Malicious
Malicious

178bcf620d15dc67aefa6f2952d35703

PE Executable
MD5: 178bcf620d15dc67aefa6f2952d35703
Size: 352.77 KB
application/x-dosexec
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
178bcf620d15dc67aefa6f2952d35703
Sha1
fde0b3e263b781966265389f658ffee510e50837
Sha256
a3551ee95176fa92f07ee54a5f66d1f547765fc79e1fb9e98b75dad86b71a10e
Sha384
bc7b88fff454c1c084108fcc2c6f3ad45bf3a428112aacd0d312e7b1010d62d7e53e88112dcc5b174316371beb353a71
Sha512
f5d47511f072d5fc5dd04a9306e041c5318e5f8a20ec338b32c5f88c58e57fd8fdee2fd466cacae4cdc007c3399da11009553d6b47cd89a3c5def2b6ac1186e9
SSDeep
6144:uXm40uOeBRu3QIUywZGbLVjCtndFuZTGHnG5YBpongBxQaTj4sMz18gRSHczx/rE:uXm40uOeBRu3QIUywZGbLVjCtndFuZT0
TLSH
A774181B36568E21D2841233D2EB550187F165477A37E70EBA8123DB29033BBEE4B797

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
178bcf620d15dc67aefa6f2952d35703
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WuQVSPJAEFf9q91U9F.lAA9IfwMA8n6Q1n9rm
ZI4XJoqoTPv7KNu1E8.v1i9LsUeFyxxGMgoVS
fLuo8i0T1ZGaMgyhWv.nCM5rjsJt40DWDP3JB
jxsVjqH9WyRwrSYC4m.4NbuRcyIbU6e3EsH9K
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Cclieueusrx.exe
Full Name

Cclieueusrx.exe
EntryPoint

System.Void aDgQgNpmngujXEGqRf.b2NG9b8rZDTj4jJU61::wrtO4Wxd3()
Scope Name

Cclieueusrx.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Cclieueusrx
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

41
Main Method

System.Void aDgQgNpmngujXEGqRf.b2NG9b8rZDTj4jJU61::wrtO4Wxd3()
Main IL Instruction Count

63
Main IL

ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0009: ldloc V_1 br IL_0031: ret ret <null> call System.Void S0mfY5yW6kQTLsuD7N9.XUQKOKyt9eXoJ3OvPhe::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 0 ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_394441267d824d4baf661a32b38007e6 brfalse IL_000D: switch(IL_0056,IL_0032,IL_0031) pop <null> ldc.i4 3 br IL_000D: switch(IL_0056,IL_0032,IL_0031) nop <null> newobj System.Void lWXxDA2WNEukAifU6O.gudTYruGZyqN5jARF3::.ctor() call System.Byte[] Bqgkoimai.Properties.Voufhjut::get_Ivikdhbt() callvirt System.Void lWXxDA2WNEukAifU6O.gudTYruGZyqN5jARF3::EQQv5lFxd(System.Byte[]) ldc.i4 0 ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d069f6b879ab43a2add8d2dd371a7759 brtrue IL_0097: switch(IL_00B3) pop <null> ldc.i4 1 br IL_0097: switch(IL_00B3) br IL_0093: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_0093: ldloc V_2 br IL_00B3: leave IL_0031 leave IL_0031: ret pop <null> ldc.i4 6 ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_53505539460341aaa6374800775b1824 brfalse IL_00EA: switch(IL_0106) pop <null> ldc.i4 0 br IL_00EA: switch(IL_0106) br IL_00E6: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_00E6: ldloc V_0 br IL_0106: leave IL_0031 leave IL_0031: ret ldc.i4 2 ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_efa1d0aee7a444f1957eac519b59f70d brtrue IL_000D: switch(IL_0056,IL_0032,IL_0031) pop <null> ldc.i4 2 br IL_000D: switch(IL_0056,IL_0032,IL_0031)
Module Name

Cclieueusrx.exe
Full Name

Cclieueusrx.exe
EntryPoint

System.Void aDgQgNpmngujXEGqRf.b2NG9b8rZDTj4jJU61::wrtO4Wxd3()
Scope Name

Cclieueusrx.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Cclieueusrx
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

41
Main Method

System.Void aDgQgNpmngujXEGqRf.b2NG9b8rZDTj4jJU61::wrtO4Wxd3()
Main IL Instruction Count

63
Main IL

ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0009: ldloc V_1 br IL_0031: ret ret <null> call System.Void S0mfY5yW6kQTLsuD7N9.XUQKOKyt9eXoJ3OvPhe::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 0 ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_394441267d824d4baf661a32b38007e6 brfalse IL_000D: switch(IL_0056,IL_0032,IL_0031) pop <null> ldc.i4 3 br IL_000D: switch(IL_0056,IL_0032,IL_0031) nop <null> newobj System.Void lWXxDA2WNEukAifU6O.gudTYruGZyqN5jARF3::.ctor() call System.Byte[] Bqgkoimai.Properties.Voufhjut::get_Ivikdhbt() callvirt System.Void lWXxDA2WNEukAifU6O.gudTYruGZyqN5jARF3::EQQv5lFxd(System.Byte[]) ldc.i4 0 ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d069f6b879ab43a2add8d2dd371a7759 brtrue IL_0097: switch(IL_00B3) pop <null> ldc.i4 1 br IL_0097: switch(IL_00B3) br IL_0093: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_0093: ldloc V_2 br IL_00B3: leave IL_0031 leave IL_0031: ret pop <null> ldc.i4 6 ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_53505539460341aaa6374800775b1824 brfalse IL_00EA: switch(IL_0106) pop <null> ldc.i4 0 br IL_00EA: switch(IL_0106) br IL_00E6: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_00E6: ldloc V_0 br IL_0106: leave IL_0031 leave IL_0031: ret ldc.i4 2 ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_efa1d0aee7a444f1957eac519b59f70d brtrue IL_000D: switch(IL_0056,IL_0032,IL_0031) pop <null> ldc.i4 2 br IL_000D: switch(IL_0056,IL_0032,IL_0031)
178bcf620d15dc67aefa6f2952d35703 (352.77 KB)
File Structure
178bcf620d15dc67aefa6f2952d35703
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
WuQVSPJAEFf9q91U9F.lAA9IfwMA8n6Q1n9rm
ZI4XJoqoTPv7KNu1E8.v1i9LsUeFyxxGMgoVS
fLuo8i0T1ZGaMgyhWv.nCM5rjsJt40DWDP3JB
jxsVjqH9WyRwrSYC4m.4NbuRcyIbU6e3EsH9K
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙