Suspicious
Suspect

98305d77761a5b93852ed0f8e4ac8cb2

PE Executable
|
MD5: 98305d77761a5b93852ed0f8e4ac8cb2
|
Size: 13.95 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
98305d77761a5b93852ed0f8e4ac8cb2
Sha1
5feb73f91dcd474dc07addf9e5901b10e231c6a4
Sha256
d8ff7ec2d99a0660d02a01b36e212850da700e3c7ceff4fa0972551431e59aed
Sha384
abb77e5d2f401966a8bb9bd586a486d39f2fcdbda723b577e55a5c669e1cb50ddcf74f7044c8e9025bdabab605ae60af
Sha512
75dd9e685100d07a0f32f61876d16d848855d0056d56df50c880f1cf70fdb6b52994ab56a904b1cd35c05f973a38434303b4fa94da275eb7c0f65a24ab224a87
SSDeep
393216:v4+QvdoSRRQz7IbAbMVlmXdpYXuHMgzZTdpif:g+QWq2zmVlSdgVgzldK
TLSH
D8E63338F7E41729E75842B8949801AD03D0F7CE57F8C9BE761A4310EC9846D673AF6A

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
UPolyX 0.3 -> delikon
File Structure
98305d77761a5b93852ed0f8e4ac8cb2
[Authenticode]_633d0522.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Norboz.Properties.Resources.resources
Ctyemvhob
ILRepack.List
Igrjmqhem.png
Igrjmqhem.png-preview.png
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0xD4AA00 size 10632 bytes
Module Name

GXsetup
Full Name

GXsetup
EntryPoint

System.Void Norboz.Rxoizinka::Main()
Scope Name

GXsetup
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

GXsetup
Assembly Version

119.0.5497.62
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

16
Main Method

System.Void Norboz.Rxoizinka::Main()
Main IL Instruction Count

42
Main IL

newobj System.Void Norboz.Jnjwz::.ctor() stloc.0 <null> newobj System.Void Norboz.Xwvkjtlero::.ctor() stloc.1 <null> newobj System.Void Norboz.Amcvg::.ctor() stloc.2 <null> newobj System.Void Norboz.Wnmut::.ctor() stloc.3 <null> ldloc.1 <null> ldloc.2 <null> ldloc.3 <null> newobj System.Void Norboz.Daikgyed::.ctor(Norboz.Xwvkjtlero,Norboz.Amcvg,Norboz.Wnmut) stloc.s V_4 ldloc.0 <null> ldloc.s V_4 ldftn System.Void Norboz.Daikgyed::Yprmetyxrdq(System.Object,Norboz.Jzuyz) newobj System.Void System.EventHandler`1<Norboz.Jzuyz>::.ctor(System.Object,System.IntPtr) callvirt System.Void Norboz.Jnjwz::add_DownloadCompleted(System.EventHandler`1<Norboz.Jzuyz>) ldloc.1 <null> ldloc.s V_4 ldftn System.Void Norboz.Daikgyed::Xfasqcz(System.Object,Norboz.Rmlzsvodz) newobj System.Void System.EventHandler`1<Norboz.Rmlzsvodz>::.ctor(System.Object,System.IntPtr) callvirt System.Void Norboz.Xwvkjtlero::add_DecryptionCompleted(System.EventHandler`1<Norboz.Rmlzsvodz>) ldloc.2 <null> ldloc.s V_4 ldftn System.Void Norboz.Daikgyed::Ylxgjei(System.Object,Norboz.Ohqid) newobj System.Void System.EventHandler`1<Norboz.Ohqid>::.ctor(System.Object,System.IntPtr) callvirt System.Void Norboz.Amcvg::add_LoadCompleted(System.EventHandler`1<Norboz.Ohqid>) ldloc.3 <null> ldloc.s V_4 ldftn System.Void Norboz.Daikgyed::Vqinamc(System.Object,Norboz.Iwblhgvwv) newobj System.Void System.EventHandler`1<Norboz.Iwblhgvwv>::.ctor(System.Object,System.IntPtr) callvirt System.Void Norboz.Wnmut::add_InvocationCompleted(System.EventHandler`1<Norboz.Iwblhgvwv>) ldloc.0 <null> callvirt System.Void Norboz.Jnjwz::Aqfyepkulll() leave.s IL_0082: ret ldloc.s V_4 brfalse.s IL_0081: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
Module Name

GXsetup
Full Name

GXsetup
EntryPoint

System.Void Norboz.Rxoizinka::Main()
Scope Name

GXsetup
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

GXsetup
Assembly Version

119.0.5497.62
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

16
Main Method

System.Void Norboz.Rxoizinka::Main()
Main IL Instruction Count

42
Main IL

newobj System.Void Norboz.Jnjwz::.ctor() stloc.0 <null> newobj System.Void Norboz.Xwvkjtlero::.ctor() stloc.1 <null> newobj System.Void Norboz.Amcvg::.ctor() stloc.2 <null> newobj System.Void Norboz.Wnmut::.ctor() stloc.3 <null> ldloc.1 <null> ldloc.2 <null> ldloc.3 <null> newobj System.Void Norboz.Daikgyed::.ctor(Norboz.Xwvkjtlero,Norboz.Amcvg,Norboz.Wnmut) stloc.s V_4 ldloc.0 <null> ldloc.s V_4 ldftn System.Void Norboz.Daikgyed::Yprmetyxrdq(System.Object,Norboz.Jzuyz) newobj System.Void System.EventHandler`1<Norboz.Jzuyz>::.ctor(System.Object,System.IntPtr) callvirt System.Void Norboz.Jnjwz::add_DownloadCompleted(System.EventHandler`1<Norboz.Jzuyz>) ldloc.1 <null> ldloc.s V_4 ldftn System.Void Norboz.Daikgyed::Xfasqcz(System.Object,Norboz.Rmlzsvodz) newobj System.Void System.EventHandler`1<Norboz.Rmlzsvodz>::.ctor(System.Object,System.IntPtr) callvirt System.Void Norboz.Xwvkjtlero::add_DecryptionCompleted(System.EventHandler`1<Norboz.Rmlzsvodz>) ldloc.2 <null> ldloc.s V_4 ldftn System.Void Norboz.Daikgyed::Ylxgjei(System.Object,Norboz.Ohqid) newobj System.Void System.EventHandler`1<Norboz.Ohqid>::.ctor(System.Object,System.IntPtr) callvirt System.Void Norboz.Amcvg::add_LoadCompleted(System.EventHandler`1<Norboz.Ohqid>) ldloc.3 <null> ldloc.s V_4 ldftn System.Void Norboz.Daikgyed::Vqinamc(System.Object,Norboz.Iwblhgvwv) newobj System.Void System.EventHandler`1<Norboz.Iwblhgvwv>::.ctor(System.Object,System.IntPtr) callvirt System.Void Norboz.Wnmut::add_InvocationCompleted(System.EventHandler`1<Norboz.Iwblhgvwv>) ldloc.0 <null> callvirt System.Void Norboz.Jnjwz::Aqfyepkulll() leave.s IL_0082: ret ldloc.s V_4 brfalse.s IL_0081: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
98305d77761a5b93852ed0f8e4ac8cb2 (13.95 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙