Suspicious
Suspect

7e4482794753ece2c7555148db60813d

PE Executable
|
MD5: 7e4482794753ece2c7555148db60813d
|
Size: 276.99 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
 Hash Value
MD5
7e4482794753ece2c7555148db60813d
Sha1
dcb820b18308fbac5cf22d31c3281127857280e7
Sha256
85f04d9bf7440fa3611f62f2322ee36d2dc625fd46c91316da75bc067c66fd42
Sha384
34b4f7669769355dc73db1d20c41b4bd8aa05c80193ca0584b161a72dfb2121dc64cedd1bc56f812735806c788241e3f
Sha512
4c30679dc3b78e5d3f00d20bbd058ff52e22aacd2920645c65e88327bd0d183fbc3def7d7a26c8992e0a4a14a7cb9eb49f1b943399ada63586295a885c4b3448
SSDeep
6144:6hELyY169yoILiUMiOWqGNrNaxSNqqO89PX1xJo/J8bkvXCK6wj:hRAyoILwvolNZ19v78bKPwj
TLSH
2A442280BDD4DBB2C21B24BAAE9B530483E5A2B24854E72C75B5BAC45C1D3B34C1B977

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
7e4482794753ece2c7555148db60813d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Module Name

DownloaderApp.exe
Full Name

DownloaderApp.exe
EntryPoint

System.Int32 <Module>::Main(System.String[])
Scope Name

DownloaderApp.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

DownloaderApp
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.7.2
Total Strings

1
Main Method

System.Int32 <Module>::Main(System.String[])
Main IL Instruction Count

96
Main IL

ldc.i4 65910 pop <null> ldc.i4 65910 newarr System.UInt32 dup <null> ldtoken <Module>/DataType <Module>::DataField call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.0 <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() dup <null> callvirt System.Reflection.Module System.Reflection.Assembly::get_ManifestModule() stloc.1 <null> ldloc.0 <null> ldc.i4 -2092476572 call System.Runtime.InteropServices.GCHandle <Module>::Decrypt(System.UInt32[],System.UInt32) stloc.2 <null> ldloca.s V_2 call System.Object System.Runtime.InteropServices.GCHandle::get_Target() castclass System.Byte[] stloc.3 <null> ldstr koi ldloc.3 <null> callvirt System.Reflection.Module System.Reflection.Assembly::LoadModule(System.String,System.Byte[]) ldloc.3 <null> ldc.i4.0 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloca.s V_2 call System.Void System.Runtime.InteropServices.GCHandle::Free() ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloc.1 <null> ldc.i4 285212673 callvirt System.Byte[] System.Reflection.Module::ResolveSignature(System.Int32) stsfld System.Byte[] <Module>::key call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Reflection.Assembly <Module>::Resolve(System.Object,System.ResolveEventArgs) newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) dup <null> callvirt System.Type[] System.Reflection.Module::GetTypes() pop <null> ldsfld System.Byte[] <Module>::key ldc.i4.0 <null> ldelem.u1 <null> ldsfld System.Byte[] <Module>::key ldc.i4.1 <null> ldelem.u1 <null> ldc.i4.8 <null> shl <null> or <null> ldsfld System.Byte[] <Module>::key ldc.i4.2 <null> ldelem.u1 <null> ldc.i4.s 16 shl <null> or <null> ldsfld System.Byte[] <Module>::key ldc.i4.3 <null> ldelem.u1 <null> ldc.i4.s 24 shl <null> or <null> callvirt System.Reflection.MethodBase System.Reflection.Module::ResolveMethod(System.Int32) dup <null> callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> conv.i4 <null> newarr System.Object stloc.s V_4 ldloc.s V_4 ldlen <null> brfalse.s IL_00D9: ldnull ldloc.s V_4 ldc.i4.0 <null> ldarg.0 <null> stelem.ref <null> ldnull <null> ldloc.s V_4 callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) stloc.s V_5 ldloc.s V_5 isinst System.Int32 brfalse.s IL_00F4: ldc.i4.0 ldloc.s V_5 unbox.any System.Int32 ret <null> ldc.i4.0 <null> ret <null>
Module Name

DownloaderApp.exe
Full Name

DownloaderApp.exe
EntryPoint

System.Int32 <Module>::Main(System.String[])
Scope Name

DownloaderApp.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

DownloaderApp
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.7.2
Total Strings

1
Main Method

System.Int32 <Module>::Main(System.String[])
Main IL Instruction Count

96
Main IL

ldc.i4 65910 pop <null> ldc.i4 65910 newarr System.UInt32 dup <null> ldtoken <Module>/DataType <Module>::DataField call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.0 <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() dup <null> callvirt System.Reflection.Module System.Reflection.Assembly::get_ManifestModule() stloc.1 <null> ldloc.0 <null> ldc.i4 -2092476572 call System.Runtime.InteropServices.GCHandle <Module>::Decrypt(System.UInt32[],System.UInt32) stloc.2 <null> ldloca.s V_2 call System.Object System.Runtime.InteropServices.GCHandle::get_Target() castclass System.Byte[] stloc.3 <null> ldstr koi ldloc.3 <null> callvirt System.Reflection.Module System.Reflection.Assembly::LoadModule(System.String,System.Byte[]) ldloc.3 <null> ldc.i4.0 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloca.s V_2 call System.Void System.Runtime.InteropServices.GCHandle::Free() ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloc.1 <null> ldc.i4 285212673 callvirt System.Byte[] System.Reflection.Module::ResolveSignature(System.Int32) stsfld System.Byte[] <Module>::key call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Reflection.Assembly <Module>::Resolve(System.Object,System.ResolveEventArgs) newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) dup <null> callvirt System.Type[] System.Reflection.Module::GetTypes() pop <null> ldsfld System.Byte[] <Module>::key ldc.i4.0 <null> ldelem.u1 <null> ldsfld System.Byte[] <Module>::key ldc.i4.1 <null> ldelem.u1 <null> ldc.i4.8 <null> shl <null> or <null> ldsfld System.Byte[] <Module>::key ldc.i4.2 <null> ldelem.u1 <null> ldc.i4.s 16 shl <null> or <null> ldsfld System.Byte[] <Module>::key ldc.i4.3 <null> ldelem.u1 <null> ldc.i4.s 24 shl <null> or <null> callvirt System.Reflection.MethodBase System.Reflection.Module::ResolveMethod(System.Int32) dup <null> callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> conv.i4 <null> newarr System.Object stloc.s V_4 ldloc.s V_4 ldlen <null> brfalse.s IL_00D9: ldnull ldloc.s V_4 ldc.i4.0 <null> ldarg.0 <null> stelem.ref <null> ldnull <null> ldloc.s V_4 callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) stloc.s V_5 ldloc.s V_5 isinst System.Int32 brfalse.s IL_00F4: ldc.i4.0 ldloc.s V_5 unbox.any System.Int32 ret <null> ldc.i4.0 <null> ret <null>
Artefacts
Name
 Value
Embedded Resources

1
Suspicious Type Names (1-2 chars)

0
7e4482794753ece2c7555148db60813d (276.99 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙