Suspicious
Suspect

dd49835c8887b4274f7077f961007f14

PE Executable
|
MD5: dd49835c8887b4274f7077f961007f14
|
Size: 1.13 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Medium

Hash
Hash Value
MD5
dd49835c8887b4274f7077f961007f14
Sha1
746d1007cfdc8ffabbb2d1514532f7ad9860e7c3
Sha256
bfafcc89f89a7e1c6e8767a61b20f1b0875dc6bf5952f012f9c4aac270e3590c
Sha384
74f7fdd507944622472dccb31acd1de5edf2daaf685398c538b7ab7902f21fd4caaee9467fb48d80d9feeb1ffba46d00
Sha512
5d0b8d8453648ca2716dcbc1f8bbfaad86e40a1fe8d73dd64c15272898635fbdb51859ecb1555d7ce3fd2c9fbb20b2a039cb92be927759a10e182133923dced0
SSDeep
24576:S8fqnC1QZHs8MacMnjg5FP5CL2gd5AoSp+QA4XitBB0y:tqC1gnTxjg5R5CagDAoSp+QAnt/
TLSH
A3351260775EEB13C12A17B40862F174133E2E5EAA52E3164EE9BFEF78B1B140D44687

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Wi2nAp1p.frmArvore.resources
Wi2nAp1p.frmCambioCheckBox.resources
$this.Icon
[NBF]root.IconData
Wi2nAp1p.frmPrincipal.resources
RAM
[NBF]root.Data
menuStrip1.TrayLocation
Wi2nAp1p.Properties.Resources.resources
upvd
[NBF]root.Data
[NBF]root.Data-preview.png
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

PDB Path: C:\Users\Administrator\Desktop\Client\Temp\VGwbBCxExR\src\obj\Debug\APVf.pdb

Module Name

APVf.exe

Full Name

APVf.exe

EntryPoint

System.Void Wi2nAp1p.Program::Main()

Scope Name

APVf.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

APVf

Assembly Version

9.3.8.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.5

Total Strings

417

Main Method

System.Void Wi2nAp1p.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Wi2nAp1p.frmPrincipal::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

Module Name

APVf.exe

Full Name

APVf.exe

EntryPoint

System.Void Wi2nAp1p.Program::Main()

Scope Name

APVf.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

APVf

Assembly Version

9.3.8.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.5

Total Strings

417

Main Method

System.Void Wi2nAp1p.Program::Main()

Main IL Instruction Count

10

Main IL

nop <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() nop <null> ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) nop <null> newobj System.Void Wi2nAp1p.frmPrincipal::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> ret <null>

dd49835c8887b4274f7077f961007f14 (1.13 MB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Wi2nAp1p.frmArvore.resources
Wi2nAp1p.frmCambioCheckBox.resources
$this.Icon
[NBF]root.IconData
Wi2nAp1p.frmPrincipal.resources
RAM
[NBF]root.Data
menuStrip1.TrayLocation
Wi2nAp1p.Properties.Resources.resources
upvd
[NBF]root.Data
[NBF]root.Data-preview.png
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙