Deep Malware Analysis of f4d39526066eea25288d9b2ea8d3515f | md5: f4d39526066eea25288d9b2ea8d3515f | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 64 Exe | x64 | .Net | SOS: 0.34

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

PeID

.NET SmartAssemby Obfuscator 6.0 (chars) sign ASLMicrosoft Visual C++ DLLMicrosoft Visual C++ v6.0

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	testpowershell.exe
Full Name	testpowershell.exe
EntryPoint	System.Void testpowershell.sha::Main()
Scope Name	testpowershell.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	testpowershell
Assembly Version	5.0.4.12
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	8
Main Method	System.Void testpowershell.sha::Main()
Main IL Instruction Count	39
Main IL	ldc.i4.0 <null> brtrue.s IL_0025: nop nop <null> ldsfld :: ldc.i4.7 <null> br.s IL_0035: call System.String ::Invoke(System.Environment/SpecialFolder) ldc.i4.7 <null> brtrue.s IL_003C: stloc.0 pop <null> ldsfld ::Ž ldc.i4.0 <null> br.s IL_003F: call System.Void ::Invoke(System.Boolean) ldc.i4.0 <null> brtrue.s IL_0034: ret nop <null> ldsfld :: br.s IL_0046: newobj System.Void testpowershell.Form1::.ctor() br.s IL_004D: call System.Void ::Invoke(System.Windows.Forms.Form) nop <null> ldc.i4.0 <null> brtrue.s IL_0025: nop ldc.i4.0 <null> brtrue.s IL_0025: nop ldsfld :: br.s IL_0054: call System.Void ::Invoke() nop <null> ret <null> call System.String ::Invoke(System.Environment/SpecialFolder) br.s IL_000C: ldc.i4.7 stloc.0 <null> br.s IL_0010: ldsfld ::Ž call System.Void ::Invoke(System.Boolean) br.s IL_0018: ldc.i4.0 newobj System.Void testpowershell.Form1::.ctor() br.s IL_0023: br.s IL_004D call System.Void ::Invoke(System.Windows.Forms.Form) br.s IL_0025: nop call System.Void ::Invoke() br.s IL_0033: nop