name

t1
Full Name

t1
EntryPoint

System.Void Tznip.Dyylgwlgw::Main()
Scope Name

t1
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

t1
Assembly Version

1.0.6164.29261
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

48
Main Method

System.Void Tznip.Dyylgwlgw::Main()
Main IL Instruction Count

60
Main IL

newobj System.Void Tznip.Dyylgwlgw/<>c__DisplayClass0_0::.ctor() stloc.0 <null> ldstr 2+jOEHN9o6cMzFIqoBYzfg== stloc.1 <null> ldstr SlCktjxUV6k= stloc.2 <null> ldsfld System.Func`1<System.Byte[]> Tznip.Dyylgwlgw/<>c::<>9__0_0 dup <null> brtrue.s IL_0031: newobj System.Void Tznip.Rcwtmyax::.ctor(System.Func`1<System.Byte[]>) pop <null> ldsfld Tznip.Dyylgwlgw/<>c Tznip.Dyylgwlgw/<>c::<>9 ldftn System.Byte[] Tznip.Dyylgwlgw/<>c::<Main>b__0_0() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Tznip.Dyylgwlgw/<>c::<>9__0_0 newobj System.Void Tznip.Rcwtmyax::.ctor(System.Func`1<System.Byte[]>) ldloc.0 <null> ldloc.1 <null> ldloc.2 <null> newobj System.Void Tznip.Fiknef::.ctor(System.String,System.String) stfld Tznip.Fiknef Tznip.Dyylgwlgw/<>c__DisplayClass0_0::decryptor ldloc.0 <null> newobj System.Void Tznip.Boqeibymq::.ctor() stfld Tznip.Boqeibymq Tznip.Dyylgwlgw/<>c__DisplayClass0_0::loader ldloc.0 <null> ldstr UY5IxflmccNK6gxpHk.PvUNq2W1RCGOJZjL2I ldstr m31H7rHg7 newobj System.Void Tznip.Ifndxp::.ctor(System.String,System.String) stfld Tznip.Ifndxp Tznip.Dyylgwlgw/<>c__DisplayClass0_0::invoker dup <null> ldloc.0 <null> ldftn System.Void Tznip.Dyylgwlgw/<>c__DisplayClass0_0::<Main>b__1(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Tznip.Rcwtmyax::add_DownloadCompleted(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld Tznip.Fiknef Tznip.Dyylgwlgw/<>c__DisplayClass0_0::decryptor ldloc.0 <null> ldftn System.Void Tznip.Dyylgwlgw/<>c__DisplayClass0_0::<Main>b__2(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Tznip.Fiknef::add_DecryptionCompleted(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld Tznip.Boqeibymq Tznip.Dyylgwlgw/<>c__DisplayClass0_0::loader ldloc.0 <null> ldftn System.Void Tznip.Dyylgwlgw/<>c__DisplayClass0_0::<Main>b__3(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Tznip.Boqeibymq::add_LoadCompleted(System.Action`1<System.Reflection.Assembly>) ldloc.0 <null> ldfld Tznip.Ifndxp Tznip.Dyylgwlgw/<>c__DisplayClass0_0::invoker ldsfld System.Action Tznip.Dyylgwlgw/<>c::<>9__0_4 dup <null> brtrue.s IL_00C8: callvirt System.Void Tznip.Ifndxp::add_InvocationCompleted(System.Action) pop <null> ldsfld Tznip.Dyylgwlgw/<>c Tznip.Dyylgwlgw/<>c::<>9 ldftn System.Void Tznip.Dyylgwlgw/<>c::<Main>b__0_4() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action Tznip.Dyylgwlgw/<>c::<>9__0_4 callvirt System.Void Tznip.Ifndxp::add_InvocationCompleted(System.Action) callvirt System.Void Tznip.Rcwtmyax::Kcdelaozco() ret <null>
76482e447cfbe7caac0cac43125da2ac (1.59 MB)
File Structure
76482e447cfbe7caac0cac43125da2ac
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Tznip.Properties.Resources.resources
Xhmaoeir
ILRepack.List
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙