Suspicious
Suspect

7de170ce970af68f014113495aa4bfc7

PE Executable
|
MD5: 7de170ce970af68f014113495aa4bfc7
|
Size: 1.37 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
Hash Value
MD5
7de170ce970af68f014113495aa4bfc7
Sha1
0be655451b8176781e9ef2113ba363364007d19d
Sha256
17e58d32c3edba5a27fc78a38c63206d312811794e694c108fe77e1f74ecfc57
Sha384
996f2d9e98feb4c0a3ba73a3f87ccd35c0ee6fcd6f9bfab8598e2b173559263a4be1183ff2b926d9c9e38b0a87a4917a
Sha512
5b26bc6c7afd2519bddfd27979ba86f55b3a3ce92af68f40f0aade72a8c245eb55cd87906262652bdb78266efde08eaa74943e69b36e3347c92829ae4cff6acc
SSDeep
24576:0cnTF/fb39Z1JXJ0mO0e0v3IVSy95YYwkLjgZQzyQI1Tn:0aTBfb9ZnXa0LwXnRLEK2t1j
TLSH
4655F10617D456A8F0FE8B74A6B4006443F0F917E32AEBAF7A4841ED8E21BC5D952773

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
6Mf_poN7Lq5.g.resources
6Mf_poN7Lq5.Resources.resources
e454d32da0e8d9.Resources.resources
47ba0d940
[NBF]root.Data
47ba0d941
[NBF]root.Data
47ba0d9410
[NBF]root.Data
47ba0d9411
[NBF]root.Data
47ba0d9412
[NBF]root.Data
47ba0d9413
[NBF]root.Data
47ba0d9414
[NBF]root.Data
47ba0d9415
[NBF]root.Data
47ba0d9416
[NBF]root.Data
47ba0d9417
[NBF]root.Data
47ba0d9418
[NBF]root.Data
47ba0d9419
[NBF]root.Data
47ba0d942
[NBF]root.Data
47ba0d9420
[NBF]root.Data
47ba0d9421
[NBF]root.Data
47ba0d9422
[NBF]root.Data
47ba0d9423
[NBF]root.Data
47ba0d9424
[NBF]root.Data
47ba0d9425
[NBF]root.Data
47ba0d9426
[NBF]root.Data
47ba0d9427
[NBF]root.Data
47ba0d9428
[NBF]root.Data
47ba0d9429
[NBF]root.Data
47ba0d943
[NBF]root.Data
47ba0d9430
[NBF]root.Data
47ba0d9431
[NBF]root.Data
47ba0d9432
[NBF]root.Data
47ba0d9433
[NBF]root.Data
47ba0d9434
[NBF]root.Data
47ba0d9435
[NBF]root.Data
47ba0d9436
[NBF]root.Data
47ba0d9437
[NBF]root.Data
47ba0d9438
[NBF]root.Data
47ba0d9439
[NBF]root.Data
47ba0d944
[NBF]root.Data
47ba0d9440
[NBF]root.Data
47ba0d9441
[NBF]root.Data
47ba0d9442
[NBF]root.Data
47ba0d945
[NBF]root.Data
47ba0d946
[NBF]root.Data
47ba0d947
[NBF]root.Data
47ba0d948
[NBF]root.Data
47ba0d949
[NBF]root.Data
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

6Mf_poN7Lq5

Full Name

6Mf_poN7Lq5

EntryPoint

System.Void 6Mf_poN7Lq5.az9KYt/ps8P5iTtfd.0Wmgz::7PtxCw4z()

Scope Name

6Mf_poN7Lq5

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

6Mf_poN7Lq5

Assembly Version

11.9.34.178

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1089

Main Method

System.Void 6Mf_poN7Lq5.az9KYt/ps8P5iTtfd.0Wmgz::7PtxCw4z()

Main IL Instruction Count

39

Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.0 <null> ldloc.0 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) stloc.3 <null> ldloc.3 <null> brfalse.s IL_0027: ldc.i4.s 100 ldstr 1.6.4.9 stloc.0 <null> ldc.i4.s 100 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr AppConfig.dat call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> newobj System.Void 6Mf_poN7Lq5.Bg4f7npAjZz1H9::.ctor() stloc.2 <null> ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> leave.s IL_0067: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0067: nop nop <null> ret <null>

Module Name

6Mf_poN7Lq5

Full Name

6Mf_poN7Lq5

EntryPoint

System.Void 6Mf_poN7Lq5.az9KYt/ps8P5iTtfd.0Wmgz::7PtxCw4z()

Scope Name

6Mf_poN7Lq5

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

6Mf_poN7Lq5

Assembly Version

11.9.34.178

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.6

Total Strings

1089

Main Method

System.Void 6Mf_poN7Lq5.az9KYt/ps8P5iTtfd.0Wmgz::7PtxCw4z()

Main IL Instruction Count

39

Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.0 <null> ldloc.0 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) stloc.3 <null> ldloc.3 <null> brfalse.s IL_0027: ldc.i4.s 100 ldstr 1.6.4.9 stloc.0 <null> ldc.i4.s 100 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr AppConfig.dat call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> newobj System.Void 6Mf_poN7Lq5.Bg4f7npAjZz1H9::.ctor() stloc.2 <null> ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> leave.s IL_0067: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0067: nop nop <null> ret <null>

7de170ce970af68f014113495aa4bfc7 (1.37 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
6Mf_poN7Lq5.g.resources
6Mf_poN7Lq5.Resources.resources
e454d32da0e8d9.Resources.resources
47ba0d940
[NBF]root.Data
47ba0d941
[NBF]root.Data
47ba0d9410
[NBF]root.Data
47ba0d9411
[NBF]root.Data
47ba0d9412
[NBF]root.Data
47ba0d9413
[NBF]root.Data
47ba0d9414
[NBF]root.Data
47ba0d9415
[NBF]root.Data
47ba0d9416
[NBF]root.Data
47ba0d9417
[NBF]root.Data
47ba0d9418
[NBF]root.Data
47ba0d9419
[NBF]root.Data
47ba0d942
[NBF]root.Data
47ba0d9420
[NBF]root.Data
47ba0d9421
[NBF]root.Data
47ba0d9422
[NBF]root.Data
47ba0d9423
[NBF]root.Data
47ba0d9424
[NBF]root.Data
47ba0d9425
[NBF]root.Data
47ba0d9426
[NBF]root.Data
47ba0d9427
[NBF]root.Data
47ba0d9428
[NBF]root.Data
47ba0d9429
[NBF]root.Data
47ba0d943
[NBF]root.Data
47ba0d9430
[NBF]root.Data
47ba0d9431
[NBF]root.Data
47ba0d9432
[NBF]root.Data
47ba0d9433
[NBF]root.Data
47ba0d9434
[NBF]root.Data
47ba0d9435
[NBF]root.Data
47ba0d9436
[NBF]root.Data
47ba0d9437
[NBF]root.Data
47ba0d9438
[NBF]root.Data
47ba0d9439
[NBF]root.Data
47ba0d944
[NBF]root.Data
47ba0d9440
[NBF]root.Data
47ba0d9441
[NBF]root.Data
47ba0d9442
[NBF]root.Data
47ba0d945
[NBF]root.Data
47ba0d946
[NBF]root.Data
47ba0d947
[NBF]root.Data
47ba0d948
[NBF]root.Data
47ba0d949
[NBF]root.Data
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙