Suspicious
Suspect

a987e67b986d528e7e29fa70b5a7303f

PE Executable
|
MD5: a987e67b986d528e7e29fa70b5a7303f
|
Size: 972.29 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
a987e67b986d528e7e29fa70b5a7303f
Sha1
4c08e0c5f4b868b0d9880ce7a26c58c1edd37f39
Sha256
f7121d16f7c5e546edc168027fdcbeee4698b1038b035003002cee8a295468ad
Sha384
d7320d53209cc2ad298634981592775a86eeff6353f9ac804699d58b92c28e170773033d26cfff3dd074432c07ff1f47
Sha512
d1002db7ffb706ffb9566a471ad0394327f6af58fbc3799823e59cfcd7206f9660c028e54354a2b98161a4da1a0f5d9f6cc0fb74ae74883491dc8c0bd342c8f5
SSDeep
24576:msPVfx+0DbFKjgyZ6RYBIaZKpPIHSTaiTwGEqGO:FPhDXFWgyiYB1I2STaXq
TLSH
882523F5B6656A93EF80773FC2E3E8610509BA8014C514983AD60E0E7D7EFA4F365263

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
a987e67b986d528e7e29fa70b5a7303f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Fuftukhukm.Properties.Resources.resources
Vainggryen
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Ojnqgqus.exe
Full Name

Ojnqgqus.exe
EntryPoint

System.Void Fuftukhukm.Programming.FunctionObject::ImplementInterruptibleFunction()
Scope Name

Ojnqgqus.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ojnqgqus
Assembly Version

1.0.4569.11701
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

6
Main Method

System.Void Fuftukhukm.Programming.FunctionObject::ImplementInterruptibleFunction()
Main IL Instruction Count

32
Main IL

ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0028: ret ret <null> ldsfld System.Action`1<System.IO.MemoryStream> Fuftukhukm.Programming.FunctionObject/<>c::_IntegratedFunction dup <null> brfalse IL_0039: pop br IL_006F: call System.Void Fuftukhukm.Programming.FunctionObject::PlayFunction(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 1 ldsfld <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5} <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5}::m_85e4f3a5774c49a1acb0a62f6f61b5de ldfld System.Int32 <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5}::m_10b5944f414d4c47a7c63c4a4e744eed brtrue IL_0012: switch(IL_0028,IL_0059,IL_0029) pop <null> ldc.i4 1 br IL_0012: switch(IL_0028,IL_0059,IL_0029) ldsfld Fuftukhukm.Programming.FunctionObject/<>c Fuftukhukm.Programming.FunctionObject/<>c::modularAnnotation ldftn System.Void Fuftukhukm.Programming.FunctionObject/<>c::CallModularFunction(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> Fuftukhukm.Programming.FunctionObject/<>c::_IntegratedFunction call System.Void Fuftukhukm.Programming.FunctionObject::PlayFunction(System.Action`1<System.IO.MemoryStream>) ldc.i4 0 ldsfld <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5} <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5}::m_85e4f3a5774c49a1acb0a62f6f61b5de ldfld System.Int32 <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5}::m_1eb33eafe70b449bb51a4e8489c21684 brtrue IL_0012: switch(IL_0028,IL_0059,IL_0029) pop <null> ldc.i4 0 br IL_0012: switch(IL_0028,IL_0059,IL_0029)
Module Name

Ojnqgqus.exe
Full Name

Ojnqgqus.exe
EntryPoint

System.Void Fuftukhukm.Programming.FunctionObject::ImplementInterruptibleFunction()
Scope Name

Ojnqgqus.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ojnqgqus
Assembly Version

1.0.4569.11701
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

6
Main Method

System.Void Fuftukhukm.Programming.FunctionObject::ImplementInterruptibleFunction()
Main IL Instruction Count

32
Main IL

ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0028: ret ret <null> ldsfld System.Action`1<System.IO.MemoryStream> Fuftukhukm.Programming.FunctionObject/<>c::_IntegratedFunction dup <null> brfalse IL_0039: pop br IL_006F: call System.Void Fuftukhukm.Programming.FunctionObject::PlayFunction(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 1 ldsfld <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5} <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5}::m_85e4f3a5774c49a1acb0a62f6f61b5de ldfld System.Int32 <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5}::m_10b5944f414d4c47a7c63c4a4e744eed brtrue IL_0012: switch(IL_0028,IL_0059,IL_0029) pop <null> ldc.i4 1 br IL_0012: switch(IL_0028,IL_0059,IL_0029) ldsfld Fuftukhukm.Programming.FunctionObject/<>c Fuftukhukm.Programming.FunctionObject/<>c::modularAnnotation ldftn System.Void Fuftukhukm.Programming.FunctionObject/<>c::CallModularFunction(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> Fuftukhukm.Programming.FunctionObject/<>c::_IntegratedFunction call System.Void Fuftukhukm.Programming.FunctionObject::PlayFunction(System.Action`1<System.IO.MemoryStream>) ldc.i4 0 ldsfld <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5} <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5}::m_85e4f3a5774c49a1acb0a62f6f61b5de ldfld System.Int32 <Module>{e63c67a3-d1b7-429e-b985-3a4f851994e5}::m_1eb33eafe70b449bb51a4e8489c21684 brtrue IL_0012: switch(IL_0028,IL_0059,IL_0029) pop <null> ldc.i4 0 br IL_0012: switch(IL_0028,IL_0059,IL_0029)
a987e67b986d528e7e29fa70b5a7303f (972.29 KB)
File Structure
a987e67b986d528e7e29fa70b5a7303f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Fuftukhukm.Properties.Resources.resources
Vainggryen
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙