Suspicious
Suspect

01622415491ac641000c09628e27122a

Share on LinkedIn
Print
PE Executable
MD5: 01622415491ac641000c09628e27122a
Size: 1.43 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.43 MB · 1,433,600 B
First seen
2026-10-02 09:30 · 22 days ago
Last seen
2026-10-02 09:30 · 22 days ago
Last analysis
2026-10-02 09:30 · 22 days ago
Hashes
MD5 01622415491ac641000c09628e27122a Sha1 d5826185ce784b59f750a97fba9dea360e7b9664 Sha256 ad32cad9cfc8c820e5c91d750796ed93f573f2335fc2dd87692e28dfc28626e5 Sha384 74064b71b701c7a9f77f12b851896b57e042885d4fe8cc551457b97f3073907d064e35ac0ce055ccbd8b6e711699e1e6 Sha512 a2afec0cce5eba0e6b9987448184bdf45f17c07c477dacae2b570c8a5bf0d4add842726dc07626fb04cb0de5487093fa8554c5b5e9493f8e011ae487ee74c02d SSDeep 24576:NElvO51fjCeRx/7TRNaNyHtNy3cJFzDERUMAq7sX1Mi81Fn:aUDb7RxzTfxHtNyeFXEmMsXbO TLSH A5653309FA5C4F5CE37FC1F67EB7AA85C666FDA15934015A04C8521B2DB0B8608BB3B4
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
20 files
EXE01622415491ac641000c09628e27122a
Structure
STICH beta

No STICH Path has been generated for this analysis yet.

6 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 6
Name Value
Module Name
ReservasAmigos-1.4.0-Windows-x86.exe
Full Name
ReservasAmigos-1.4.0-Windows-x86.exe
EntryPoint
System.Int32 InstallerBootstrap::Main(System.String[])
Scope Name
ReservasAmigos-1.4.0-Windows-x86.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ReservasAmigos-1.4.0-Windows-x86
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
54
Main Method
System.Int32 InstallerBootstrap::Main(System.String[])
Main IL Instruction Count
229
Main IL 
ldarg.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
br.s IL_0050: ldloc.s V_10
ldloc.s V_9
ldloc.s V_10
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr /S
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0022: ldloc.0
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::silent
ldloc.0 <null>
ldstr /TESTMODE
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0036: ldloc.0
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::test
ldloc.0 <null>
ldstr /NOLAUNCH
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_004A: ldloc.s V_10
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::noLaunch
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_10
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt.s IL_0008: ldloc.s V_9
ldsfld System.Boolean InstallerBootstrap::test
brfalse.s IL_0065: ldc.i4 -2147483646
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::noLaunch
ldc.i4 -2147483646
ldc.i4 512
call Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenBaseKey(Microsoft.Win32.RegistryHive,Microsoft.Win32.RegistryView)
stloc.1 <null>
ldloc.1 <null>
ldstr SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_00A1: ldstr "Se requiere .NET Framework 4.8 previamente instalado."
ldloc.2 <null>
ldstr Release
ldc.i4.0 <null>
box System.Int32
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String,System.Object)
call System.Int32 System.Convert::ToInt32(System.Object)
ldc.i4 528040
bge.s IL_00B4: leave.s IL_00C0
ldstr Se requiere .NET Framework 4.8 previamente instalado.
call System.Void InstallerBootstrap::ShowError(System.String)
ldc.i4.s 10
stloc.s V_8
leave IL_0296: ldloc.s V_8
leave.s IL_00C0: leave.s IL_00CC
ldloc.2 <null>
brfalse.s IL_00BF: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_00CC: ldstr "BuildInfo"
ldloc.1 <null>
brfalse.s IL_00CB: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr BuildInfo
call System.IO.Stream InstallerBootstrap::Resource(System.String)
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.3 <null>
ldloc.3 <null>
callvirt System.String System.IO.TextReader::ReadLine()
stsfld System.String InstallerBootstrap::version
ldloc.3 <null>
callvirt System.String System.IO.TextReader::ReadLine()
stsfld System.String InstallerBootstrap::arch
leave.s IL_0103: ldc.i4.s 28
ldloc.3 <null>
brfalse.s IL_0102: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr Programs
ldstr ReservasAmigosLocal-
ldsfld System.String InstallerBootstrap::arch
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_4
ldloc.s V_4
stsfld System.String InstallerBootstrap::root
call System.String System.Environment::get_CommandLine()
ldstr  /D=
ldc.i4.5 <null>
callvirt System.Int32 System.String::LastIndexOf(System.String,System.StringComparison)
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
blt.s IL_0175: ldsfld System.String InstallerBootstrap::root
call System.String System.Environment::get_CommandLine()
ldloc.s V_5
ldc.i4.4 <null>
add <null>
callvirt System.String System.String::Substring(System.Int32)
callvirt System.String System.String::Trim()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_11
callvirt System.String System.String::Trim(System.Char[])
stsfld System.String InstallerBootstrap::root
ldsfld System.String InstallerBootstrap::root
call System.String System.IO.Path::GetFullPath(System.String)
ldc.i4.1 <null>
newarr System.Char
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
stelem.i2 <null>
ldloc.s V_12
callvirt System.String System.String::TrimEnd(System.Char[])
stsfld System.String InstallerBootstrap::root
ldsfld System.Boolean InstallerBootstrap::test
brfalse.s IL_01F0: ldsfld System.String InstallerBootstrap::root
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
box System.Char
ldstr .local-work
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
box System.Char
call System.String System.String::Concat(System.Object,System.Object,System.Object)
stloc.s V_6
ldsfld System.String InstallerBootstrap::root
ldloc.s V_6
ldc.i4.5 <null>
callvirt System.Int32 System.String::IndexOf(System.String,System.StringComparison)
ldc.i4.0 <null>
blt.s IL_01E5: ldstr "/TESTMODE requiere /D en una subcarpeta local de .local-work."
ldsfld System.String InstallerBootstrap::root
ldstr \\
ldc.i4.4 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_020A: ldsfld System.Boolean InstallerBootstrap::silent
ldstr /TESTMODE requiere /D en una subcarpeta local de .local-work.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
ldsfld System.String InstallerBootstrap::root
ldloc.s V_4
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue.s IL_020A: ldsfld System.Boolean InstallerBootstrap::silent
ldstr La instalación normal usa la carpeta por usuario predeterminada.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
ldsfld System.Boolean InstallerBootstrap::silent
brtrue.s IL_0279: call System.Int32 InstallerBootstrap::Install()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.6 <null>
newarr System.String
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldstr Instalar Reservas Amigos Local 
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldsfld System.String InstallerBootstrap::version
stelem.ref <null>
ldloc.s V_13
ldc.i4.2 <null>
ldstr  (
stelem.ref <null>
ldloc.s V_13
ldc.i4.3 <null>
ldsfld System.String InstallerBootstrap::arch
stelem.ref <null>
ldloc.s V_13
ldc.i4.4 <null>
ldstr ) en este usuario.

Conserva los datos y las versiones anteriores.


stelem.ref <null>
ldloc.s V_13
ldc.i4.5 <null>
ldsfld System.String InstallerBootstrap::root
stelem.ref <null>
ldloc.s V_13
call System.String System.String::Concat(System.String[])
ldstr Reservas Amigos Local
ldc.i4.1 <null>
ldc.i4.s 64
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
ldc.i4.1 <null>
beq.s IL_0270: call System.Int32 InstallerBootstrap::RunWithProgress()
ldc.i4.2 <null>
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
call System.Int32 InstallerBootstrap::RunWithProgress()
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
call System.Int32 InstallerBootstrap::Install()
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
stloc.s V_7
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.Void InstallerBootstrap::ShowError(System.String)
ldc.i4.s 30
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
ldloc.s V_8
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
ReservasAmigos-1.4.0-Windows-x86.exe
Full Name
ReservasAmigos-1.4.0-Windows-x86.exe
EntryPoint
System.Int32 InstallerBootstrap::Main(System.String[])
Scope Name
ReservasAmigos-1.4.0-Windows-x86.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ReservasAmigos-1.4.0-Windows-x86
Assembly Version
1.4.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
54
Main Method
System.Int32 InstallerBootstrap::Main(System.String[])
Main IL Instruction Count
229
Main IL 
ldarg.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
br.s IL_0050: ldloc.s V_10
ldloc.s V_9
ldloc.s V_10
ldelem.ref <null>
stloc.0 <null>
ldloc.0 <null>
ldstr /S
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0022: ldloc.0
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::silent
ldloc.0 <null>
ldstr /TESTMODE
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_0036: ldloc.0
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::test
ldloc.0 <null>
ldstr /NOLAUNCH
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brfalse.s IL_004A: ldloc.s V_10
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::noLaunch
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_10
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt.s IL_0008: ldloc.s V_9
ldsfld System.Boolean InstallerBootstrap::test
brfalse.s IL_0065: ldc.i4 -2147483646
ldc.i4.1 <null>
stsfld System.Boolean InstallerBootstrap::noLaunch
ldc.i4 -2147483646
ldc.i4 512
call Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenBaseKey(Microsoft.Win32.RegistryHive,Microsoft.Win32.RegistryView)
stloc.1 <null>
ldloc.1 <null>
ldstr SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String)
stloc.2 <null>
ldloc.2 <null>
brfalse.s IL_00A1: ldstr "Se requiere .NET Framework 4.8 previamente instalado."
ldloc.2 <null>
ldstr Release
ldc.i4.0 <null>
box System.Int32
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String,System.Object)
call System.Int32 System.Convert::ToInt32(System.Object)
ldc.i4 528040
bge.s IL_00B4: leave.s IL_00C0
ldstr Se requiere .NET Framework 4.8 previamente instalado.
call System.Void InstallerBootstrap::ShowError(System.String)
ldc.i4.s 10
stloc.s V_8
leave IL_0296: ldloc.s V_8
leave.s IL_00C0: leave.s IL_00CC
ldloc.2 <null>
brfalse.s IL_00BF: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_00CC: ldstr "BuildInfo"
ldloc.1 <null>
brfalse.s IL_00CB: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr BuildInfo
call System.IO.Stream InstallerBootstrap::Resource(System.String)
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.3 <null>
ldloc.3 <null>
callvirt System.String System.IO.TextReader::ReadLine()
stsfld System.String InstallerBootstrap::version
ldloc.3 <null>
callvirt System.String System.IO.TextReader::ReadLine()
stsfld System.String InstallerBootstrap::arch
leave.s IL_0103: ldc.i4.s 28
ldloc.3 <null>
brfalse.s IL_0102: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr Programs
ldstr ReservasAmigosLocal-
ldsfld System.String InstallerBootstrap::arch
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_4
ldloc.s V_4
stsfld System.String InstallerBootstrap::root
call System.String System.Environment::get_CommandLine()
ldstr  /D=
ldc.i4.5 <null>
callvirt System.Int32 System.String::LastIndexOf(System.String,System.StringComparison)
stloc.s V_5
ldloc.s V_5
ldc.i4.0 <null>
blt.s IL_0175: ldsfld System.String InstallerBootstrap::root
call System.String System.Environment::get_CommandLine()
ldloc.s V_5
ldc.i4.4 <null>
add <null>
callvirt System.String System.String::Substring(System.Int32)
callvirt System.String System.String::Trim()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_11
callvirt System.String System.String::Trim(System.Char[])
stsfld System.String InstallerBootstrap::root
ldsfld System.String InstallerBootstrap::root
call System.String System.IO.Path::GetFullPath(System.String)
ldc.i4.1 <null>
newarr System.Char
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
stelem.i2 <null>
ldloc.s V_12
callvirt System.String System.String::TrimEnd(System.Char[])
stsfld System.String InstallerBootstrap::root
ldsfld System.Boolean InstallerBootstrap::test
brfalse.s IL_01F0: ldsfld System.String InstallerBootstrap::root
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
box System.Char
ldstr .local-work
ldsfld System.Char System.IO.Path::DirectorySeparatorChar
box System.Char
call System.String System.String::Concat(System.Object,System.Object,System.Object)
stloc.s V_6
ldsfld System.String InstallerBootstrap::root
ldloc.s V_6
ldc.i4.5 <null>
callvirt System.Int32 System.String::IndexOf(System.String,System.StringComparison)
ldc.i4.0 <null>
blt.s IL_01E5: ldstr "/TESTMODE requiere /D en una subcarpeta local de .local-work."
ldsfld System.String InstallerBootstrap::root
ldstr \\
ldc.i4.4 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_020A: ldsfld System.Boolean InstallerBootstrap::silent
ldstr /TESTMODE requiere /D en una subcarpeta local de .local-work.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
ldsfld System.String InstallerBootstrap::root
ldloc.s V_4
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue.s IL_020A: ldsfld System.Boolean InstallerBootstrap::silent
ldstr La instalación normal usa la carpeta por usuario predeterminada.
newobj System.Void System.InvalidOperationException::.ctor(System.String)
throw <null>
ldsfld System.Boolean InstallerBootstrap::silent
brtrue.s IL_0279: call System.Int32 InstallerBootstrap::Install()
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.6 <null>
newarr System.String
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldstr Instalar Reservas Amigos Local 
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldsfld System.String InstallerBootstrap::version
stelem.ref <null>
ldloc.s V_13
ldc.i4.2 <null>
ldstr  (
stelem.ref <null>
ldloc.s V_13
ldc.i4.3 <null>
ldsfld System.String InstallerBootstrap::arch
stelem.ref <null>
ldloc.s V_13
ldc.i4.4 <null>
ldstr ) en este usuario.

Conserva los datos y las versiones anteriores.


stelem.ref <null>
ldloc.s V_13
ldc.i4.5 <null>
ldsfld System.String InstallerBootstrap::root
stelem.ref <null>
ldloc.s V_13
call System.String System.String::Concat(System.String[])
ldstr Reservas Amigos Local
ldc.i4.1 <null>
ldc.i4.s 64
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
ldc.i4.1 <null>
beq.s IL_0270: call System.Int32 InstallerBootstrap::RunWithProgress()
ldc.i4.2 <null>
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
call System.Int32 InstallerBootstrap::RunWithProgress()
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
call System.Int32 InstallerBootstrap::Install()
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
stloc.s V_7
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.Void InstallerBootstrap::ShowError(System.String)
ldc.i4.s 30
stloc.s V_8
leave.s IL_0296: ldloc.s V_8
ldloc.s V_8
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙