Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

The file 07ad174d24a2328effd237fb9b6aaba2 is a PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 2 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
Inconclusive
File type
PE Executable

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

3 files
EXE07ad174d24a2328effd237fb9b6aaba2
Structure

Name Value
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint 
System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
298
Main Method 
System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Main IL Instruction Count
64
Main IL 
ldsfld System.Int32 JzGvM3Iy4MdWkuXn2zppw::D4KbuyGaLzwf8DlMnP5Nbhn20sBVzgtTXXVMi6LSU4fRXZWy6OnkKk79Ov7kIR12LWfm1JXoHl8CLo7ZSNGteqQFZ95xoUDo
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy
leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
brtrue.s IL_00AB: call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU()
call System.Void Stub.Lz7isNvrEoNvhYbOLpXhzZho::K4VOPMsGzSE3lu1DCtqOh2fw()
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::REHFcRFV4QVFtafV3KsFN9LHG3YHfrs9OCqnuoWZQwXF2enMUGNlyYQ871G9hWtIoBBM95LJaQAX8wn8UuPhp3hiModhTqqe()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::7FcuKGlodJbeLzCOZl9iN3FYVxH2jDJr6vPjqUPDM0mAziWl7OpNsCBBhAxx8W60jCK11n9UbIBI43iYKiTvfrs5spyt72sj()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::XGIXakbXmQtDTMVTkk2uBl7EeoT8Wi0YsPWWmvPSn59G0wrIgsB6botBxTTMN7qOq0DUBebAt7NZHzw6NjE4S1ah5c1OmZ1f()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint 
System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
298
Main Method 
System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Main IL Instruction Count
64
Main IL 
ldsfld System.Int32 JzGvM3Iy4MdWkuXn2zppw::D4KbuyGaLzwf8DlMnP5Nbhn20sBVzgtTXXVMi6LSU4fRXZWy6OnkKk79Ov7kIR12LWfm1JXoHl8CLo7ZSNGteqQFZ95xoUDo
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN
ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy
call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy
leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy()
brtrue.s IL_00AB: call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU()
call System.Void Stub.Lz7isNvrEoNvhYbOLpXhzZho::K4VOPMsGzSE3lu1DCtqOh2fw()
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::REHFcRFV4QVFtafV3KsFN9LHG3YHfrs9OCqnuoWZQwXF2enMUGNlyYQ871G9hWtIoBBM95LJaQAX8wn8UuPhp3hiModhTqqe()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::7FcuKGlodJbeLzCOZl9iN3FYVxH2jDJr6vPjqUPDM0mAziWl7OpNsCBBhAxx8W60jCK11n9UbIBI43iYKiTvfrs5spyt72sj()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::XGIXakbXmQtDTMVTkk2uBl7EeoT8Wi0YsPWWmvPSn59G0wrIgsB6botBxTTMN7qOq0DUBebAt7NZHzw6NjE4S1ah5c1OmZ1f()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙