Suspicious
Suspect

PE Executable
MD5: 07ad174d24a2328effd237fb9b6aaba2
Size: 61.44 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 07ad174d24a2328effd237fb9b6aaba2
Sha1 7edafea14b960ca75ad13d64a1475bc1801636a8
Sha256 1484cfccea4edee8891e62c1825f0de42e6c8e702e3e6af99901cd74bab83925
Sha384 dab00633fd82c8e2635025b802a88aa2e3d135ad32a0e17cbc6654157cd0c5d7e34b84584aa06ad1f4b4c31b2c26d4ee
Sha512 dabf2d1954ba1b2c8b75cda1db6b83d3a37bb660d3335f62a995162dff32c9489e92115f7e40beecdc308ea1d2b388e6b21192d0cdcbf8f6a3ae986e7a85d26b
SSDeep 1536:glwCTNjGk3kRBy3bcMumzNMwONnW+bF6NKVXn6ifPOmjt:+DTNKkUrmzNMwOnW+bF7VXOmh
TLSH 06537C087BE00225D5FF9FB259E27265C739F713A812A79F28C9059A2213AC8CD617F5
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
07ad174d24a2328effd237fb9b6aaba2
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint 
System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
298
Main Method 
System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Main IL Instruction Count
64
Main IL 
ldsfld System.Int32 JzGvM3Iy4MdWkuXn2zppw::D4KbuyGaLzwf8DlMnP5Nbhn20sBVzgtTXXVMi6LSU4fRXZWy6OnkKk79Ov7kIR12LWfm1JXoHl8CLo7ZSNGteqQFZ95xoUDo
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy
leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
brtrue.s IL_00AB: call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU()
call System.Void Stub.Lz7isNvrEoNvhYbOLpXhzZho::K4VOPMsGzSE3lu1DCtqOh2fw()
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::REHFcRFV4QVFtafV3KsFN9LHG3YHfrs9OCqnuoWZQwXF2enMUGNlyYQ871G9hWtIoBBM95LJaQAX8wn8UuPhp3hiModhTqqe()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::7FcuKGlodJbeLzCOZl9iN3FYVxH2jDJr6vPjqUPDM0mAziWl7OpNsCBBhAxx8W60jCK11n9UbIBI43iYKiTvfrs5spyt72sj()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::XGIXakbXmQtDTMVTkk2uBl7EeoT8Wi0YsPWWmvPSn59G0wrIgsB6botBxTTMN7qOq0DUBebAt7NZHzw6NjE4S1ah5c1OmZ1f()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint 
System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
298
Main Method 
System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Main IL Instruction Count
64
Main IL 
ldsfld System.Int32 JzGvM3Iy4MdWkuXn2zppw::D4KbuyGaLzwf8DlMnP5Nbhn20sBVzgtTXXVMi6LSU4fRXZWy6OnkKk79Ov7kIR12LWfm1JXoHl8CLo7ZSNGteqQFZ95xoUDo
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy
leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
brtrue.s IL_00AB: call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU()
call System.Void Stub.Lz7isNvrEoNvhYbOLpXhzZho::K4VOPMsGzSE3lu1DCtqOh2fw()
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::REHFcRFV4QVFtafV3KsFN9LHG3YHfrs9OCqnuoWZQwXF2enMUGNlyYQ871G9hWtIoBBM95LJaQAX8wn8UuPhp3hiModhTqqe()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::7FcuKGlodJbeLzCOZl9iN3FYVxH2jDJr6vPjqUPDM0mAziWl7OpNsCBBhAxx8W60jCK11n9UbIBI43iYKiTvfrs5spyt72sj()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::XGIXakbXmQtDTMVTkk2uBl7EeoT8Wi0YsPWWmvPSn59G0wrIgsB6botBxTTMN7qOq0DUBebAt7NZHzw6NjE4S1ah5c1OmZ1f()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
07ad174d24a2328effd237fb9b6aaba2
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙