Suspicious
Suspect

0b2a20629f103349d431fb0d0211fd94

PE Executable
MD5: 0b2a20629f103349d431fb0d0211fd94
Size: 809.98 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 0b2a20629f103349d431fb0d0211fd94
Sha1 d0e7f833c683bc3b508ee254ea4b47581c1d8fa6
Sha256 f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132
Sha384 892a23a90f4bada89e1a17ee316949799e55913674b936208924d0d31e47a03b7699e2559edfb1ec1d140d46a46e7565
Sha512 d63590ad4fb6e7e16bf757fe11185095043afcf425e930baa44ca828f5331540ce2cd281286c84a764e13a585f58aa0e360445d875ec96cffd3de5b7839d2b47
SSDeep 12288:cpoIY///1UFomjrv8CmTwU1G01cHi2y3+TWp2GZEOjEjmzebqHD1SCk:jIY/JerkC8QwcC2m+ynWOjEjsc
TLSH 280523CA5D5B908BFC428BF784E368343B819A970E95094A585EECDD3C23DD399087ED
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0b2a20629f103349d431fb0d0211fd94
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
zqsj.Resources
crsvv.exe
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
csrsvvw.exe
Full Name
csrsvvw.exe
EntryPoint
System.Void Program::Main()
Scope Name
csrsvvw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
csrsvvw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
18
Main Method
System.Void Program::Main()
Main IL Instruction Count
40
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brtrue.s IL_007A: ldnull
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0078: br.s IL_0081
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0022: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: br.s IL_0081
br.s IL_0081: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
Module Name
csrsvvw.exe
Full Name
csrsvvw.exe
EntryPoint
System.Void Program::Main()
Scope Name
csrsvvw.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
csrsvvw
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
18
Main Method
System.Void Program::Main()
Main IL Instruction Count
40
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brtrue.s IL_007A: ldnull
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0078: br.s IL_0081
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0022: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: br.s IL_0081
br.s IL_0081: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
0b2a20629f103349d431fb0d0211fd94
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
zqsj.Resources
crsvv.exe
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙