Suspicious
Suspect

f55d7ad75c595e4c01279e5ec04c65ae

PE Executable
|
MD5: f55d7ad75c595e4c01279e5ec04c65ae
|
Size: 687.1 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
f55d7ad75c595e4c01279e5ec04c65ae
Sha1
609bd45f269ed9f460acc3a7b98849f0d24cd9df
Sha256
cf355d1f1a7066a2082089a149779b564e67a55620fc4ce3b332258522bf72fc
Sha384
9147da67b43285eaf8b42aa1ae816e398dd2685963a3ca9f99ebe56666ab9d4c24101ccb395e178a09034477a53d19d6
Sha512
0bbc6863d93545a1fec9fb11d63762a618d81ac4d9ba5e4a4259490c921b450e28418cb4d95b10a9522732db68fb2446da929d3d090111fce8f5996a7f8288e4
SSDeep
12288:Hr+1IMH6uRTF/sqb4+7GyhZ1ISX0Bf/hAMwn70HaF5QGqgSBRQV:LcnTF/fb39Z1JXJ0C51qguRU
TLSH
72E4CF0113E85A68F4BF9B79A974151547F1F802E73ADF5EBE8850EE0C62BC0CA56723

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
f55d7ad75c595e4c01279e5ec04c65ae
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Ezx2p4HiAmf.g.resources
Ezx2p4HiAmf.Resources.resources
bfb65d15c14d59.Resources.resources
432221d90
[NBF]root.Data
432221d91
[NBF]root.Data
432221d92
[NBF]root.Data
432221d93
[NBF]root.Data
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Ezx2p4HiAmf
Full Name

Ezx2p4HiAmf
EntryPoint

System.Void Ezx2p4HiAmf.km6RaKo3w4J/7kdLC1pnsk6Xx.1c_Gk9B::in3TeFa()
Scope Name

Ezx2p4HiAmf
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ezx2p4HiAmf
Assembly Version

27.15.43.129
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

1089
Main Method

System.Void Ezx2p4HiAmf.km6RaKo3w4J/7kdLC1pnsk6Xx.1c_Gk9B::in3TeFa()
Main IL Instruction Count

39
Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.0 <null> ldloc.0 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) stloc.3 <null> ldloc.3 <null> brfalse.s IL_0027: ldc.i4.s 100 ldstr 1.6.4.9 stloc.0 <null> ldc.i4.s 100 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr AppConfig.dat call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> newobj System.Void Ezx2p4HiAmf.Tek9x4Dx7Kfi::.ctor() stloc.2 <null> ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> leave.s IL_0067: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0067: nop nop <null> ret <null>
Module Name

Ezx2p4HiAmf
Full Name

Ezx2p4HiAmf
EntryPoint

System.Void Ezx2p4HiAmf.km6RaKo3w4J/7kdLC1pnsk6Xx.1c_Gk9B::in3TeFa()
Scope Name

Ezx2p4HiAmf
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Ezx2p4HiAmf
Assembly Version

27.15.43.129
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.6
Total Strings

1089
Main Method

System.Void Ezx2p4HiAmf.km6RaKo3w4J/7kdLC1pnsk6Xx.1c_Gk9B::in3TeFa()
Main IL Instruction Count

39
Main IL

nop <null> nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.0 <null> ldloc.0 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) stloc.3 <null> ldloc.3 <null> brfalse.s IL_0027: ldc.i4.s 100 ldstr 1.6.4.9 stloc.0 <null> ldc.i4.s 100 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr AppConfig.dat call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> newobj System.Void Ezx2p4HiAmf.Tek9x4Dx7Kfi::.ctor() stloc.2 <null> ldloc.2 <null> call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) nop <null> leave.s IL_0067: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 nop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0067: nop nop <null> ret <null>
f55d7ad75c595e4c01279e5ec04c65ae (687.1 KB)
File Structure
f55d7ad75c595e4c01279e5ec04c65ae
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Ezx2p4HiAmf.g.resources
Ezx2p4HiAmf.Resources.resources
bfb65d15c14d59.Resources.resources
432221d90
[NBF]root.Data
432221d91
[NBF]root.Data
432221d92
[NBF]root.Data
432221d93
[NBF]root.Data
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙