Suspicious
Suspect

81879af759d84e0c4fa84d61e162f3c6

PE Executable
|
MD5: 81879af759d84e0c4fa84d61e162f3c6
|
Size: 1.23 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
81879af759d84e0c4fa84d61e162f3c6
Sha1
54b1bea37bf9f5980057a4137e64953414cd5291
Sha256
53f30e1593c7a75712d21b5f8d5de7ef1849e2bc6e3a8d064efebf1518517b01
Sha384
3be77c0476741df27b3aee4ae9a6cc8db786eb24f746e2d3a18967b8902d4aae002ff3fc0d4590a62601c45639823837
Sha512
1631270961524ed129e92a779ff824a8d922f3dc703120ffd523d21a9d15128f0543170537d389c51c2aabc96ea48179743d509e664ad97d012675f221a6e92d
SSDeep
24576:jME2ue6LgUsdgBjpm3/Upj9ArCOQkE61kRsq6jIDl4IGZB:jMEr5LgZL/+Srny6Cyq6jDIq
TLSH
A14523177B55C361C21C17BED63A1D009B72D681BE2FD35B38452BA668CB3BE860274B

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ v6.0 DLL
Microsoft Visual Studio .NET
File Structure
81879af759d84e0c4fa84d61e162f3c6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Rowzepyivi.Properties.Resources.resources
Koozbxwgn
ILRepack.List
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

41709937600
Full Name

41709937600
EntryPoint

System.Void CryptSharp.Testing.TesterQueue::InspectDetachedTester()
Scope Name

41709937600
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

41709937600
Assembly Version

1.0.7121.8543
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

48
Main Method

System.Void CryptSharp.Testing.TesterQueue::InspectDetachedTester()
Main IL Instruction Count

98
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_00AC: ldstr "ZhXz4Ta+fEWUytl/2xcEvw==" ldsfld System.Func`1<System.Byte[]> CryptSharp.Testing.TesterQueue/<>c::_DispatcherCache dup <null> brtrue IL_00E8: newobj System.Void .Execution.CommandSender::.ctor(System.Func`1<System.Byte[]>) pop <null> ldc.i4 4 ldsfld <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b} <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_03da610520454e228379687e90710df3 ldfld System.Int32 <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_77714a0317f549ccb4d94c0f02e30684 brfalse IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) pop <null> ldc.i4 4 br IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) ldstr T0TagejkvR4= stloc.s V_2 ldc.i4 1 ldsfld <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b} <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_03da610520454e228379687e90710df3 ldfld System.Int32 <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_15b3e7b4562c478c88facf890066dd8e brtrue IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) pop <null> ldc.i4 5 br IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) newobj System.Void CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::.ctor() stloc.s V_3 ldc.i4 0 ldsfld <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b} <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_03da610520454e228379687e90710df3 ldfld System.Int32 <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_7806b70dcc4a438cbba62d518e15892d brtrue IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) pop <null> ldc.i4 0 br IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) ret <null> ldstr ZhXz4Ta+fEWUytl/2xcEvw== stloc.s V_1 ldc.i4 2 ldsfld <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b} <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_03da610520454e228379687e90710df3 ldfld System.Int32 <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_502bd7cb688b4813b7bcf122416ace0b brtrue IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) pop <null> ldc.i4 2 br IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) ldsfld CryptSharp.Testing.TesterQueue/<>c CryptSharp.Testing.TesterQueue/<>c::testerPublisher ldftn System.Byte[] CryptSharp.Testing.TesterQueue/<>c::SplitTester() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> CryptSharp.Testing.TesterQueue/<>c::_DispatcherCache newobj System.Void .Execution.CommandSender::.ctor(System.Func`1<System.Byte[]>) ldloc.s V_3 ldloc.s V_1 ldloc.s V_2 newobj System.Void .Distribution.DistributorStub::.ctor(System.String,System.String) stfld .Distribution.DistributorStub CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::m_IdentifiableConsumer ldloc.s V_3 newobj System.Void CryptSharp.Networking.VisibleSender::.ctor() stfld CryptSharp.Networking.VisibleSender CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::_TesterMember ldloc.s V_3 ldstr oyJMnYUbLehJ5p0Jml.noVsXTlmK1PkNVoDng ldstr fS3u9IngQ newobj System.Void .Execution.ErrorNode::.ctor(System.String,System.String) stfld .Execution.ErrorNode CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::commonService dup <null> ldloc.s V_3 ldftn System.Void CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::EvaluateCustomizableTester(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void .Execution.CommandSender::SolveCommand(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld .Distribution.DistributorStub CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::m_IdentifiableConsumer ldloc.s V_3 ldftn System.Void CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::TestSimpleTester(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void .Distribution.DistributorStub::RunDistributor(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld CryptSharp.Networking.VisibleSender CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::_TesterMember ldloc.s V_3 ldftn System.Void CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::ValidateTester(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void CryptSharp.Networking.VisibleSender::SendInternalSender(System.Action`1<System.Reflection.Assembly>) ldloc.s V_3 ldfld .Execution.ErrorNode CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::commonService ldsfld System.Action CryptSharp.Testing.TesterQueue/<>c::_FactoryList dup <null> brfalse IL_017B: pop br IL_0192: callvirt System.Void .Execution.ErrorNode::ExecuteIntegratedCommand(System.Action) pop <null> ldsfld CryptSharp.Testing.TesterQueue/<>c CryptSharp.Testing.TesterQueue/<>c::testerPublisher ldftn System.Void CryptSharp.Testing.TesterQueue/<>c::InspectGeneralTester() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action CryptSharp.Testing.TesterQueue/<>c::_FactoryList callvirt System.Void .Execution.ErrorNode::ExecuteIntegratedCommand(System.Action) callvirt System.Void .Execution.CommandSender::RunLiteralCommand() ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0
Module Name

41709937600
Full Name

41709937600
EntryPoint

System.Void CryptSharp.Testing.TesterQueue::InspectDetachedTester()
Scope Name

41709937600
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

41709937600
Assembly Version

1.0.7121.8543
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

48
Main Method

System.Void CryptSharp.Testing.TesterQueue::InspectDetachedTester()
Main IL Instruction Count

98
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_00AC: ldstr "ZhXz4Ta+fEWUytl/2xcEvw==" ldsfld System.Func`1<System.Byte[]> CryptSharp.Testing.TesterQueue/<>c::_DispatcherCache dup <null> brtrue IL_00E8: newobj System.Void .Execution.CommandSender::.ctor(System.Func`1<System.Byte[]>) pop <null> ldc.i4 4 ldsfld <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b} <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_03da610520454e228379687e90710df3 ldfld System.Int32 <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_77714a0317f549ccb4d94c0f02e30684 brfalse IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) pop <null> ldc.i4 4 br IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) ldstr T0TagejkvR4= stloc.s V_2 ldc.i4 1 ldsfld <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b} <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_03da610520454e228379687e90710df3 ldfld System.Int32 <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_15b3e7b4562c478c88facf890066dd8e brtrue IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) pop <null> ldc.i4 5 br IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) newobj System.Void CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::.ctor() stloc.s V_3 ldc.i4 0 ldsfld <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b} <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_03da610520454e228379687e90710df3 ldfld System.Int32 <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_7806b70dcc4a438cbba62d518e15892d brtrue IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) pop <null> ldc.i4 0 br IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) ret <null> ldstr ZhXz4Ta+fEWUytl/2xcEvw== stloc.s V_1 ldc.i4 2 ldsfld <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b} <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_03da610520454e228379687e90710df3 ldfld System.Int32 <Module>{45e5c630-7bc2-4f0e-b34e-1c43c3110d4b}::m_502bd7cb688b4813b7bcf122416ace0b brtrue IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) pop <null> ldc.i4 2 br IL_0012: switch(IL_00AC,IL_0085,IL_005F,IL_00AB,IL_00D2,IL_0034) ldsfld CryptSharp.Testing.TesterQueue/<>c CryptSharp.Testing.TesterQueue/<>c::testerPublisher ldftn System.Byte[] CryptSharp.Testing.TesterQueue/<>c::SplitTester() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> CryptSharp.Testing.TesterQueue/<>c::_DispatcherCache newobj System.Void .Execution.CommandSender::.ctor(System.Func`1<System.Byte[]>) ldloc.s V_3 ldloc.s V_1 ldloc.s V_2 newobj System.Void .Distribution.DistributorStub::.ctor(System.String,System.String) stfld .Distribution.DistributorStub CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::m_IdentifiableConsumer ldloc.s V_3 newobj System.Void CryptSharp.Networking.VisibleSender::.ctor() stfld CryptSharp.Networking.VisibleSender CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::_TesterMember ldloc.s V_3 ldstr oyJMnYUbLehJ5p0Jml.noVsXTlmK1PkNVoDng ldstr fS3u9IngQ newobj System.Void .Execution.ErrorNode::.ctor(System.String,System.String) stfld .Execution.ErrorNode CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::commonService dup <null> ldloc.s V_3 ldftn System.Void CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::EvaluateCustomizableTester(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void .Execution.CommandSender::SolveCommand(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld .Distribution.DistributorStub CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::m_IdentifiableConsumer ldloc.s V_3 ldftn System.Void CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::TestSimpleTester(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void .Distribution.DistributorStub::RunDistributor(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld CryptSharp.Networking.VisibleSender CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::_TesterMember ldloc.s V_3 ldftn System.Void CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::ValidateTester(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void CryptSharp.Networking.VisibleSender::SendInternalSender(System.Action`1<System.Reflection.Assembly>) ldloc.s V_3 ldfld .Execution.ErrorNode CryptSharp.Testing.TesterQueue/<>c__DisplayClass0_0::commonService ldsfld System.Action CryptSharp.Testing.TesterQueue/<>c::_FactoryList dup <null> brfalse IL_017B: pop br IL_0192: callvirt System.Void .Execution.ErrorNode::ExecuteIntegratedCommand(System.Action) pop <null> ldsfld CryptSharp.Testing.TesterQueue/<>c CryptSharp.Testing.TesterQueue/<>c::testerPublisher ldftn System.Void CryptSharp.Testing.TesterQueue/<>c::InspectGeneralTester() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action CryptSharp.Testing.TesterQueue/<>c::_FactoryList callvirt System.Void .Execution.ErrorNode::ExecuteIntegratedCommand(System.Action) callvirt System.Void .Execution.CommandSender::RunLiteralCommand() ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0
81879af759d84e0c4fa84d61e162f3c6 (1.23 MB)
File Structure
81879af759d84e0c4fa84d61e162f3c6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Rowzepyivi.Properties.Resources.resources
Koozbxwgn
ILRepack.List
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙