Suspicious
Suspect

07ad174d24a2328effd237fb9b6aaba2

PE Executable
|
MD5: 07ad174d24a2328effd237fb9b6aaba2
|
Size: 61.44 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
07ad174d24a2328effd237fb9b6aaba2
Sha1
7edafea14b960ca75ad13d64a1475bc1801636a8
Sha256
1484cfccea4edee8891e62c1825f0de42e6c8e702e3e6af99901cd74bab83925
Sha384
dab00633fd82c8e2635025b802a88aa2e3d135ad32a0e17cbc6654157cd0c5d7e34b84584aa06ad1f4b4c31b2c26d4ee
Sha512
dabf2d1954ba1b2c8b75cda1db6b83d3a37bb660d3335f62a995162dff32c9489e92115f7e40beecdc308ea1d2b388e6b21192d0cdcbf8f6a3ae986e7a85d26b
SSDeep
1536:glwCTNjGk3kRBy3bcMumzNMwONnW+bF6NKVXn6ifPOmjt:+DTNKkUrmzNMwOnW+bF7VXOmh
TLSH
06537C087BE00225D5FF9FB259E27265C739F713A812A79F28C9059A2213AC8CD617F5

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
07ad174d24a2328effd237fb9b6aaba2
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

XWormClient.exe
Full Name

XWormClient.exe
EntryPoint

System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Scope Name

XWormClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

XWormClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

298
Main Method

System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Main IL Instruction Count

64
Main IL

ldsfld System.Int32 JzGvM3Iy4MdWkuXn2zppw::D4KbuyGaLzwf8DlMnP5Nbhn20sBVzgtTXXVMi6LSU4fRXZWy6OnkKk79Ov7kIR12LWfm1JXoHl8CLo7ZSNGteqQFZ95xoUDo ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9 call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9 ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2 call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2 ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37 call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37 ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy() call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy() brtrue.s IL_00AB: call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU() call System.Void Stub.Lz7isNvrEoNvhYbOLpXhzZho::K4VOPMsGzSE3lu1DCtqOh2fw() ldnull <null> ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::REHFcRFV4QVFtafV3KsFN9LHG3YHfrs9OCqnuoWZQwXF2enMUGNlyYQ871G9hWtIoBBM95LJaQAX8wn8UuPhp3hiModhTqqe() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::7FcuKGlodJbeLzCOZl9iN3FYVxH2jDJr6vPjqUPDM0mAziWl7OpNsCBBhAxx8W60jCK11n9UbIBI43iYKiTvfrs5spyt72sj() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::XGIXakbXmQtDTMVTkk2uBl7EeoT8Wi0YsPWWmvPSn59G0wrIgsB6botBxTTMN7qOq0DUBebAt7NZHzw6NjE4S1ah5c1OmZ1f() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name

XWormClient.exe
Full Name

XWormClient.exe
EntryPoint

System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Scope Name

XWormClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

XWormClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

298
Main Method

System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uq2mXex2QYxEho1PUC3qtuX0uGuQG4dPbkcpwicVgcgZj5N8Uv8ZhFevTOKNLzilxPl0UoTLNXnflrgqiBtlgVfDkJCnQH8b()
Main IL Instruction Count

64
Main IL

ldsfld System.Int32 JzGvM3Iy4MdWkuXn2zppw::D4KbuyGaLzwf8DlMnP5Nbhn20sBVzgtTXXVMi6LSU4fRXZWy6OnkKk79Ov7kIR12LWfm1JXoHl8CLo7ZSNGteqQFZ95xoUDo ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9 call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::wVZBBbipuFlFTNgaIWQvX5K2antQAxIQ1DYpRuZbaPftSKC5oYks9Ys98R5xeFVpbWs4gFlT0TRxrTjqoom45dxWsnTn0mo9 ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2 call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::LTHGEWqo6F111dAfRcvAQspnfY5DhhnWdaat7z29wjS88p4JB1I4v5pNrvf8EEnUpQiRekQ3dUNlUe2FLHUrdnVGbDsiEfY2 ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37 call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::xUliqAb44hdEtwNT2yN8YWpXpy3CrZOYuFbHTyzSNve54WYB5aoZGDlguU8qMFOt36uT4CH0ScES7kmTxQpfG54UikXiSC37 ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::qAshK7SjLK2bj0uWZOMoCLekkGn05x463Sh3ERiHhJAIB4dE9ELLsgl8fniPhPSD8MYutwzG6P8MKDuZ3fAcYdSovf17EJfl ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::RU6zVPur0KpL0oeVGdzU6j1bSqBNe8dJicuch8gDsRrAUDo70G4znCOlISq1bTtizwOl9WohctN46zu5qzvnwq59zHbSzyEN ldsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy call System.Object Stub.JDhaf4jzL6TTVMNqxjayd24O::DKn7ssUOQocr3UIcyZNH5URx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String JzGvM3Iy4MdWkuXn2zppw::NTpJVSnh81WYBbQYMiKftBtpb0aKesSZ2zjiiIvUpQp7iSKtvc6ZSIsHNjniQlsJygjUTCITyXqh75LJKRzvKsJkyDwEOACy leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_009E: call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy() call System.Boolean Stub.Lz7isNvrEoNvhYbOLpXhzZho::xLnKXLCisPMKT5zYNnyNhTNy() brtrue.s IL_00AB: call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::uVF1upmDWIvNs7bE9Ts0wvz8gktEKnxzeJeYRS3iSfgbzG7p3UHFonYgOtPBfVG15ztwhfxXvAubvAkedzZ69MVxuL2nIDsU() call System.Void Stub.Lz7isNvrEoNvhYbOLpXhzZho::K4VOPMsGzSE3lu1DCtqOh2fw() ldnull <null> ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::REHFcRFV4QVFtafV3KsFN9LHG3YHfrs9OCqnuoWZQwXF2enMUGNlyYQ871G9hWtIoBBM95LJaQAX8wn8UuPhp3hiModhTqqe() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::7FcuKGlodJbeLzCOZl9iN3FYVxH2jDJr6vPjqUPDM0mAziWl7OpNsCBBhAxx8W60jCK11n9UbIBI43iYKiTvfrs5spyt72sj() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.ghmd1Y9ikr5nVELzLGJ6ZQxyRuVnFoRs3yFGL1IoQcSy10BEbx1OtncJbWTDm5k1SLWmHldUGPojMPBPGu0vaoAxRmk3U84b::XGIXakbXmQtDTMVTkk2uBl7EeoT8Wi0YsPWWmvPSn59G0wrIgsB6botBxTTMN7qOq0DUBebAt7NZHzw6NjE4S1ah5c1OmZ1f() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldloc.0 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
07ad174d24a2328effd237fb9b6aaba2 (61.44 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙