Suspicious
Suspect

ea4074142cbc09d33f8a6a065f02cbf4

PE Executable
|
MD5: ea4074142cbc09d33f8a6a065f02cbf4
|
Size: 1.09 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
ea4074142cbc09d33f8a6a065f02cbf4
Sha1
9a0d9ecd99ae139c063b12c5f6ad1dbf5ede0aee
Sha256
1626d048d160be512ed5e4e9755c924980a09d1759216ff3ea2966a0347d0ce7
Sha384
b31f20542979e234d93673fb2c4ba6c705e7f13439deb3f50953594da6a0c93bc55969ce273b857a245fcd37ae9b5f54
Sha512
beb4992b7d47e397b28b506d6ff5513014d16249a972670262e524c81af2dc4ba648b59821a8735d41d1850171a13ada17a790ea01120ce1e0767c308bdb1f1b
SSDeep
24576:EwVOxM9O9z6Ywu2j/7McRqyHiJ99unipdBkMgQex9edMNRJM:NVOc/wcR5HizgB94MzJ
TLSH
173533ED8B4442D8DE36B37F9EF3E88A18A966AE5C63F117B507134A413D315CA09BD0

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
ea4074142cbc09d33f8a6a065f02cbf4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Fontnnu.Properties.Resources.resources
Kopqqha
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

am.exe
Full Name

am.exe
EntryPoint

System.Void am.Matching.CommonMatcher::ValidateCustomMatcher()
Scope Name

am.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

am
Assembly Version

1.0.8173.14647
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

6
Main Method

System.Void am.Matching.CommonMatcher::ValidateCustomMatcher()
Main IL Instruction Count

32
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0059: ldsfld am.Matching.CommonMatcher/<>c am.Matching.CommonMatcher/<>c::_SequentialMatcher ret <null> ldsfld System.Action`1<System.IO.MemoryStream> am.Matching.CommonMatcher/<>c::_MonoMatcher dup <null> brfalse IL_0039: pop br IL_006F: call System.Void am.Matching.CommonMatcher::StoreMatcher(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 0 ldsfld <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18} <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_b530a094e8e24d36b7ffdcf2b979df21 ldfld System.Int32 <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_3a9c0534745e416fa99183f70ec508f9 brtrue IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0059,IL_0029,IL_0028) ldsfld am.Matching.CommonMatcher/<>c am.Matching.CommonMatcher/<>c::_SequentialMatcher ldftn System.Void am.Matching.CommonMatcher/<>c::MatchBasicMatcher(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> am.Matching.CommonMatcher/<>c::_MonoMatcher call System.Void am.Matching.CommonMatcher::StoreMatcher(System.Action`1<System.IO.MemoryStream>) ldc.i4 2 ldsfld <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18} <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_b530a094e8e24d36b7ffdcf2b979df21 ldfld System.Int32 <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_83c1dddff80d4681acc2f332325e9271 brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 2 br IL_0012: switch(IL_0059,IL_0029,IL_0028)
Module Name

am.exe
Full Name

am.exe
EntryPoint

System.Void am.Matching.CommonMatcher::ValidateCustomMatcher()
Scope Name

am.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

am
Assembly Version

1.0.8173.14647
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

6
Main Method

System.Void am.Matching.CommonMatcher::ValidateCustomMatcher()
Main IL Instruction Count

32
Main IL

ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0059: ldsfld am.Matching.CommonMatcher/<>c am.Matching.CommonMatcher/<>c::_SequentialMatcher ret <null> ldsfld System.Action`1<System.IO.MemoryStream> am.Matching.CommonMatcher/<>c::_MonoMatcher dup <null> brfalse IL_0039: pop br IL_006F: call System.Void am.Matching.CommonMatcher::StoreMatcher(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 0 ldsfld <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18} <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_b530a094e8e24d36b7ffdcf2b979df21 ldfld System.Int32 <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_3a9c0534745e416fa99183f70ec508f9 brtrue IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0059,IL_0029,IL_0028) ldsfld am.Matching.CommonMatcher/<>c am.Matching.CommonMatcher/<>c::_SequentialMatcher ldftn System.Void am.Matching.CommonMatcher/<>c::MatchBasicMatcher(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> am.Matching.CommonMatcher/<>c::_MonoMatcher call System.Void am.Matching.CommonMatcher::StoreMatcher(System.Action`1<System.IO.MemoryStream>) ldc.i4 2 ldsfld <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18} <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_b530a094e8e24d36b7ffdcf2b979df21 ldfld System.Int32 <Module>{add4d0a0-42a7-4893-86b6-763a1d9b9d18}::m_83c1dddff80d4681acc2f332325e9271 brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 2 br IL_0012: switch(IL_0059,IL_0029,IL_0028)
ea4074142cbc09d33f8a6a065f02cbf4 (1.09 MB)
File Structure
ea4074142cbc09d33f8a6a065f02cbf4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Fontnnu.Properties.Resources.resources
Kopqqha
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙