0df8a0970f0589cc8292fdc1693e1e1b

PE Executable
|
MD5: 0df8a0970f0589cc8292fdc1693e1e1b
|
Size: 75.78 KB
|
application/x-dosexec

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	0df8a0970f0589cc8292fdc1693e1e1b
Sha1	7926f0e4e5c64e46b90e2a8b8e0f62ecb9bcb7b4
Sha256	e4ea373bf70b008d51db2d707171a01a40c45e7e01d2ed61eef21199fd30c8dd
Sha384	0e20ccc6299d0aeb44be79133c4abedd7c38a4caf1f20925ce86e0edfb7b374de8c70dafae820d98e909c0e710590d05
Sha512	0cc02edac7b480ff5a86f86209dd7819e55cbeeeb72c5df0999db36da9c2394997d9c65b7175f4c81096c845c5189079120c58313f348d219a6f85f42a1c6127
SSDeep	1536:zUzkcx4VHsC0SPMV9mD7a3IS41bF/wsgQzc6LVclN:zUwcx4GfSPMVx741bFIRQrBY
TLSH	DE734A013BD88D25F2AE4BB9ACF252074EF4D5576112DE5E3CC840CD6A67BC58A037EA

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	tutaa.exe
Full Name	tutaa.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	tutaa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tutaa
Assembly Version	6.0.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	252
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	94
Main IL	ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr MyData call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld Params.KeylogParams Client.Keylogger::Params callvirt System.Void Params.KeylogParams::LoadFromFile() ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.0 <null> br IL_0050: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0042: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_006D: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0086: leave IL_0091 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0091: call System.Void Client.Helper.A::B() pop <null> leave IL_0091: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_00A6: leave IL_00B1 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_00B1: nop pop <null> leave IL_00B1: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C6: leave IL_00D1 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00D1: nop pop <null> leave IL_00D1: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00F0: leave IL_00FB call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.ProcessCritical::Set() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0110: leave IL_011B call System.Void Client.Install.NormalStartup::Install() leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_012F: leave IL_013A call System.Void Client.Helper.Methods::ClearSetting() leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 pop <null> leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 dup <null> brtrue IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.Void Client.Keylogger::Run() call System.Void System.Windows.Forms.Application::Run() ret <null>
Module Name	tutaa.exe
Full Name	tutaa.exe
EntryPoint	System.Void Client.Program::Main()
Scope Name	tutaa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tutaa
Assembly Version	6.0.1.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	252
Main Method	System.Void Client.Program::Main()
Main IL Instruction Count	94
Main IL	ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr MyData call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld Params.KeylogParams Client.Keylogger::Params callvirt System.Void Params.KeylogParams::LoadFromFile() ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.0 <null> br IL_0050: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0042: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_006D: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0086: leave IL_0091 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0091: call System.Void Client.Helper.A::B() pop <null> leave IL_0091: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_00A6: leave IL_00B1 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_00B1: nop pop <null> leave IL_00B1: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C6: leave IL_00D1 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00D1: nop pop <null> leave IL_00D1: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00F0: leave IL_00FB call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.ProcessCritical::Set() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0110: leave IL_011B call System.Void Client.Install.NormalStartup::Install() leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_012F: leave IL_013A call System.Void Client.Helper.Methods::ClearSetting() leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 pop <null> leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 dup <null> brtrue IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.Void Client.Keylogger::Run() call System.Void System.Windows.Forms.Application::Run() ret <null>

0df8a0970f0589cc8292fdc1693e1e1b (75.78 KB)

File Structure

Characteristics

No malware configuration were found at this point.

You must be signed in to post a comment.

0df8a0970f0589cc8292fdc1693e1e1b

PE Executable | MD5: 0df8a0970f0589cc8292fdc1693e1e1b | Size: 75.78 KB | application/x-dosexec

PE Executable
|
MD5: 0df8a0970f0589cc8292fdc1693e1e1b
|
Size: 75.78 KB
|
application/x-dosexec