Suspicious
Suspect

f4e5a26167ca9b8515eef078e25c15f0

PE Executable
|
MD5: f4e5a26167ca9b8515eef078e25c15f0
|
Size: 1.78 MB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

High

Hash
Hash Value
MD5
f4e5a26167ca9b8515eef078e25c15f0
Sha1
43c7c034b4a9d3b03751e17d0bb66cb111dda69f
Sha256
a8d911dd10c0abac0de077868ab455f1869f63cda456ecab048a1572c8d35e7f
Sha384
284c4e2fa8a67936a7d9cc498a40c07cf796695de4979d0f1fd00811bd01fbc1facb75a2745237fa05a2b58eeaf71c0f
Sha512
4b2030101418dad0b776977339e46dbd1411e5a64f361e14a054a142572090ff8a23dce3de0d15fdb3a8267b110c6a94dcd229b8b7e5e3be7b11f5010e005a2c
SSDeep
24576:KQdSyahkku1ljz3/NN+VqI5R2oZ06rLt3IIup3urNeX7jf/7uAV0:/ahBsZzNNGqIx/FIpkNiHO
TLSH
9085AE460ABCAE16C17E27BA44F165C813E55428DECBDB136684BDE21FDD3611E3A20F
File Structure
[Authenticode]_49667449.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.@#J
.'7]
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
A32A8E8B.resources
Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Info

Authenticode present at 0x1AF600 size 12032 bytes

Module Name

images.exe

Full Name

images.exe

EntryPoint

System.Void FC15CF05::1593E81A()

Scope Name

images.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

images

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.8

Total Strings

254

Main Method

System.Void FC15CF05::1593E81A()

Main IL Instruction Count

72

Main IL

br.s IL_004B: ldc.i4.0 brfalse.s IL_000B: call System.Void FC15CF05::750F1B11() call System.Void FC15CF05::0F1DE037() br.s IL_0010: br IL_006F call System.Void FC15CF05::750F1B11() br IL_006F: ldc.i4.0 ldc.i4.1 <null> callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() br.s IL_0042: ldc.i4.0 ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() ret <null> ldc.i4.0 <null> brfalse.s IL_002A: br.s IL_0039 ldc.i4.5 <null> pop <null> br.s IL_0039: ldc.i4.1 br.s IL_001D: ldloca.s V_0 ldc.i4.1 <null> brtrue.s IL_0033: br.s IL_0065 ldc.i4.1 <null> pop <null> br.s IL_0065: ldc.i4.1 ldind.r8 <null> ldc.i4.5 <null> br.s IL_002C: br.s IL_001D ldc.i4.1 <null> brtrue.s IL_003E: br.s IL_002E ldc.i4.8 <null> pop <null> br.s IL_002E: ldc.i4.1 br.s IL_002C: br.s IL_001D ldc.i4.0 <null> brfalse.s IL_0047: br.s IL_0025 ldc.i4.0 <null> pop <null> br.s IL_0025: ldc.i4.0 br.s IL_001D: ldloca.s V_0 ldc.i4.0 <null> brfalse.s IL_0050: br.s IL_0059 ldc.i4.4 <null> pop <null> br.s IL_0059: ldc.i4.1 ldarg.3 <null> stloc.3 <null> br IL_0002: brfalse.s IL_000B ldc.i4.1 <null> brtrue.s IL_005E: call System.Boolean FC15CF05::080626AD() ldc.i4.1 <null> pop <null> call System.Boolean FC15CF05::080626AD() br.s IL_0054: br IL_0002 ldc.i4.1 <null> brtrue.s IL_006A: stloc.0 ldc.i4.6 <null> pop <null> stloc.0 <null> br.s IL_007E: ldc.i4.0 ldc.i4.8 <null> stind.i8 <null> ldc.i4.0 <null> brfalse.s IL_0074: call System.Threading.Tasks.Task FC15CF05::EA25ACAA() ldc.i4.4 <null> pop <null> call System.Threading.Tasks.Task FC15CF05::EA25ACAA() br IL_0016: callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() ldc.i4.0 <null> brfalse.s IL_0083: br.s IL_0037 ldc.i4.m1 <null> pop <null> br.s IL_0037: br.s IL_002C br.s IL_006F: ldc.i4.0

f4e5a26167ca9b8515eef078e25c15f0 (1.78 MB)
File Structure
[Authenticode]_49667449.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.@#J
.'7]
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
A32A8E8B.resources
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙