Suspicious
Suspect

d05b37a6730355553a0e1945f61ed48a

PE Executable
MD5: d05b37a6730355553a0e1945f61ed48a
Size: 58.88 KB
application/x-dosexec

This sample is a 57.5 KB PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 1 embedded or derived file. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
1dc810f8145f9836d8eb78c0f5cbe99d2e44cfdf7a294bd7d4e5c0b30b62b18d
MD5
d05b37a6730355553a0e1945f61ed48a
Verdict
Inconclusive
File type
PE Executable · 57.5 KB

Cite this report: https://app.malva.re/sha256/1dc810f8145f9836d8eb78c0f5cbe99d2e44cfdf7a294bd7d4e5c0b30b62b18d

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
58.88 KB · 58,880 B
First seen
2026-10-21 05:45 · 10 days ago
Last seen
2026-10-21 05:45 · 10 days ago
Last analysis
2026-10-21 05:45 · 10 days ago
Hashes
MD5 d05b37a6730355553a0e1945f61ed48a Sha1 2f5087729ebccec76294d36066d0d83b7cbd6d83 Sha256 1dc810f8145f9836d8eb78c0f5cbe99d2e44cfdf7a294bd7d4e5c0b30b62b18d Sha384 2247677cf2386a9b0a1d98804f158678bd3bce50d30037fb433629c84eb2fe567a7f103616859b10497588d2cb227d86 Sha512 6f58c18465e7dd95f06b83232abbfc52148eeb96defa7c99016bef1141b56bca5e6af78b6894598ce76e3d05e4d45056f79f4c1eec9e805012d167beb13a5ecc SSDeep 1536:3xqjvtmwUEzaR18mAymSW/9KnDz2OZK6x0Qm7jU2D:GwAM8R9KnDz2O7wjU2D TLSH A3430810A3798A65D0DCD6B8A0F9170243F3A00E36BAF7A74E9D51DE2F5778252133DA
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

2 files
EXEd05b37a6730355553a0e1945f61ed48a
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name Value
Module Name
gp2.exe
Full Name
gp2.exe
EntryPoint
System.Void GodPotato.Program::Main(System.String[])
Scope Name
gp2.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gp2
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
88
Main Method
System.Void GodPotato.Program::Main(System.String[])
Main IL Instruction Count
136
Main IL 
call System.IO.TextWriter System.Console::get_Out()
stloc.0 <null>
ldtoken GodPotato.Program/GodPotatoArgs
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldstr                                                                                                
    FFFFF                   FFF  FFFFFFF                                                       
   FFFFFFF                  FFF  FFFFFFFF                                                      
  FFF  FFFF                 FFF  FFF   FFF             FFF                  FFF                
  FFF   FFF                 FFF  FFF   FFF             FFF                  FFF                
  FFF   FFF                 FFF  FFF   FFF             FFF                  FFF                
 FFFF        FFFFFFF   FFFFFFFF  FFF   FFF  FFFFFFF  FFFFFFFFF   FFFFFF  FFFFFFFFF    FFFFFF   
 FFFF       FFFF FFFF  FFF FFFF  FFF  FFFF FFFF FFFF   FFF      FFF  FFF    FFF      FFF FFFF  
 FFFF FFFFF FFF   FFF FFF   FFF  FFFFFFFF  FFF   FFF   FFF      F    FFF    FFF     FFF   FFF  
 FFFF   FFF FFF   FFFFFFF   FFF  FFF      FFFF   FFF   FFF         FFFFF    FFF     FFF   FFFF 
 FFFF   FFF FFF   FFFFFFF   FFF  FFF      FFFF   FFF   FFF      FFFFFFFF    FFF     FFF   FFFF 
  FFF   FFF FFF   FFF FFF   FFF  FFF       FFF   FFF   FFF     FFFF  FFF    FFF     FFF   FFFF 
  FFFF FFFF FFFF  FFF FFFF  FFF  FFF       FFF  FFFF   FFF     FFFF  FFF    FFF     FFFF  FFF  
   FFFFFFFF  FFFFFFF   FFFFFFFF  FFF        FFFFFFF     FFFFFF  FFFFFFFF    FFFFFFF  FFFFFFF   
    FFFFFFF   FFFFF     FFFFFFF  FFF         FFFFF       FFFFF   FFFFFFFF     FFFF     FFFF    

ldstr GodPotato
ldc.i4.0 <null>
newarr System.String
call System.String GodPotato.ArgsParse::PrintHelp(System.Type,System.String,System.String,System.String[])
stloc.2 <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
brtrue IL_0036: ldarg.0
ldloc.0 <null>
ldloc.2 <null>
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ret <null>
ldarg.0 <null>
call GodPotato.Program/GodPotatoArgs GodPotato.ArgsParse::ParseArgs<GodPotato.Program/GodPotatoArgs>(System.String[])
stloc.1 <null>
leave IL_0077: ldloc.0
stloc.3 <null>
ldloc.3 <null>
callvirt System.Exception System.Exception::get_InnerException()
brfalse IL_0055: ldloc.0
ldloc.3 <null>
callvirt System.Exception System.Exception::get_InnerException()
stloc.3 <null>
ldloc.0 <null>
ldstr Exception:
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.0 <null>
ldloc.2 <null>
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
leave IL_01D1: ret
ldloc.0 <null>
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
constrained. System.Guid
callvirt System.String System.Object::ToString()
newobj System.Void GodPotato.NativeAPI.GodPotatoContext::.ctor(System.IO.TextWriter,System.String)
stloc.s V_4
ldloc.0 <null>
ldstr [*] CombaseModule: 0x{0:x}
ldloc.s V_4
callvirt System.IntPtr GodPotato.NativeAPI.GodPotatoContext::get_CombaseModule()
box System.IntPtr
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
ldloc.0 <null>
ldstr [*] DispatchTable: 0x{0:x}
ldloc.s V_4
callvirt System.IntPtr GodPotato.NativeAPI.GodPotatoContext::get_DispatchTablePtr()
box System.IntPtr
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
ldloc.0 <null>
ldstr [*] UseProtseqFunction: 0x{0:x}
ldloc.s V_4
callvirt System.IntPtr GodPotato.NativeAPI.GodPotatoContext::get_UseProtseqFunctionPtr()
box System.IntPtr
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
ldloc.0 <null>
ldstr [*] UseProtseqFunctionParamCount: {0}
ldloc.s V_4
callvirt System.UInt32 GodPotato.NativeAPI.GodPotatoContext::get_UseProtseqFunctionParamCount()
box System.UInt32
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
ldloc.0 <null>
ldstr [*] HookRPC
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_4
callvirt System.Void GodPotato.NativeAPI.GodPotatoContext::HookRPC()
ldloc.0 <null>
ldstr [*] Start PipeServer
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_4
callvirt System.Void GodPotato.NativeAPI.GodPotatoContext::Start()
ldloc.s V_4
newobj System.Void GodPotato.NativeAPI.GodPotatoUnmarshalTrigger::.ctor(GodPotato.NativeAPI.GodPotatoContext)
stloc.s V_6
ldloc.0 <null>
ldstr [*] Trigger RPCSS
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_6
callvirt System.Int32 GodPotato.NativeAPI.GodPotatoUnmarshalTrigger::Trigger()
stloc.s V_7
ldloc.0 <null>
ldstr [*] UnmarshalObject: 0x{0:x}
ldloc.s V_7
box System.Int32
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
leave IL_0156: ldloc.s V_4
stloc.s V_8
ldloc.0 <null>
ldloc.s V_8
callvirt System.Void System.IO.TextWriter::WriteLine(System.Object)
leave IL_0156: ldloc.s V_4
ldloc.s V_4
callvirt System.Security.Principal.WindowsIdentity GodPotato.NativeAPI.GodPotatoContext::GetToken()
stloc.s V_9
ldloc.s V_9
brfalse IL_0195: ldloc.0
ldloc.0 <null>
ldstr [*] CurrentUser: 
ldloc.s V_9
callvirt System.String System.Security.Claims.ClaimsIdentity::get_Name()
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.0 <null>
ldloc.s V_9
callvirt System.IntPtr System.Security.Principal.WindowsIdentity::get_Token()
ldloc.1 <null>
callvirt System.String GodPotato.Program/GodPotatoArgs::get_cmd()
call System.Void SharpToken.TokenuUils::createProcessReadOut(System.IO.TextWriter,System.IntPtr,System.String)
br IL_01A0: ldloc.s V_4
ldloc.0 <null>
ldstr [!] Failed to impersonate security context token
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_4
callvirt System.Void GodPotato.NativeAPI.GodPotatoContext::Restore()
ldloc.s V_4
callvirt System.Void GodPotato.NativeAPI.GodPotatoContext::Stop()
leave IL_01D1: ret
stloc.s V_10
ldloc.0 <null>
ldstr [!] 
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
leave IL_01D1: ret
ret <null>
Module Name
gp2.exe
Full Name
gp2.exe
EntryPoint
System.Void GodPotato.Program::Main(System.String[])
Scope Name
gp2.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
gp2
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
88
Main Method
System.Void GodPotato.Program::Main(System.String[])
Main IL Instruction Count
136
Main IL 
call System.IO.TextWriter System.Console::get_Out()
stloc.0 <null>
ldtoken GodPotato.Program/GodPotatoArgs
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldstr                                                                                                
    FFFFF                   FFF  FFFFFFF                                                       
   FFFFFFF                  FFF  FFFFFFFF                                                      
  FFF  FFFF                 FFF  FFF   FFF             FFF                  FFF                
  FFF   FFF                 FFF  FFF   FFF             FFF                  FFF                
  FFF   FFF                 FFF  FFF   FFF             FFF                  FFF                
 FFFF        FFFFFFF   FFFFFFFF  FFF   FFF  FFFFFFF  FFFFFFFFF   FFFFFF  FFFFFFFFF    FFFFFF   
 FFFF       FFFF FFFF  FFF FFFF  FFF  FFFF FFFF FFFF   FFF      FFF  FFF    FFF      FFF FFFF  
 FFFF FFFFF FFF   FFF FFF   FFF  FFFFFFFF  FFF   FFF   FFF      F    FFF    FFF     FFF   FFF  
 FFFF   FFF FFF   FFFFFFF   FFF  FFF      FFFF   FFF   FFF         FFFFF    FFF     FFF   FFFF 
 FFFF   FFF FFF   FFFFFFF   FFF  FFF      FFFF   FFF   FFF      FFFFFFFF    FFF     FFF   FFFF 
  FFF   FFF FFF   FFF FFF   FFF  FFF       FFF   FFF   FFF     FFFF  FFF    FFF     FFF   FFFF 
  FFFF FFFF FFFF  FFF FFFF  FFF  FFF       FFF  FFFF   FFF     FFFF  FFF    FFF     FFFF  FFF  
   FFFFFFFF  FFFFFFF   FFFFFFFF  FFF        FFFFFFF     FFFFFF  FFFFFFFF    FFFFFFF  FFFFFFF   
    FFFFFFF   FFFFF     FFFFFFF  FFF         FFFFF       FFFFF   FFFFFFFF     FFFF     FFFF    

ldstr GodPotato
ldc.i4.0 <null>
newarr System.String
call System.String GodPotato.ArgsParse::PrintHelp(System.Type,System.String,System.String,System.String[])
stloc.2 <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
brtrue IL_0036: ldarg.0
ldloc.0 <null>
ldloc.2 <null>
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ret <null>
ldarg.0 <null>
call GodPotato.Program/GodPotatoArgs GodPotato.ArgsParse::ParseArgs<GodPotato.Program/GodPotatoArgs>(System.String[])
stloc.1 <null>
leave IL_0077: ldloc.0
stloc.3 <null>
ldloc.3 <null>
callvirt System.Exception System.Exception::get_InnerException()
brfalse IL_0055: ldloc.0
ldloc.3 <null>
callvirt System.Exception System.Exception::get_InnerException()
stloc.3 <null>
ldloc.0 <null>
ldstr Exception:
ldloc.3 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.0 <null>
ldloc.2 <null>
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
leave IL_01D1: ret
ldloc.0 <null>
call System.Guid System.Guid::NewGuid()
stloc.s V_5
ldloca.s V_5
constrained. System.Guid
callvirt System.String System.Object::ToString()
newobj System.Void GodPotato.NativeAPI.GodPotatoContext::.ctor(System.IO.TextWriter,System.String)
stloc.s V_4
ldloc.0 <null>
ldstr [*] CombaseModule: 0x{0:x}
ldloc.s V_4
callvirt System.IntPtr GodPotato.NativeAPI.GodPotatoContext::get_CombaseModule()
box System.IntPtr
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
ldloc.0 <null>
ldstr [*] DispatchTable: 0x{0:x}
ldloc.s V_4
callvirt System.IntPtr GodPotato.NativeAPI.GodPotatoContext::get_DispatchTablePtr()
box System.IntPtr
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
ldloc.0 <null>
ldstr [*] UseProtseqFunction: 0x{0:x}
ldloc.s V_4
callvirt System.IntPtr GodPotato.NativeAPI.GodPotatoContext::get_UseProtseqFunctionPtr()
box System.IntPtr
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
ldloc.0 <null>
ldstr [*] UseProtseqFunctionParamCount: {0}
ldloc.s V_4
callvirt System.UInt32 GodPotato.NativeAPI.GodPotatoContext::get_UseProtseqFunctionParamCount()
box System.UInt32
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
ldloc.0 <null>
ldstr [*] HookRPC
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_4
callvirt System.Void GodPotato.NativeAPI.GodPotatoContext::HookRPC()
ldloc.0 <null>
ldstr [*] Start PipeServer
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_4
callvirt System.Void GodPotato.NativeAPI.GodPotatoContext::Start()
ldloc.s V_4
newobj System.Void GodPotato.NativeAPI.GodPotatoUnmarshalTrigger::.ctor(GodPotato.NativeAPI.GodPotatoContext)
stloc.s V_6
ldloc.0 <null>
ldstr [*] Trigger RPCSS
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_6
callvirt System.Int32 GodPotato.NativeAPI.GodPotatoUnmarshalTrigger::Trigger()
stloc.s V_7
ldloc.0 <null>
ldstr [*] UnmarshalObject: 0x{0:x}
ldloc.s V_7
box System.Int32
callvirt System.Void System.IO.TextWriter::WriteLine(System.String,System.Object)
leave IL_0156: ldloc.s V_4
stloc.s V_8
ldloc.0 <null>
ldloc.s V_8
callvirt System.Void System.IO.TextWriter::WriteLine(System.Object)
leave IL_0156: ldloc.s V_4
ldloc.s V_4
callvirt System.Security.Principal.WindowsIdentity GodPotato.NativeAPI.GodPotatoContext::GetToken()
stloc.s V_9
ldloc.s V_9
brfalse IL_0195: ldloc.0
ldloc.0 <null>
ldstr [*] CurrentUser: 
ldloc.s V_9
callvirt System.String System.Security.Claims.ClaimsIdentity::get_Name()
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.0 <null>
ldloc.s V_9
callvirt System.IntPtr System.Security.Principal.WindowsIdentity::get_Token()
ldloc.1 <null>
callvirt System.String GodPotato.Program/GodPotatoArgs::get_cmd()
call System.Void SharpToken.TokenuUils::createProcessReadOut(System.IO.TextWriter,System.IntPtr,System.String)
br IL_01A0: ldloc.s V_4
ldloc.0 <null>
ldstr [!] Failed to impersonate security context token
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
ldloc.s V_4
callvirt System.Void GodPotato.NativeAPI.GodPotatoContext::Restore()
ldloc.s V_4
callvirt System.Void GodPotato.NativeAPI.GodPotatoContext::Stop()
leave IL_01D1: ret
stloc.s V_10
ldloc.0 <null>
ldstr [!] 
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.IO.TextWriter::WriteLine(System.String)
leave IL_01D1: ret
ret <null>

2 files
EXEd05b37a6730355553a0e1945f61ed48a
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙