Suspicious
Suspect

01622415491ac641000c09628e27122a

PE Executable
MD5: 01622415491ac641000c09628e27122a
Size: 1.43 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.43 MB · 1,433,600 B
Hashes
MD5 01622415491ac641000c09628e27122a Sha1 d5826185ce784b59f750a97fba9dea360e7b9664 Sha256 ad32cad9cfc8c820e5c91d750796ed93f573f2335fc2dd87692e28dfc28626e5 Sha384 74064b71b701c7a9f77f12b851896b57e042885d4fe8cc551457b97f3073907d064e35ac0ce055ccbd8b6e711699e1e6 Sha512 a2afec0cce5eba0e6b9987448184bdf45f17c07c477dacae2b570c8a5bf0d4add842726dc07626fb04cb0de5487093fa8554c5b5e9493f8e011ae487ee74c02d SSDeep 24576:NElvO51fjCeRx/7TRNaNyHtNy3cJFzDERUMAq7sX1Mi81Fn:aUDb7RxzTfxHtNyeFXEmMsXbO TLSH A5653309FA5C4F5CE37FC1F67EB7AA85C666FDA15934015A04C8521B2DB0B8608BB3B4
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
20 files
EXE01622415491ac641000c09628e27122a
Structure
BIN.Net Resources
BINPayloadManifest
EXEInstallHelper
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
ZIPInstallPayload
JSONcatalog.json
TXTLEEME.txt
BINnative
BINx86
DLLsqlite3.dll
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:1033
BINRT_GROUP_CURSOR4
BINID:0065
BINID:1033
BINRT_VERSION
BINID:0001
BINID:1033
EXEReservasAmigos.exe
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BINReservasAmigos.exe.config
JSONSHA256.json
JSONSQLITE-PROVENANCE.json
BINBuildInfo
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

6 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 6
Name Value
Module Name
ReservasAmigos-1.4.0-Windows-x86.exe
Full Name
ReservasAmigos-1.4.0-Windows-x86.exe
EntryPoint
System.Int32 InstallerBootstrap::Main(System.String[])
Scope Name
ReservasAmigos-1.4.0-Windows-x86.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ReservasAmigos-1.4.0-Windows-x86
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
54
Main Method
System.Int32 InstallerBootstrap::Main(System.String[])
Main IL Instruction Count
229
Main IL 
ldarg.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
br.s IL_0050: ldloc.s V_10
ldloc.s V_9
ldloc.s V_10
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr /S
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0022: ldloc.0
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::silent
ldloc.0 <null>
ldstr /TESTMODE
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0036: ldloc.0
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::test
ldloc.0 <null>
ldstr /NOLAUNCH
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_004A: ldloc.s V_10
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::noLaunch
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_10
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt.s IL_0008: ldloc.s V_9
ldsfld System.Boolean InstallerBootstrap::test
brfalse.s IL_0065: ldc.i4 -2147483646
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::noLaunch
ldc.i4 -2147483646
ldc.i4 512
call Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenBaseKey(Microsoft.Win32.RegistryHive,Microsoft.Win32.RegistryView)
stloc.1 <null>
ldloc.1 <null>
ldstr SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_00A1: ldstr "Se requiere .NET Framework 4.8 previamente instalado."
ldloc.2 <null>
ldstr Release
ldc.i4.0 <null>
box System.Int32
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String,System.Object)
call System.Int32 System.Convert::ToInt32(System.Object)
ldc.i4 528040
bge.s IL_00B4: leave.s IL_00C0
ldstr Se requiere .NET Framework 4.8 previamente instalado.
call System.Void InstallerBootstrap::ShowError(System.String)
ldc.i4.s 10
stloc.s V_8
leave IL_0296: ldloc.s V_8
leave.s IL_00C0: leave.s IL_00CC
ldloc.2 <null>
brfalse.s IL_00BF: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_00CC: ldstr "BuildInfo"
ldloc.1 <null>
brfalse.s IL_00CB: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr BuildInfo
call System.IO.Stream InstallerBootstrap::Resource(System.String)
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.3 <null>
ldloc.3 <null>
callvirt System.String System.IO.TextReader::ReadLine()
stsfld System.String InstallerBootstrap::version
ldloc.3 <null>
callvirt System.String System.IO.TextReader::ReadLine()
stsfld System.String InstallerBootstrap::arch
leave.s IL_0103: ldc.i4.s 28
ldloc.3 <null>
brfalse.s IL_0102: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr Programs
ldstr ReservasAmigosLocal-
ldsfld System.String InstallerBootstrap::arch
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_4
ldloc.s V_4
stsfld System.String InstallerBootstrap::root
call System.String System.Environment::get_CommandLine()
ldstr  /D=
ldc.i4.5 <null>
callvirt System.Int32 System.String::LastIndexOf(System.String,System.StringComparison)
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
blt.s IL_0175: ldsfld System.String InstallerBootstrap::root
call System.String System.Environment::get_CommandLine()
ldloc.s V_5
ldc.i4.4 <null>
add <null>
callvirt System.String System.String::Substring(System.Int32)
callvirt System.String System.String::Trim()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_11
callvirt System.String System.String::Trim(System.Char[])
stsfld System.String InstallerBootstrap::root
ldsfld System.String InstallerBootstrap::root
call System.String System.IO.Path::GetFullPath(System.String)
ldc.i4.1 <null>
newarr System.Char
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
stelem.i2 <null>
ldloc.s V_12
callvirt System.String System.String::TrimEnd(System.Char[])
stsfld System.String InstallerBootstrap::root
ldsfld System.Boolean InstallerBootstrap::test
brfalse.s IL_01F0: ldsfld System.String InstallerBootstrap::root
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
box System.Char
ldstr .local-work
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
box System.Char
call System.String System.String::Concat(System.Object,System.Object,System.Object)
stloc.s V_6
ldsfld System.String InstallerBootstrap::root
ldloc.s V_6
ldc.i4.5 <null>
callvirt System.Int32 System.String::IndexOf(System.String,System.StringComparison)
ldc.i4.0 <null>
blt.s IL_01E5: ldstr "/TESTMODE requiere /D en una subcarpeta local de .local-work."
ldsfld System.String InstallerBootstrap::root
ldstr \\
ldc.i4.4 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_020A: ldsfld System.Boolean InstallerBootstrap::silent
ldstr /TESTMODE requiere /D en una subcarpeta local de .local-work.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
ldsfld System.String InstallerBootstrap::root
ldloc.s V_4
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue.s IL_020A: ldsfld System.Boolean InstallerBootstrap::silent
ldstr La instalación normal usa la carpeta por usuario predeterminada.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
ldsfld System.Boolean InstallerBootstrap::silent
brtrue.s IL_0279: call System.Int32 InstallerBootstrap::Install()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.6 <null>
newarr System.String
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldstr Instalar Reservas Amigos Local 
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldsfld System.String InstallerBootstrap::version
stelem.ref <null>
ldloc.s V_13
ldc.i4.2 <null>
ldstr  (
stelem.ref <null>
ldloc.s V_13
ldc.i4.3 <null>
ldsfld System.String InstallerBootstrap::arch
stelem.ref <null>
ldloc.s V_13
ldc.i4.4 <null>
ldstr ) en este usuario.

Conserva los datos y las versiones anteriores.


stelem.ref <null>
ldloc.s V_13
ldc.i4.5 <null>
ldsfld System.String InstallerBootstrap::root
stelem.ref <null>
ldloc.s V_13
call System.String System.String::Concat(System.String[])
ldstr Reservas Amigos Local
ldc.i4.1 <null>
ldc.i4.s 64
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
ldc.i4.1 <null>
beq.s IL_0270: call System.Int32 InstallerBootstrap::RunWithProgress()
ldc.i4.2 <null>
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
call System.Int32 InstallerBootstrap::RunWithProgress()
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
call System.Int32 InstallerBootstrap::Install()
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
stloc.s V_7
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.Void InstallerBootstrap::ShowError(System.String)
ldc.i4.s 30
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
ldloc.s V_8
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
ReservasAmigos-1.4.0-Windows-x86.exe
Full Name
ReservasAmigos-1.4.0-Windows-x86.exe
EntryPoint
System.Int32 InstallerBootstrap::Main(System.String[])
Scope Name
ReservasAmigos-1.4.0-Windows-x86.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ReservasAmigos-1.4.0-Windows-x86
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
54
Main Method
System.Int32 InstallerBootstrap::Main(System.String[])
Main IL Instruction Count
229
Main IL 
ldarg.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
br.s IL_0050: ldloc.s V_10
ldloc.s V_9
ldloc.s V_10
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr /S
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0022: ldloc.0
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::silent
ldloc.0 <null>
ldstr /TESTMODE
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0036: ldloc.0
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::test
ldloc.0 <null>
ldstr /NOLAUNCH
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_004A: ldloc.s V_10
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::noLaunch
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_10
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt.s IL_0008: ldloc.s V_9
ldsfld System.Boolean InstallerBootstrap::test
brfalse.s IL_0065: ldc.i4 -2147483646
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::noLaunch
ldc.i4 -2147483646
ldc.i4 512
call Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenBaseKey(Microsoft.Win32.RegistryHive,Microsoft.Win32.RegistryView)
stloc.1 <null>
ldloc.1 <null>
ldstr SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_00A1: ldstr "Se requiere .NET Framework 4.8 previamente instalado."
ldloc.2 <null>
ldstr Release
ldc.i4.0 <null>
box System.Int32
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String,System.Object)
call System.Int32 System.Convert::ToInt32(System.Object)
ldc.i4 528040
bge.s IL_00B4: leave.s IL_00C0
ldstr Se requiere .NET Framework 4.8 previamente instalado.
call System.Void InstallerBootstrap::ShowError(System.String)
ldc.i4.s 10
stloc.s V_8
leave IL_0296: ldloc.s V_8
leave.s IL_00C0: leave.s IL_00CC
ldloc.2 <null>
brfalse.s IL_00BF: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_00CC: ldstr "BuildInfo"
ldloc.1 <null>
brfalse.s IL_00CB: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr BuildInfo
call System.IO.Stream InstallerBootstrap::Resource(System.String)
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.3 <null>
ldloc.3 <null>
callvirt System.String System.IO.TextReader::ReadLine()
stsfld System.String InstallerBootstrap::version
ldloc.3 <null>
callvirt System.String System.IO.TextReader::ReadLine()
stsfld System.String InstallerBootstrap::arch
leave.s IL_0103: ldc.i4.s 28
ldloc.3 <null>
brfalse.s IL_0102: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr Programs
ldstr ReservasAmigosLocal-
ldsfld System.String InstallerBootstrap::arch
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_4
ldloc.s V_4
stsfld System.String InstallerBootstrap::root
call System.String System.Environment::get_CommandLine()
ldstr  /D=
ldc.i4.5 <null>
callvirt System.Int32 System.String::LastIndexOf(System.String,System.StringComparison)
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
blt.s IL_0175: ldsfld System.String InstallerBootstrap::root
call System.String System.Environment::get_CommandLine()
ldloc.s V_5
ldc.i4.4 <null>
add <null>
callvirt System.String System.String::Substring(System.Int32)
callvirt System.String System.String::Trim()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_11
callvirt System.String System.String::Trim(System.Char[])
stsfld System.String InstallerBootstrap::root
ldsfld System.String InstallerBootstrap::root
call System.String System.IO.Path::GetFullPath(System.String)
ldc.i4.1 <null>
newarr System.Char
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
stelem.i2 <null>
ldloc.s V_12
callvirt System.String System.String::TrimEnd(System.Char[])
stsfld System.String InstallerBootstrap::root
ldsfld System.Boolean InstallerBootstrap::test
brfalse.s IL_01F0: ldsfld System.String InstallerBootstrap::root
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
box System.Char
ldstr .local-work
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
box System.Char
call System.String System.String::Concat(System.Object,System.Object,System.Object)
stloc.s V_6
ldsfld System.String InstallerBootstrap::root
ldloc.s V_6
ldc.i4.5 <null>
callvirt System.Int32 System.String::IndexOf(System.String,System.StringComparison)
ldc.i4.0 <null>
blt.s IL_01E5: ldstr "/TESTMODE requiere /D en una subcarpeta local de .local-work."
ldsfld System.String InstallerBootstrap::root
ldstr \\
ldc.i4.4 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_020A: ldsfld System.Boolean InstallerBootstrap::silent
ldstr /TESTMODE requiere /D en una subcarpeta local de .local-work.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
ldsfld System.String InstallerBootstrap::root
ldloc.s V_4
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue.s IL_020A: ldsfld System.Boolean InstallerBootstrap::silent
ldstr La instalación normal usa la carpeta por usuario predeterminada.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
ldsfld System.Boolean InstallerBootstrap::silent
brtrue.s IL_0279: call System.Int32 InstallerBootstrap::Install()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.6 <null>
newarr System.String
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldstr Instalar Reservas Amigos Local 
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldsfld System.String InstallerBootstrap::version
stelem.ref <null>
ldloc.s V_13
ldc.i4.2 <null>
ldstr  (
stelem.ref <null>
ldloc.s V_13
ldc.i4.3 <null>
ldsfld System.String InstallerBootstrap::arch
stelem.ref <null>
ldloc.s V_13
ldc.i4.4 <null>
ldstr ) en este usuario.

Conserva los datos y las versiones anteriores.


stelem.ref <null>
ldloc.s V_13
ldc.i4.5 <null>
ldsfld System.String InstallerBootstrap::root
stelem.ref <null>
ldloc.s V_13
call System.String System.String::Concat(System.String[])
ldstr Reservas Amigos Local
ldc.i4.1 <null>
ldc.i4.s 64
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
ldc.i4.1 <null>
beq.s IL_0270: call System.Int32 InstallerBootstrap::RunWithProgress()
ldc.i4.2 <null>
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
call System.Int32 InstallerBootstrap::RunWithProgress()
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
call System.Int32 InstallerBootstrap::Install()
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
stloc.s V_7
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.Void InstallerBootstrap::ShowError(System.String)
ldc.i4.s 30
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
ldloc.s V_8
ret <null>
20 files
EXE01622415491ac641000c09628e27122a
Structure
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙