Suspicious
Suspect

dff11248cb2fef62978f0f6909625a63

PE Executable
|
MD5: dff11248cb2fef62978f0f6909625a63
|
Size: 10.38 MB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
Hash Value
MD5
dff11248cb2fef62978f0f6909625a63
Sha1
8ae351b9b9e2ad8d9b68c1bc70892db5aefdac21
Sha256
392d7cb3aef7c58452ef07b02dd8f63e680c913f5ce4d94553adf86241b389e7
Sha384
904fe02d181de8e35c7410e30ad910f640177e5426eb965d81543ff6554ab3411191641b601e8db000973e1ce0d7a07b
Sha512
b94e18c05da2c0b89466f8dd8b8b87379242b586d8ef1dffba0652ab1abc9f02535fd8a144d296e51ad124f0cdb2f04e59c5151017244602721ac17796b962ba
SSDeep
196608:z6n0oLeJkck3trXZiJuYJijwt8vYx5UwD3M+5/dwJOWpZHZ0EKH7Se:zCeJBuYBJzy055A4/CHyEKH
TLSH
DCA63355F4E5AF09ECEF50F026D395E96058E7849913AB0453DA0DA128B2327CDBB0BF

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ v6.0 DLL
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ffi.Resources
Aorus launcher.exe
explorer.exe
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

XBinderOutput.exe

Full Name

XBinderOutput.exe

EntryPoint

System.Void Program::Main()

Scope Name

XBinderOutput.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

XBinderOutput

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

11

Main Method

System.Void Program::Main()

Main IL Instruction Count

39

Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007C: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_007A: br.s IL_0083 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007A: br.s IL_0083 br.s IL_0083: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>

Module Name

XBinderOutput.exe

Full Name

XBinderOutput.exe

EntryPoint

System.Void Program::Main()

Scope Name

XBinderOutput.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

XBinderOutput

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

11

Main Method

System.Void Program::Main()

Main IL Instruction Count

39

Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::AdminCheck() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::AdminCheck() brtrue.s IL_007C: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.0 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.0 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_007A: br.s IL_0083 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.1 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_007A: br.s IL_0083 br.s IL_0083: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>

dff11248cb2fef62978f0f6909625a63 (10.38 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙