Suspicious
Suspect

b994cfeb9a6617ddc3a1383d3d1493c3

PE Executable
|
MD5: b994cfeb9a6617ddc3a1383d3d1493c3
|
Size: 984.06 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
b994cfeb9a6617ddc3a1383d3d1493c3
Sha1
2564959ccb76d7aa24247fc52dc5de08bec9eb38
Sha256
4b493efbc51d8cc77f3fe9e2b96070d5b9e1641a00a3f265cdb60209993fa515
Sha384
24ee3c4af620393f7e04d73a1b9fd5242423d6eb164c4ff2ea9e0b4563eab29d85155c427168c4c3aae5422d16ed4ce4
Sha512
a20448474ecff9df8143b899232db427e994f186a42227fe3d5dbbc940f2d813e6d0c726698089fcc25834bc4443c2b8cde1ed43b567b5354e7205405f8b5bf5
SSDeep
24576:2gam8Sb0zNDZqWRkkQ8TvprwHpV6q/hB+UTvpAT+yjf4rd9B33Bu:2O4RDEkQivpraLNB+U9ATPcrd3R
TLSH
E525231F67A5BBA9EFB81FFC62B51B190674370199330785521C703A39A9327286327F

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
b994cfeb9a6617ddc3a1383d3d1493c3
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Hfozrmwjoyp.Properties.Resources.resources
Mvhqyt
ILRepack.List
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Fsrqyz
Full Name

Fsrqyz
EntryPoint

System.Void Hfozrmwjoyp.Ucabvwdioy::Main()
Scope Name

Fsrqyz
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Fsrqyz
Assembly Version

1.0.7666.24805
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

48
Main Method

System.Void Hfozrmwjoyp.Ucabvwdioy::Main()
Main IL Instruction Count

60
Main IL

newobj System.Void Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::.ctor() stloc.0 <null> ldstr iOZcPfL9WdP1W68fVwD38g== stloc.1 <null> ldstr Ls4Uzy9MuMU= stloc.2 <null> ldsfld System.Func`1<System.Byte[]> Hfozrmwjoyp.Ucabvwdioy/<>c::<>9__0_0 dup <null> brtrue.s IL_0031: newobj System.Void Hfozrmwjoyp.Bexfvgdanvd::.ctor(System.Func`1<System.Byte[]>) pop <null> ldsfld Hfozrmwjoyp.Ucabvwdioy/<>c Hfozrmwjoyp.Ucabvwdioy/<>c::<>9 ldftn System.Byte[] Hfozrmwjoyp.Ucabvwdioy/<>c::<Main>b__0_0() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Hfozrmwjoyp.Ucabvwdioy/<>c::<>9__0_0 newobj System.Void Hfozrmwjoyp.Bexfvgdanvd::.ctor(System.Func`1<System.Byte[]>) ldloc.0 <null> ldloc.1 <null> ldloc.2 <null> newobj System.Void Hfozrmwjoyp.Nilusbygr::.ctor(System.String,System.String) stfld Hfozrmwjoyp.Nilusbygr Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::decryptor ldloc.0 <null> newobj System.Void Hfozrmwjoyp.Zyehsepg::.ctor() stfld Hfozrmwjoyp.Zyehsepg Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::loader ldloc.0 <null> ldstr p4elkxo9MdaB2ZKWCD.wIkV3NttGYQhkUNOl5 ldstr BLSPP0OgL newobj System.Void Hfozrmwjoyp.Nlajncfpeqm::.ctor(System.String,System.String) stfld Hfozrmwjoyp.Nlajncfpeqm Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::invoker dup <null> ldloc.0 <null> ldftn System.Void Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::<Main>b__1(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Hfozrmwjoyp.Bexfvgdanvd::add_DownloadCompleted(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld Hfozrmwjoyp.Nilusbygr Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::decryptor ldloc.0 <null> ldftn System.Void Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::<Main>b__2(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Hfozrmwjoyp.Nilusbygr::add_DecryptionCompleted(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld Hfozrmwjoyp.Zyehsepg Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::loader ldloc.0 <null> ldftn System.Void Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::<Main>b__3(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Hfozrmwjoyp.Zyehsepg::add_LoadCompleted(System.Action`1<System.Reflection.Assembly>) ldloc.0 <null> ldfld Hfozrmwjoyp.Nlajncfpeqm Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::invoker ldsfld System.Action Hfozrmwjoyp.Ucabvwdioy/<>c::<>9__0_4 dup <null> brtrue.s IL_00C8: callvirt System.Void Hfozrmwjoyp.Nlajncfpeqm::add_InvocationCompleted(System.Action) pop <null> ldsfld Hfozrmwjoyp.Ucabvwdioy/<>c Hfozrmwjoyp.Ucabvwdioy/<>c::<>9 ldftn System.Void Hfozrmwjoyp.Ucabvwdioy/<>c::<Main>b__0_4() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action Hfozrmwjoyp.Ucabvwdioy/<>c::<>9__0_4 callvirt System.Void Hfozrmwjoyp.Nlajncfpeqm::add_InvocationCompleted(System.Action) callvirt System.Void Hfozrmwjoyp.Bexfvgdanvd::Abmyfz() ret <null>
Module Name

Fsrqyz
Full Name

Fsrqyz
EntryPoint

System.Void Hfozrmwjoyp.Ucabvwdioy::Main()
Scope Name

Fsrqyz
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Fsrqyz
Assembly Version

1.0.7666.24805
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

48
Main Method

System.Void Hfozrmwjoyp.Ucabvwdioy::Main()
Main IL Instruction Count

60
Main IL

newobj System.Void Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::.ctor() stloc.0 <null> ldstr iOZcPfL9WdP1W68fVwD38g== stloc.1 <null> ldstr Ls4Uzy9MuMU= stloc.2 <null> ldsfld System.Func`1<System.Byte[]> Hfozrmwjoyp.Ucabvwdioy/<>c::<>9__0_0 dup <null> brtrue.s IL_0031: newobj System.Void Hfozrmwjoyp.Bexfvgdanvd::.ctor(System.Func`1<System.Byte[]>) pop <null> ldsfld Hfozrmwjoyp.Ucabvwdioy/<>c Hfozrmwjoyp.Ucabvwdioy/<>c::<>9 ldftn System.Byte[] Hfozrmwjoyp.Ucabvwdioy/<>c::<Main>b__0_0() newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`1<System.Byte[]> Hfozrmwjoyp.Ucabvwdioy/<>c::<>9__0_0 newobj System.Void Hfozrmwjoyp.Bexfvgdanvd::.ctor(System.Func`1<System.Byte[]>) ldloc.0 <null> ldloc.1 <null> ldloc.2 <null> newobj System.Void Hfozrmwjoyp.Nilusbygr::.ctor(System.String,System.String) stfld Hfozrmwjoyp.Nilusbygr Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::decryptor ldloc.0 <null> newobj System.Void Hfozrmwjoyp.Zyehsepg::.ctor() stfld Hfozrmwjoyp.Zyehsepg Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::loader ldloc.0 <null> ldstr p4elkxo9MdaB2ZKWCD.wIkV3NttGYQhkUNOl5 ldstr BLSPP0OgL newobj System.Void Hfozrmwjoyp.Nlajncfpeqm::.ctor(System.String,System.String) stfld Hfozrmwjoyp.Nlajncfpeqm Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::invoker dup <null> ldloc.0 <null> ldftn System.Void Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::<Main>b__1(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Hfozrmwjoyp.Bexfvgdanvd::add_DownloadCompleted(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld Hfozrmwjoyp.Nilusbygr Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::decryptor ldloc.0 <null> ldftn System.Void Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::<Main>b__2(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) callvirt System.Void Hfozrmwjoyp.Nilusbygr::add_DecryptionCompleted(System.Action`1<System.IO.MemoryStream>) ldloc.0 <null> ldfld Hfozrmwjoyp.Zyehsepg Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::loader ldloc.0 <null> ldftn System.Void Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::<Main>b__3(System.Reflection.Assembly) newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr) callvirt System.Void Hfozrmwjoyp.Zyehsepg::add_LoadCompleted(System.Action`1<System.Reflection.Assembly>) ldloc.0 <null> ldfld Hfozrmwjoyp.Nlajncfpeqm Hfozrmwjoyp.Ucabvwdioy/<>c__DisplayClass0_0::invoker ldsfld System.Action Hfozrmwjoyp.Ucabvwdioy/<>c::<>9__0_4 dup <null> brtrue.s IL_00C8: callvirt System.Void Hfozrmwjoyp.Nlajncfpeqm::add_InvocationCompleted(System.Action) pop <null> ldsfld Hfozrmwjoyp.Ucabvwdioy/<>c Hfozrmwjoyp.Ucabvwdioy/<>c::<>9 ldftn System.Void Hfozrmwjoyp.Ucabvwdioy/<>c::<Main>b__0_4() newobj System.Void System.Action::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action Hfozrmwjoyp.Ucabvwdioy/<>c::<>9__0_4 callvirt System.Void Hfozrmwjoyp.Nlajncfpeqm::add_InvocationCompleted(System.Action) callvirt System.Void Hfozrmwjoyp.Bexfvgdanvd::Abmyfz() ret <null>
b994cfeb9a6617ddc3a1383d3d1493c3 (984.06 KB)
File Structure
b994cfeb9a6617ddc3a1383d3d1493c3
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Hfozrmwjoyp.Properties.Resources.resources
Mvhqyt
ILRepack.List
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙