Suspicious
Suspect

e4a85471e36e19f0165b320c731c667a

PE Executable
|
MD5: e4a85471e36e19f0165b320c731c667a
|
Size: 1.85 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
 Hash Value
MD5
e4a85471e36e19f0165b320c731c667a
Sha1
49fa1788e9c2294fa9c0d00c7fb38a3bb2e307ac
Sha256
0065d42e62b532221d6ec96913cdedd45d3e84b1d50076b478a5d0a22608b536
Sha384
dcd85d933ec66c38dd5a8aaeacb5b8cd2027132e8864fffe195b2980c5f5577f057c6c495a717cc1a5bfc65db2312ece
Sha512
bb28f77dbbcda528d0de93c84e99f29cd4c87f267ca743a2e60f405cde6a0b500f98c174d436cf69794fd13713fba741659d8d911661b6195b08feba73db7b61
SSDeep
49152:Zh3k2DTy+tpHxaFQ12R+mYLPZ5SdT31msHvTv2im1yt:DbDvtpwW1MlYLR5SdT8sHv7kk
TLSH
6785335FB821865DDFB76CFBBC734BA7B7210ECBD05DE068B49AA6E41041096BB5C204

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
e4a85471e36e19f0165b320c731c667a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
a
Informations
Name
 Value
Module Name

temploader.exe
Full Name

temploader.exe
EntryPoint

System.Void a.a::Main()
Scope Name

temploader.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

temploader
Assembly Version

0.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

3
Main Method

System.Void a.a::Main()
Main IL Instruction Count

37
Main IL

call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldstr GpEexsYAitWnABataWBcQg== ldstr 2YSF4FNHVcik/TSW/uG3H6ikXlexojhdz8FK0SNHrnE= ldstr drw7xo4K4UgNge72SGfmZA== call System.String 埙�穁␆뢙悽癎ꌼ၈::虀㩫鑤툺ʔ쟸達ꄜ(System.String,System.String,System.String) callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.0 <null> newobj System.Void System.IO.MemoryStream::.ctor() stloc.1 <null> ldloc.0 <null> ldc.i4.0 <null> newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) leave IL_0046: ldloc.1 ldloc.2 <null> brfalse IL_0045: endfinally ldloc.2 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.1 <null> callvirt System.Byte[] System.IO.MemoryStream::ToArray() call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave IL_0070: ret ldloc.0 <null> brfalse IL_006F: endfinally ldloc.0 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
Module Name

temploader.exe
Full Name

temploader.exe
EntryPoint

System.Void a.a::Main()
Scope Name

temploader.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

temploader
Assembly Version

0.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

3
Main Method

System.Void a.a::Main()
Main IL Instruction Count

37
Main IL

call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldstr GpEexsYAitWnABataWBcQg== ldstr 2YSF4FNHVcik/TSW/uG3H6ikXlexojhdz8FK0SNHrnE= ldstr drw7xo4K4UgNge72SGfmZA== call System.String 埙�穁␆뢙悽癎ꌼ၈::虀㩫鑤툺ʔ쟸達ꄜ(System.String,System.String,System.String) callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.0 <null> newobj System.Void System.IO.MemoryStream::.ctor() stloc.1 <null> ldloc.0 <null> ldc.i4.0 <null> newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) leave IL_0046: ldloc.1 ldloc.2 <null> brfalse IL_0045: endfinally ldloc.2 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.1 <null> callvirt System.Byte[] System.IO.MemoryStream::ToArray() call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave IL_0070: ret ldloc.0 <null> brfalse IL_006F: endfinally ldloc.0 <null> callvirt System.Void System.IDisposable::Dispose() endfinally <null> ret <null>
Artefacts
Name
 Value
Embedded Resources

1
Suspicious Type Names (1-2 chars)

1
e4a85471e36e19f0165b320c731c667a (1.85 MB)
File Structure
e4a85471e36e19f0165b320c731c667a
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
a
Characteristics
No malware configuration were found at this point.
Artefacts
Name
 Value Location
Embedded Resources

1

e4a85471e36e19f0165b320c731c667a
Suspicious Type Names (1-2 chars)

1

e4a85471e36e19f0165b320c731c667a
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙