Suspicious
Suspect

a5d76127614daedf642624e74f3c404c

PE Executable
|
MD5: a5d76127614daedf642624e74f3c404c
|
Size: 8.7 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
 Hash Value
MD5
a5d76127614daedf642624e74f3c404c
Sha1
afdc2889a44fdc65517e7ba9bdfe9326698dcb92
Sha256
2e492bd375e85e8da83b948d454235be9c76c89f1c769f30cd080efa7c60592e
Sha384
2b0024c12c1dcefb2d3f3e63a1147e50b48c08f4796f83b63cc51756e7bed81b00d18b9d3b620036660f0f1d133b8f7f
Sha512
515d8dac822140d0eeb62d2ba8c47ba279c2e6c4c0497cbcd672aff0fc3bd91e14cfd89d262a376964645f7308fd58cddcdbdb8bde8f88129a2c40ec137d617b
SSDeep
96:mMFblNMLHk0nDGJK9iYNRh5++u1fLFkWxOEacUKfE4wkxjE9pfndNqBzNt:11EYKIORhk3tLCOOEaQwcjEXnw
TLSH
8C02F926B7E8C735D9BB0B3598B356400A74B354DC27DB6EB889210BAD6334046E2FB0

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
a5d76127614daedf642624e74f3c404c
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
App.Properties.Resources.resources
Informations
Name
 Value
Module Name

App.exe
Full Name

App.exe
EntryPoint

System.Void App.Program::Main()
Scope Name

App.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

App
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.7.2
Total Strings

16
Main Method

System.Void App.Program::Main()
Main IL Instruction Count

156
Main IL

ldc.i4.s 11 newarr System.String dup <null> ldc.i4.0 <null> ldstr CloneAppParameters.exe stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr PhotoRecoveryTable.exe stelem.ref <null> dup <null> ldc.i4.2 <null> ldstr AdvancedWindowsManager.exe stelem.ref <null> dup <null> ldc.i4.3 <null> ldstr OneDrivePatcher.exe stelem.ref <null> dup <null> ldc.i4.4 <null> ldstr uninstaller.exe stelem.ref <null> dup <null> ldc.i4.5 <null> ldstr updatechecker.exe stelem.ref <null> dup <null> ldc.i4.6 <null> ldstr DiskRecoveryTool.exe stelem.ref <null> dup <null> ldc.i4.7 <null> ldstr UninstallMonitor.exe stelem.ref <null> dup <null> ldc.i4.8 <null> ldstr SystemSettings.exe stelem.ref <null> dup <null> ldc.i4.s 9 ldstr SystemOptimizer.exe stelem.ref <null> dup <null> ldc.i4.s 10 ldstr elevation_service.exe stelem.ref <null> stloc.0 <null> ldc.i4.2 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr svchost stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr cloneapp stelem.ref <null> stloc.1 <null> call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcesses() stloc.2 <null> ldc.i4.0 <null> stloc.3 <null> br IL_0185: ldloc.3 ldloc.2 <null> ldloc.3 <null> ldelem.ref <null> stloc.s V_4 newobj System.Void App.Program/<>c__DisplayClass0_0::.ctor() stloc.s V_5 ldnull <null> stloc.s V_6 ldloc.s V_5 ldnull <null> stfld System.String App.Program/<>c__DisplayClass0_0::exeName ldloc.s V_4 callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() stloc.s V_6 ldloc.s V_5 ldloc.s V_6 call System.String System.IO.Path::GetFileName(System.String) stfld System.String App.Program/<>c__DisplayClass0_0::exeName leave.s IL_00C1: ldloc.s V_6 pop <null> leave IL_0181: ldloc.3 ldloc.s V_6 call System.Boolean System.String::IsNullOrEmpty(System.String) brtrue IL_0181: ldloc.3 ldloc.s V_6 call System.Boolean System.IO.File::Exists(System.String) brfalse IL_0181: ldloc.3 ldloc.0 <null> ldloc.s V_5 ldftn System.Boolean App.Program/<>c__DisplayClass0_0::<Main>b__0(System.String) newobj System.Void System.Func`2<System.String,System.Boolean>::.ctor(System.Object,System.IntPtr) call System.Boolean System.Linq.Enumerable::Any<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`2<System.String,System.Boolean>) stloc.s V_7 ldloc.s V_7 brtrue.s IL_0107: ldloc.s V_7 ldloc.1 <null> ldloc.s V_5 ldftn System.Boolean App.Program/<>c__DisplayClass0_0::<Main>b__1(System.String) newobj System.Void System.Func`2<System.String,System.Boolean>::.ctor(System.Object,System.IntPtr) call System.Boolean System.Linq.Enumerable::Any<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`2<System.String,System.Boolean>) stloc.s V_7 ldloc.s V_7 brfalse.s IL_0181: ldloc.3 ldloc.s V_4 callvirt System.Void System.Diagnostics.Process::Kill() ldloc.s V_4 ldc.i4 5000 callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32) pop <null> leave.s IL_0124: ldc.i4 1000 pop <null> leave.s IL_0124: ldc.i4 1000 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.s V_6 call System.String System.IO.Path::GetDirectoryName(System.String) stloc.s V_8 ldloc.s V_8 call System.Boolean System.IO.Directory::Exists(System.String) brfalse.s IL_0181: ldloc.3 ldloc.s V_8 newobj System.Void System.IO.DirectoryInfo::.ctor(System.String) dup <null> callvirt System.Security.AccessControl.DirectorySecurity System.IO.DirectoryInfo::GetAccessControl() stloc.s V_9 ldloc.s V_9 call System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent() callvirt System.Security.Principal.SecurityIdentifier System.Security.Principal.WindowsIdentity::get_User() ldc.i4 2032127 ldc.i4.3 <null> ldc.i4.0 <null> ldc.i4.0 <null> newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.Security.Principal.IdentityReference,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.InheritanceFlags,System.Security.AccessControl.PropagationFlags,System.Security.AccessControl.AccessControlType) callvirt System.Void System.Security.AccessControl.FileSystemSecurity::SetAccessRule(System.Security.AccessControl.FileSystemAccessRule) ldloc.s V_9 callvirt System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity) ldloc.s V_8 ldc.i4.1 <null> call System.Void System.IO.Directory::Delete(System.String,System.Boolean) leave.s IL_0181: ldloc.3 pop <null> leave.s IL_0181: ldloc.3 ldloc.3 <null> ldc.i4.1 <null> add <null> stloc.3 <null> ldloc.3 <null> ldloc.2 <null> ldlen <null> conv.i4 <null> blt IL_0086: ldloc.2 ret <null>
Module Name

App.exe
Full Name

App.exe
EntryPoint

System.Void App.Program::Main()
Scope Name

App.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

App
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.7.2
Total Strings

16
Main Method

System.Void App.Program::Main()
Main IL Instruction Count

156
Main IL

ldc.i4.s 11 newarr System.String dup <null> ldc.i4.0 <null> ldstr CloneAppParameters.exe stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr PhotoRecoveryTable.exe stelem.ref <null> dup <null> ldc.i4.2 <null> ldstr AdvancedWindowsManager.exe stelem.ref <null> dup <null> ldc.i4.3 <null> ldstr OneDrivePatcher.exe stelem.ref <null> dup <null> ldc.i4.4 <null> ldstr uninstaller.exe stelem.ref <null> dup <null> ldc.i4.5 <null> ldstr updatechecker.exe stelem.ref <null> dup <null> ldc.i4.6 <null> ldstr DiskRecoveryTool.exe stelem.ref <null> dup <null> ldc.i4.7 <null> ldstr UninstallMonitor.exe stelem.ref <null> dup <null> ldc.i4.8 <null> ldstr SystemSettings.exe stelem.ref <null> dup <null> ldc.i4.s 9 ldstr SystemOptimizer.exe stelem.ref <null> dup <null> ldc.i4.s 10 ldstr elevation_service.exe stelem.ref <null> stloc.0 <null> ldc.i4.2 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr svchost stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr cloneapp stelem.ref <null> stloc.1 <null> call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcesses() stloc.2 <null> ldc.i4.0 <null> stloc.3 <null> br IL_0185: ldloc.3 ldloc.2 <null> ldloc.3 <null> ldelem.ref <null> stloc.s V_4 newobj System.Void App.Program/<>c__DisplayClass0_0::.ctor() stloc.s V_5 ldnull <null> stloc.s V_6 ldloc.s V_5 ldnull <null> stfld System.String App.Program/<>c__DisplayClass0_0::exeName ldloc.s V_4 callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() stloc.s V_6 ldloc.s V_5 ldloc.s V_6 call System.String System.IO.Path::GetFileName(System.String) stfld System.String App.Program/<>c__DisplayClass0_0::exeName leave.s IL_00C1: ldloc.s V_6 pop <null> leave IL_0181: ldloc.3 ldloc.s V_6 call System.Boolean System.String::IsNullOrEmpty(System.String) brtrue IL_0181: ldloc.3 ldloc.s V_6 call System.Boolean System.IO.File::Exists(System.String) brfalse IL_0181: ldloc.3 ldloc.0 <null> ldloc.s V_5 ldftn System.Boolean App.Program/<>c__DisplayClass0_0::<Main>b__0(System.String) newobj System.Void System.Func`2<System.String,System.Boolean>::.ctor(System.Object,System.IntPtr) call System.Boolean System.Linq.Enumerable::Any<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`2<System.String,System.Boolean>) stloc.s V_7 ldloc.s V_7 brtrue.s IL_0107: ldloc.s V_7 ldloc.1 <null> ldloc.s V_5 ldftn System.Boolean App.Program/<>c__DisplayClass0_0::<Main>b__1(System.String) newobj System.Void System.Func`2<System.String,System.Boolean>::.ctor(System.Object,System.IntPtr) call System.Boolean System.Linq.Enumerable::Any<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Func`2<System.String,System.Boolean>) stloc.s V_7 ldloc.s V_7 brfalse.s IL_0181: ldloc.3 ldloc.s V_4 callvirt System.Void System.Diagnostics.Process::Kill() ldloc.s V_4 ldc.i4 5000 callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32) pop <null> leave.s IL_0124: ldc.i4 1000 pop <null> leave.s IL_0124: ldc.i4 1000 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.s V_6 call System.String System.IO.Path::GetDirectoryName(System.String) stloc.s V_8 ldloc.s V_8 call System.Boolean System.IO.Directory::Exists(System.String) brfalse.s IL_0181: ldloc.3 ldloc.s V_8 newobj System.Void System.IO.DirectoryInfo::.ctor(System.String) dup <null> callvirt System.Security.AccessControl.DirectorySecurity System.IO.DirectoryInfo::GetAccessControl() stloc.s V_9 ldloc.s V_9 call System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent() callvirt System.Security.Principal.SecurityIdentifier System.Security.Principal.WindowsIdentity::get_User() ldc.i4 2032127 ldc.i4.3 <null> ldc.i4.0 <null> ldc.i4.0 <null> newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.Security.Principal.IdentityReference,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.InheritanceFlags,System.Security.AccessControl.PropagationFlags,System.Security.AccessControl.AccessControlType) callvirt System.Void System.Security.AccessControl.FileSystemSecurity::SetAccessRule(System.Security.AccessControl.FileSystemAccessRule) ldloc.s V_9 callvirt System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity) ldloc.s V_8 ldc.i4.1 <null> call System.Void System.IO.Directory::Delete(System.String,System.Boolean) leave.s IL_0181: ldloc.3 pop <null> leave.s IL_0181: ldloc.3 ldloc.3 <null> ldc.i4.1 <null> add <null> stloc.3 <null> ldloc.3 <null> ldloc.2 <null> ldlen <null> conv.i4 <null> blt IL_0086: ldloc.2 ret <null>
Artefacts
Name
 Value
Embedded Resources

1
Suspicious Type Names (1-2 chars)

0
a5d76127614daedf642624e74f3c404c (8.7 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙