Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
0e8965c1aea9b42a3a34cddf0bbc3767
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CSUpdater.frmConsole.resources
$this.Icon
[NBF]root.IconData
CSUpdater.frmDown.resources
pictureBox1.Image
[NBF]root.Data
[NBF]root.Data-preview.png
CSUpdater.Properties.Resources.resources
lnkClear_Image
[NBF]root.Data
[NBF]root.Data-preview.png
lnkClear_NoFocusImage
[NBF]root.Data
[NBF]root.Data-preview.png
CSUpdater.MetroFramework.Fonts.Resources.Open_Sans.ttf
CSUpdater.MetroFramework.Fonts.Resources.Open_Sans_Bold.ttf
CSUpdater.MetroFramework.Fonts.Resources.Open_Sans_Light.ttf
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Work\CSPlatform\V8\CSUpdater\CSUpdater\obj\Debug\CSUpdater.pdb
Module Name
CSUpdater.exe
Full Name
CSUpdater.exe
EntryPoint
System.Void CSUpdater.Program::Main()
Scope Name
CSUpdater.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
CSUpdater
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
True
PublicKey Token
bfc2e0a90d442e8d
Target Framework
.NETFramework,Version=v4.5
Total Strings
922
Main Method
System.Void CSUpdater.Program::Main()
Main IL Instruction Count
117
Main IL 
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
stloc.0 <null>
ldloc.0 <null>
newobj System.Void System.Security.Principal.WindowsPrincipal::.ctor(System.Security.Principal.WindowsIdentity)
stloc.1 <null>
ldloc.1 <null>
ldc.i4 544
callvirt System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0140: nop
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_CurrentCulture()
callvirt System.String System.Globalization.CultureInfo::get_TwoLetterISOLanguageName()
ldstr zh
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
stsfld System.Boolean CSUpdater.Program::IsSystemLanguageChinese
call System.Boolean CSUpdater.Program::runone()
stloc.3 <null>
ldloc.3 <null>
brfalse IL_0108: nop
nop <null>
call System.String System.Windows.Forms.Application::get_StartupPath()
ldstr \http
call System.String System.String::Concat(System.String,System.String)
call System.Boolean System.IO.File::Exists(System.String)
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0075: call System.String System.Windows.Forms.Application::get_StartupPath()
ldc.i4.1 <null>
stsfld System.Boolean CSUpdater.Program::UseHttp
call System.String System.Windows.Forms.Application::get_StartupPath()
ldstr \domain
call System.String System.String::Concat(System.String,System.String)
call System.Boolean System.IO.File::Exists(System.String)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00AD: call System.String System.Windows.Forms.Application::get_StartupPath()
call System.String System.Windows.Forms.Application::get_StartupPath()
ldstr \domain
call System.String System.String::Concat(System.String,System.String)
call System.Text.Encoding System.Text.Encoding::get_UTF8()
call System.String System.IO.File::ReadAllText(System.String,System.Text.Encoding)
stsfld System.String CSUpdater.p0::Domain
call System.String System.Windows.Forms.Application::get_StartupPath()
ldstr \authdomain
call System.String System.String::Concat(System.String,System.String)
call System.Boolean System.IO.File::Exists(System.String)
stloc.s V_6
ldloc.s V_6
brfalse.s IL_00FA: newobj System.Void CSUpdater.frmConsole::.ctor()
nop <null>
call System.String System.Windows.Forms.Application::get_StartupPath()
ldstr \authdomain
call System.String System.String::Concat(System.String,System.String)
call System.Text.Encoding System.Text.Encoding::get_UTF8()
call System.String System.IO.File::ReadAllText(System.String,System.Text.Encoding)
stsfld System.String CSUpdater.Program::fromDomain
ldc.i4.1 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldsfld System.String CSUpdater.Program::fromDomain
stelem.ref <null>
stsfld System.String[] CSUpdater.p0::AuthDomainList
nop <null>
newobj System.Void CSUpdater.frmConsole::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
nop <null>
nop <null>
br.s IL_013D: nop
nop <null>
ldsfld System.Boolean CSUpdater.Program::IsSystemLanguageChinese
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0129: ldstr "Program already running"
ldstr 程序已在运行，请勿重复打开
ldstr CSUpdater
ldc.i4.0 <null>
ldc.i4.s 48
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
br.s IL_013C: nop
ldstr Program already running
ldstr CSUpdater
ldc.i4.0 <null>
ldc.i4.s 48
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
nop <null>
br.s IL_0171: ret
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_8
ldloc.s V_8
call System.String System.Windows.Forms.Application::get_ExecutablePath()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
nop <null>
ldloc.s V_8
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.s V_8
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙