Deep Malware Analysis of d341c9133059f8b44daa6b886b412f2f | md5: d341c9133059f8b44daa6b886b412f2f | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.30

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

PeID

.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	crpted1337.exe
Full Name	crpted1337.exe
EntryPoint	System.Void crpted1337.Matching.TesterMatcher::CalcMatcher()
Scope Name	crpted1337.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	crpted1337
Assembly Version	1.0.6050.16824
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void crpted1337.Matching.TesterMatcher::CalcMatcher()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0024: ret ret <null> newobj System.Void crpted1337.Matching.MatcherTemplate::.ctor() call System.Byte[] crpted1337.Matching.MatcherTemplate::ValidateEfficientMatcher() call System.Byte[] crpted1337.Concurrency.GenericWorker::RunTransformableWorker(System.Object) call System.Void SteamKit2.Tracking.ExpandableTracker::TrackIsolatedTracker(System.Object) ldc.i4 0 ldsfld <Module>{181ff963-26cb-4966-9cb0-cd2869574a70} <Module>{181ff963-26cb-4966-9cb0-cd2869574a70}::m_5bd84276e0a54cef847e8709f99613e2 ldfld System.Int32 <Module>{181ff963-26cb-4966-9cb0-cd2869574a70}::m_240d3bae9b474bf8832318a41aa81f7b brfalse IL_0012: switch(IL_0024,IL_0025) pop <null> ldc.i4 0 br IL_0012: switch(IL_0024,IL_0025)
Module Name	crpted1337.exe
Full Name	crpted1337.exe
EntryPoint	System.Void crpted1337.Matching.TesterMatcher::CalcMatcher()
Scope Name	crpted1337.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	crpted1337
Assembly Version	1.0.6050.16824
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void crpted1337.Matching.TesterMatcher::CalcMatcher()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0024: ret ret <null> newobj System.Void crpted1337.Matching.MatcherTemplate::.ctor() call System.Byte[] crpted1337.Matching.MatcherTemplate::ValidateEfficientMatcher() call System.Byte[] crpted1337.Concurrency.GenericWorker::RunTransformableWorker(System.Object) call System.Void SteamKit2.Tracking.ExpandableTracker::TrackIsolatedTracker(System.Object) ldc.i4 0 ldsfld <Module>{181ff963-26cb-4966-9cb0-cd2869574a70} <Module>{181ff963-26cb-4966-9cb0-cd2869574a70}::m_5bd84276e0a54cef847e8709f99613e2 ldfld System.Int32 <Module>{181ff963-26cb-4966-9cb0-cd2869574a70}::m_240d3bae9b474bf8832318a41aa81f7b brfalse IL_0012: switch(IL_0024,IL_0025) pop <null> ldc.i4 0 br IL_0012: switch(IL_0024,IL_0025)