1V42M5.exe

PE Executable
|
MD5: 85e6e8fa37e3c98b223ee07e601b5f1c
|
Size: 2.68 MB
|
application/x-dosexec

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	85e6e8fa37e3c98b223ee07e601b5f1c
Sha1	8f891b36e80b4e8c4d090e9b0f05598ffab4dedb
Sha256	a61e745286c1ec16822dd0d16795a028476c76c0007bfbcc81f8b12ba28ef483
Sha384	e90732b226c22ea08902e6f5be80cad1d5600a465c2a399ee818aee79ae8920a4c99878b70ee8e586bd1a61e707999ce
Sha512	d9deaff94f55fb865a5341a60ffd0c314c310b50966fdfe86dfe72f8e3db66a29b0e10501065bc54900b7ba150e2b9d566fbb332c8652eee3b68ce6decca74af
SSDeep	49152:yq04exYBJBTpc8iYMC1yx5f6yflFkBHT9P+X5+NGuxCGggyM3el:1+i7TFMCUxQyfUB45+lxAg
TLSH	BAC51282FAA95FE3D36F1D39F6A413215D567DBC0F8A578AF66162CA88FD040CA104F1

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual C++ 6.0 DLL (Debug)

Microsoft Visual C++ 7.0 - 8.0

Microsoft Visual C++ v6.0 DLL

Microsoft Visual Studio .NET

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	DownloaderApp.exe
Full Name	DownloaderApp.exe
EntryPoint	System.Void ::(System.String[])
Scope Name	DownloaderApp.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	DownloaderApp
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	0
Main Method	System.Void ::(System.String[])
Main IL Instruction Count	106
Main IL	call System.Boolean ::() brtrue.s IL_0015: call System.Boolean System.Environment::get_UserInteractive() call System.Void ::() leave.s IL_0014: ret pop <null> leave IL_0155: ret ret <null> call System.Boolean System.Environment::get_UserInteractive() brtrue.s IL_0027: ldc.i4 116473110 newobj System.Void ::.ctor() call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase) ret <null> ldc.i4 116473110 call System.String ::(System.Int32) stloc.2 <null> ldc.i4 116473097 call System.String ::(System.Int32) stloc.3 <null> ldc.i4 116473120 call System.String ::(System.Int32) stloc.s V_4 ldc.i4.s 36 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) dup <null> ldloc.2 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.0 <null> ldloc.3 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> ldc.i4 116473176 call System.String ::(System.Int32) ldloc.0 <null> call System.Void ::(System.String,System.String) ldc.i4 116473208 call System.String ::(System.Int32) ldloc.1 <null> call System.Void ::(System.String,System.String) ldloc.0 <null> ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.1 <null> ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.0 <null> call System.Void ::(System.String) ldloc.1 <null> call System.Void ::(System.String) call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Void ::(System.String) ldloc.0 <null> ldloc.s V_4 call System.Void ::(System.String,System.String) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldc.i4 116473240 call System.String ::(System.Int32) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) dup <null> ldc.i4 116473226 call System.String ::(System.Int32) ldloc.0 <null> ldc.i4 116473278 call System.String ::(System.Int32) call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldc.i4 116473240 call System.String ::(System.Int32) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) dup <null> ldc.i4 116473226 call System.String ::(System.Int32) ldloc.1 <null> ldc.i4 116473278 call System.String ::(System.Int32) call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> leave.s IL_0155: ret pop <null> leave.s IL_0155: ret ret <null>
Module Name	DownloaderApp.exe
Full Name	DownloaderApp.exe
EntryPoint	System.Void ::(System.String[])
Scope Name	DownloaderApp.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	DownloaderApp
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	0
Main Method	System.Void ::(System.String[])
Main IL Instruction Count	106
Main IL	call System.Boolean ::() brtrue.s IL_0015: call System.Boolean System.Environment::get_UserInteractive() call System.Void ::() leave.s IL_0014: ret pop <null> leave IL_0155: ret ret <null> call System.Boolean System.Environment::get_UserInteractive() brtrue.s IL_0027: ldc.i4 116473110 newobj System.Void ::.ctor() call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase) ret <null> ldc.i4 116473110 call System.String ::(System.Int32) stloc.2 <null> ldc.i4 116473097 call System.String ::(System.Int32) stloc.3 <null> ldc.i4 116473120 call System.String ::(System.Int32) stloc.s V_4 ldc.i4.s 36 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) dup <null> ldloc.2 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.0 <null> ldloc.3 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> ldc.i4 116473176 call System.String ::(System.Int32) ldloc.0 <null> call System.Void ::(System.String,System.String) ldc.i4 116473208 call System.String ::(System.Int32) ldloc.1 <null> call System.Void ::(System.String,System.String) ldloc.0 <null> ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.1 <null> ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.0 <null> call System.Void ::(System.String) ldloc.1 <null> call System.Void ::(System.String) call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Void ::(System.String) ldloc.0 <null> ldloc.s V_4 call System.Void ::(System.String,System.String) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldc.i4 116473240 call System.String ::(System.Int32) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) dup <null> ldc.i4 116473226 call System.String ::(System.Int32) ldloc.0 <null> ldc.i4 116473278 call System.String ::(System.Int32) call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldc.i4 116473240 call System.String ::(System.Int32) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) dup <null> ldc.i4 116473226 call System.String ::(System.Int32) ldloc.1 <null> ldc.i4 116473278 call System.String ::(System.Int32) call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> leave.s IL_0155: ret pop <null> leave.s IL_0155: ret ret <null>

1V42M5.exe (2.68 MB)

File Structure

Characteristics

No malware configuration were found at this point.

You must be signed in to post a comment.

1V42M5.exe

PE Executable | MD5: 85e6e8fa37e3c98b223ee07e601b5f1c | Size: 2.68 MB | application/x-dosexec

PE Executable
|
MD5: 85e6e8fa37e3c98b223ee07e601b5f1c
|
Size: 2.68 MB
|
application/x-dosexec