Suspicious
Suspect

b3077ace6387caf4de4eb5f86bfe2899

PE Executable
|
MD5: b3077ace6387caf4de4eb5f86bfe2899
|
Size: 929.28 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
 Hash Value
MD5
b3077ace6387caf4de4eb5f86bfe2899
Sha1
80458915b138d49b253ae6e68653fa4269ba14c9
Sha256
94dc23fd9d82561b71f13af39a5ab13501ad77410d5870f30a2ea5cde9b54752
Sha384
104b4565457b55999043fc2543c41861be78a456d11275d7575ef45e4080d90f9c7f183e5f9e63e6e65e5b3f969ed9fd
Sha512
b3c20f9b2bbd8a077bf67b8e19d327b03acc2b9ccaedbe68c6bc6e153723e99233e3970024ef7d35bab4583657be0ac90785771e92527b947474fb468faa948e
SSDeep
24576:RAN7kqjzXly8dmtq1HAyIFIY/6goTv6NBD06lgOu0:OkqdvdX1HAyIFInuBI6lg
TLSH
6C1533E74E58D189CAAE01F11093DF303E5E17C62BE4ADCC164A4C6AF0F72852AE6D5C

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
b3077ace6387caf4de4eb5f86bfe2899
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
mbowzmu.Resources
ElysiumExeFree[0.4].exe
Hack.exe
Informations
Name
 Value
Module Name

ElysiumExeFree[0.4].exe
Full Name

ElysiumExeFree[0.4].exe
EntryPoint

System.Void Program::Main()
Scope Name

ElysiumExeFree[0.4].exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

ElysiumExeFree[0.4]
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

11
Main Method

System.Void Program::Main()
Main IL Instruction Count

39
Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007C: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_007A: br.s IL_0083 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007A: br.s IL_0083 br.s IL_0083: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>
Module Name

ElysiumExeFree[0.4].exe
Full Name

ElysiumExeFree[0.4].exe
EntryPoint

System.Void Program::Main()
Scope Name

ElysiumExeFree[0.4].exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

ElysiumExeFree[0.4]
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

11
Main Method

System.Void Program::Main()
Main IL Instruction Count

39
Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007C: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_007A: br.s IL_0083 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007A: br.s IL_0083 br.s IL_0083: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>
Artefacts
Name
 Value
Embedded Resources

1
Suspicious Type Names (1-2 chars)

0
b3077ace6387caf4de4eb5f86bfe2899 (929.28 KB)
File Structure
b3077ace6387caf4de4eb5f86bfe2899
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
mbowzmu.Resources
ElysiumExeFree[0.4].exe
Hack.exe
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
Embedded Resources

1

b3077ace6387caf4de4eb5f86bfe2899
Suspicious Type Names (1-2 chars)

0

b3077ace6387caf4de4eb5f86bfe2899
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙