Suspicious
Suspect

97f36207c47b8fbbf6995bb50eafd6df

PE Executable
|
MD5: 97f36207c47b8fbbf6995bb50eafd6df
|
Size: 1.39 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
97f36207c47b8fbbf6995bb50eafd6df
Sha1
3fc3b342a3b1f37fbbe85e66102b486e33972eb6
Sha256
e43e38d7957dc20e47f8718d04c1eca4bb649ea6a90776cfd0720f0fc3d22068
Sha384
9653d77a5d0e0d2bf70a4118a52fa12c92e1b4b65bcfbed21d2389aff50bfd69e49ac11411d3082d21a989b434139c04
Sha512
e02e7e950b59ba7dcf5502eabeeaa407916e964425bda20bd77a3041bec38ef3cf859eee699c6ef61555e5bc449d772f772f7e41a01ebd804d2fb763cc8ff2a6
SSDeep
24576:z48WnwJdQcj97JtgLoKZ1Or2UgxdyJgYD8K3N1uB8gCdJmvlL:NWmyLb1dqJhQ6VLk
TLSH
FD552283F95BC5A2C2045B3BC6DF940513B5D38AB293DB4AB1DE2361410BBFA855738B

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
97f36207c47b8fbbf6995bb50eafd6df
[Authenticode]_af40dfd5.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Oquxrl.Properties.Resources.resources
Iafqohzhn
ILRepack.List
​      ​      
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0x14FA00 size 18872 bytes
Module Name

Nwils
Full Name

Nwils
EntryPoint

System.Void Nwils.Collections.OperationalDictionary::FilterDictionary()
Scope Name

Nwils
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Nwils
Assembly Version

1.0.580.23610
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

0
Main Method

System.Void Nwils.Collections.OperationalDictionary::FilterDictionary()
Main IL Instruction Count

96
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_009B: ldc.i4 -74124478 newobj System.Void Nwils.Collections.OperationalDictionary/ViewerMember::.ctor() stloc.s V_3 ldc.i4 0 ldsfld <Module>{de80400d-e5c9-4316-862e-48e756a57849} <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_cd55f25fe32d413bbb8d1f45ff702ebf ldfld System.Int32 <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_a67bf790c6a54b75b440996b82a2c8bb brtrue IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) pop <null> ldc.i4 0 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) ldsfld System.Func`1<System.Byte[]> Nwils.Collections.OperationalDictionary/ExternalExecutor::executorUser dup <null> brtrue IL_00C8: newobj System.Void Nwils.Collectors.EventReceiver::.ctor(System.Func`1<System.Byte[]>) pop <null> ldc.i4 3 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) ldc.i4 -74124637 call System.String Nwils.Execution.GenericExecutor::AttachExecutor(System.Int32) stloc.s V_2 ldc.i4 2 ldsfld <Module>{de80400d-e5c9-4316-862e-48e756a57849} <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_cd55f25fe32d413bbb8d1f45ff702ebf ldfld System.Int32 <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_2767a7f8c48c4f94aa76345f6e49fb1a brtrue IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) pop <null> ldc.i4 2 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) ldc.i4 -74124478 call System.String Nwils.Execution.GenericExecutor::AttachExecutor(System.Int32) stloc.s V_1 ldc.i4 4 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) ret <null> ldsfld System.Object Nwils.Collections.OperationalDictionary/ExternalExecutor::commandMap ldftn System.Byte[] Nwils.Collections.OperationalDictionary/ExternalExecutor::ExecutePassiveStream() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Nwils.Collections.OperationalDictionary/ExternalExecutor::executorUser newobj System.Void Nwils.Collectors.EventReceiver::.ctor(System.Func`1<System.Byte[]>) ldloc.s V_3 ldloc.s V_1 ldloc.s V_2 newobj System.Void Nwils.Handling.ConfigurableHandler::.ctor(System.String,System.String) stfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::m_ProviderVerifier ldloc.s V_3 newobj System.Void Nwils.Handling.ObserverProfiler::.ctor() stfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::_BufferInspector ldloc.s V_3 ldc.i4 -74124620 call System.String Nwils.Execution.GenericExecutor::AttachExecutor(System.Int32) ldc.i4 -74124576 call System.String Nwils.Execution.GenericExecutor::AttachExecutor(System.Int32) newobj System.Void Nwils.Collectors.ErrorDic::.ctor(System.String,System.String) stfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::_ControllableMember dup <null> ldloc.s V_3 ldftn System.Void Nwils.Collections.OperationalDictionary/ViewerMember::AccessReadableCompressor(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Nwils.Collectors.EventReceiver::AcceptOperationalReceiver(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::m_ProviderVerifier ldloc.s V_3 ldftn System.Void Nwils.Collections.OperationalDictionary/ViewerMember::InvokeSegmentedAnalyzer(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Nwils.Handling.ConfigurableHandler::ProcessGroupedHandler(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::_BufferInspector ldloc.s V_3 ldftn System.Void Nwils.Collections.OperationalDictionary/ViewerMember::AccessRandomGateway(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Nwils.Handling.ObserverProfiler::AddConnectedObserver(System.Action`1<System.Reflection.Assembly>) ldloc.s V_3 ldfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::_ControllableMember ldsfld System.Object Nwils.Collections.OperationalDictionary/ExternalExecutor::_PortableStruct dup <null> brfalse IL_0165: pop br IL_017C: callvirt System.Void Nwils.Collectors.ErrorDic::CloseReceiver(System.Action) pop <null> ldsfld System.Object Nwils.Collections.OperationalDictionary/ExternalExecutor::commandMap ldftn System.Void Nwils.Collections.OperationalDictionary/ExternalExecutor::InsertExecutor() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Object Nwils.Collections.OperationalDictionary/ExternalExecutor::_PortableStruct callvirt System.Void Nwils.Collectors.ErrorDic::CloseReceiver(System.Action) callvirt System.Void Nwils.Collectors.EventReceiver::CollectLogicalReceiver() ldc.i4 5 ldsfld <Module>{de80400d-e5c9-4316-862e-48e756a57849} <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_cd55f25fe32d413bbb8d1f45ff702ebf ldfld System.Int32 <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_760432c6031f43818fda09b184cdce10 brtrue IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) pop <null> ldc.i4 0 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1)
Module Name

Nwils
Full Name

Nwils
EntryPoint

System.Void Nwils.Collections.OperationalDictionary::FilterDictionary()
Scope Name

Nwils
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Nwils
Assembly Version

1.0.580.23610
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

0
Main Method

System.Void Nwils.Collections.OperationalDictionary::FilterDictionary()
Main IL Instruction Count

96
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_009B: ldc.i4 -74124478 newobj System.Void Nwils.Collections.OperationalDictionary/ViewerMember::.ctor() stloc.s V_3 ldc.i4 0 ldsfld <Module>{de80400d-e5c9-4316-862e-48e756a57849} <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_cd55f25fe32d413bbb8d1f45ff702ebf ldfld System.Int32 <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_a67bf790c6a54b75b440996b82a2c8bb brtrue IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) pop <null> ldc.i4 0 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) ldsfld System.Func`1<System.Byte[]> Nwils.Collections.OperationalDictionary/ExternalExecutor::executorUser dup <null> brtrue IL_00C8: newobj System.Void Nwils.Collectors.EventReceiver::.ctor(System.Func`1<System.Byte[]>) pop <null> ldc.i4 3 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) ldc.i4 -74124637 call System.String Nwils.Execution.GenericExecutor::AttachExecutor(System.Int32) stloc.s V_2 ldc.i4 2 ldsfld <Module>{de80400d-e5c9-4316-862e-48e756a57849} <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_cd55f25fe32d413bbb8d1f45ff702ebf ldfld System.Int32 <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_2767a7f8c48c4f94aa76345f6e49fb1a brtrue IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) pop <null> ldc.i4 2 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) ldc.i4 -74124478 call System.String Nwils.Execution.GenericExecutor::AttachExecutor(System.Int32) stloc.s V_1 ldc.i4 4 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) ret <null> ldsfld System.Object Nwils.Collections.OperationalDictionary/ExternalExecutor::commandMap ldftn System.Byte[] Nwils.Collections.OperationalDictionary/ExternalExecutor::ExecutePassiveStream() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Nwils.Collections.OperationalDictionary/ExternalExecutor::executorUser newobj System.Void Nwils.Collectors.EventReceiver::.ctor(System.Func`1<System.Byte[]>) ldloc.s V_3 ldloc.s V_1 ldloc.s V_2 newobj System.Void Nwils.Handling.ConfigurableHandler::.ctor(System.String,System.String) stfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::m_ProviderVerifier ldloc.s V_3 newobj System.Void Nwils.Handling.ObserverProfiler::.ctor() stfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::_BufferInspector ldloc.s V_3 ldc.i4 -74124620 call System.String Nwils.Execution.GenericExecutor::AttachExecutor(System.Int32) ldc.i4 -74124576 call System.String Nwils.Execution.GenericExecutor::AttachExecutor(System.Int32) newobj System.Void Nwils.Collectors.ErrorDic::.ctor(System.String,System.String) stfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::_ControllableMember dup <null> ldloc.s V_3 ldftn System.Void Nwils.Collections.OperationalDictionary/ViewerMember::AccessReadableCompressor(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Nwils.Collectors.EventReceiver::AcceptOperationalReceiver(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::m_ProviderVerifier ldloc.s V_3 ldftn System.Void Nwils.Collections.OperationalDictionary/ViewerMember::InvokeSegmentedAnalyzer(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Nwils.Handling.ConfigurableHandler::ProcessGroupedHandler(System.Action`1<System.IO.MemoryStream>) ldloc.s V_3 ldfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::_BufferInspector ldloc.s V_3 ldftn System.Void Nwils.Collections.OperationalDictionary/ViewerMember::AccessRandomGateway(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Nwils.Handling.ObserverProfiler::AddConnectedObserver(System.Action`1<System.Reflection.Assembly>) ldloc.s V_3 ldfld System.Object Nwils.Collections.OperationalDictionary/ViewerMember::_ControllableMember ldsfld System.Object Nwils.Collections.OperationalDictionary/ExternalExecutor::_PortableStruct dup <null> brfalse IL_0165: pop br IL_017C: callvirt System.Void Nwils.Collectors.ErrorDic::CloseReceiver(System.Action) pop <null> ldsfld System.Object Nwils.Collections.OperationalDictionary/ExternalExecutor::commandMap ldftn System.Void Nwils.Collections.OperationalDictionary/ExternalExecutor::InsertExecutor() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Object Nwils.Collections.OperationalDictionary/ExternalExecutor::_PortableStruct callvirt System.Void Nwils.Collectors.ErrorDic::CloseReceiver(System.Action) callvirt System.Void Nwils.Collectors.EventReceiver::CollectLogicalReceiver() ldc.i4 5 ldsfld <Module>{de80400d-e5c9-4316-862e-48e756a57849} <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_cd55f25fe32d413bbb8d1f45ff702ebf ldfld System.Int32 <Module>{de80400d-e5c9-4316-862e-48e756a57849}::m_760432c6031f43818fda09b184cdce10 brtrue IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1) pop <null> ldc.i4 0 br IL_0012: switch(IL_009B,IL_0034,IL_005A,IL_00B2,IL_0070,IL_00B1)
97f36207c47b8fbbf6995bb50eafd6df (1.39 MB)
File Structure
97f36207c47b8fbbf6995bb50eafd6df
[Authenticode]_af40dfd5.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Oquxrl.Properties.Resources.resources
Iafqohzhn
ILRepack.List
​      ​      
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙