Malicious
Malicious

13de55a938154017fe1125cd022c87e0

PE Executable
MD5: 13de55a938154017fe1125cd022c87e0
Size: 356.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 13de55a938154017fe1125cd022c87e0
Sha1 de14cd506a04614ecb6415570241418bf2e5f90b
Sha256 308c4dfa19d1c4a47c9fbe46bb174b97e6deb192e78de2db02a7e09734d65279
Sha384 fa587059613f35487fd2f65d7951983efbc9a3b281fe929ea47ffb2d7d786dc3e12eccc9da24ff216655152b1666b43d
Sha512 c410f3a768e2c6528f783965d860a80ac5a4980f2a5018c219d8c229f673b9f865bef0735989c437632fca06da49dbc3149d3f99fc8d6c1d9359c36b4e2b4e56
SSDeep 6144:eN6bPXhLApfp1SEpmWtbHRdoWux91f6kveycii:+mhApz55xkfcii
TLSH 09748D1373A8E53BD1BE173AF43606154BB1D547BA16F38F9A5896B82C133868D903B3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
13de55a938154017fe1125cd022c87e0
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key KkzhPnhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 91.2huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey wihuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::ꁝ伬李㍸㣜ㄕ㯐샟シ绤濫ᵒ珑쿶剮敥댧凃⊪(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 桯ׇ쟫˽뽚ﾠ桩㭌뉆介酀밖韭僑褨访墈爟::ꔀ�抸쟽䘘힪ɳ푲⵸좘ねⲒ᪩췚雳揳껐퓆()
brfalse.s IL_0040: call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::⠭쒾빰⏮⺮﯊㒱뚭㲙콙됡汦뺶�在︍븊삭퐶჉()
call System.Boolean ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::㛠奦僴㒜蔎彌봷鋓霦ꛆ﹇啕ǩ⭣녤砑愂()
brfalse.s IL_0040: call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::⠭쒾빰⏮⺮﯊㒱뚭㲙콙됡汦뺶�在︍븊삭퐶჉()
call System.Boolean 催쭻᪄འ♵쿿婐闷䅏〫쫨蒡ң䫩ffl�ඌ澟돨::get_Exiting()
brtrue.s IL_0040: call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::⠭쒾빰⏮⺮﯊㒱뚭㲙콙됡汦뺶�在︍븊삭퐶჉()
ldsfld 催쭻᪄འ♵쿿婐闷䅏〫쫨蒡ң䫩ffl�ඌ澟돨 ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::ꔫꪵ筂똮F鰴䬕䐕쓙끺놖㺼㥒꠸ḹ㬎癉
callvirt System.Void 催쭻᪄འ♵쿿婐闷䅏〫쫨蒡ң䫩ffl�ඌ澟돨::ꀩ浻笈㣇䢿睳ూ႓뚻졖㿮�㞜쫈ꇦ鿊ᬖꉫ()
call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::⠭쒾빰⏮⺮﯊㒱뚭㲙콙됡汦뺶�在︍븊삭퐶჉()
call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::胊埨뾒꾢ᷲʹ噊뙡ꤳ篵ﱤ嗷⿈排჊㉴쓜䴷뤄()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::ꁝ伬李㍸㣜ㄕ㯐샟シ绤濫ᵒ珑쿶剮敥댧凃⊪(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 桯ׇ쟫˽뽚ﾠ桩㭌뉆介酀밖韭僑褨访墈爟::ꔀ�抸쟽䘘힪ɳ푲⵸좘ねⲒ᪩췚雳揳껐퓆()
brfalse.s IL_0040: call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::⠭쒾빰⏮⺮﯊㒱뚭㲙콙됡汦뺶�在︍븊삭퐶჉()
call System.Boolean ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::㛠奦僴㒜蔎彌봷鋓霦ꛆ﹇啕ǩ⭣녤砑愂()
brfalse.s IL_0040: call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::⠭쒾빰⏮⺮﯊㒱뚭㲙콙됡汦뺶�在︍븊삭퐶჉()
call System.Boolean 催쭻᪄འ♵쿿婐闷䅏〫쫨蒡ң䫩ffl�ඌ澟돨::get_Exiting()
brtrue.s IL_0040: call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::⠭쒾빰⏮⺮﯊㒱뚭㲙콙됡汦뺶�在︍븊삭퐶჉()
ldsfld 催쭻᪄འ♵쿿婐闷䅏〫쫨蒡ң䫩ffl�ඌ澟돨 ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::ꔫꪵ筂똮F鰴䬕䐕쓙끺놖㺼㥒꠸ḹ㬎癉
callvirt System.Void 催쭻᪄འ♵쿿婐闷䅏〫쫨蒡ң䫩ffl�ඌ澟돨::ꀩ浻笈㣇䢿睳ూ႓뚻졖㿮�㞜쫈ꇦ鿊ᬖꉫ()
call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::⠭쒾빰⏮⺮﯊㒱뚭㲙콙됡汦뺶�在︍븊삭퐶჉()
call System.Void ꦫ鄞捩䳤刞㧰⃜堊ಓⰠ喒䏣䄀韎钾▢ﱓ�痓::胊埨뾒꾢ᷲʹ噊뙡ꤳ篵ﱤ嗷⿈排჊㉴쓜䴷뤄()
ret <null>
CnC CNCmalicious
91.2huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
13de55a938154017fe1125cd022c87e0
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key KkzhPnhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 91.2huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_MUhuhuhuhuhuhuhuhuhuhuhu
StartupKey wihuhuhuhu
HideFile 0huhuhuhu
EnableLogger 0huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
CnC CNCmalicious
91.2huhuhuhuhuhuhu
13de55a938154017fe1125cd022c87e0
Port PORTmalicious
1huhuhuhu
13de55a938154017fe1125cd022c87e0
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙