Suspicious
Suspect

07d27cbd74e4a700352bc6ab1d85fba6

PE Executable
MD5: 07d27cbd74e4a700352bc6ab1d85fba6
Size: 190.98 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 07d27cbd74e4a700352bc6ab1d85fba6
Sha1 32c6f1ca6fdf80f6be15d5deb2a7469b0d79efe3
Sha256 ad3cbfc4ea2ad9e5879d240418fa4537eeb9b10df0addbfa6211570f9f7709f6
Sha384 9c323c38f0abb32401cbc27fd70bc9dc9d6e04c5c7f6fd4eda6b337bf5ebe3b14bed365e96976641a3838c9fd02a84bc
Sha512 ea73bc57ca21c863c9d4edd0f6b17b5747d0dfdeed57d31a7f5af43e558356544924b0de8c008cb67baeaa4662367332bd071de6a829748386a95be2081afe02
SSDeep 1536:7y7Rqtpqa0b0bPP1hiaopQWlFq4DIAa9kS7SzS09c8c:7y70tg/b0bFhixQWnXw9kS7SzS0Nc
TLSH F114AD106299E1DBFE64B2756F60D67D1E2D6D28A51287CE22C73FDFFD352C60921220
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
07d27cbd74e4a700352bc6ab1d85fba6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
总实市火业母饭决振裁兵跑编超理夜威矛.Resources
Mistys Servers.bat
aaa.exe
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
mistys servers by ssqq2.exe
Full Name
mistys servers by ssqq2.exe
EntryPoint
System.Void TransactionHandler::Main()
Scope Name
mistys servers by ssqq2.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
mistys servers by ssqq2
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
22
Main Method
System.Void TransactionHandler::Main()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean TransactionHandler::CreateMutex()
brtrue.s IL_0017: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> TransactionHandler::List
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0134: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String TransactionHandler::workpath
call System.Object TransactionHandler::GETP(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CF: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00CD: br.s IL_0127
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] TransactionHandler::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0127: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] TransactionHandler::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0127: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_0031: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01FC: ldloc.s V_4
ldloc.s V_4
br.s IL_015A: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01F1: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01F1: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01BC: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0205: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Module Name
mistys servers by ssqq2.exe
Full Name
mistys servers by ssqq2.exe
EntryPoint
System.Void TransactionHandler::Main()
Scope Name
mistys servers by ssqq2.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
mistys servers by ssqq2
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
22
Main Method
System.Void TransactionHandler::Main()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean TransactionHandler::CreateMutex()
brtrue.s IL_0017: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> TransactionHandler::List
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0134: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String TransactionHandler::workpath
call System.Object TransactionHandler::GETP(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CF: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00CD: br.s IL_0127
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] TransactionHandler::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0127: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] TransactionHandler::GetTheResource(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String TransactionHandler::sp
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0127: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_0031: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01FC: ldloc.s V_4
ldloc.s V_4
br.s IL_015A: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01F1: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01F1: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01BC: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0205: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
07d27cbd74e4a700352bc6ab1d85fba6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
总实市火业母饭决振裁兵跑编超理夜威矛.Resources
Mistys Servers.bat
aaa.exe
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙