Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

The file 289d29a9fedf2868c4e3575e7c3a16d7 is a PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 12 embedded or derived files. It matches 11 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
Inconclusive
File type
PE Executable

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Detection
Symbol obfuscation
Very low

13 files
EXE289d29a9fedf2868c4e3575e7c3a16d7
Structure

Name Value
Module Name
DllLoader.exe
Full Name
DllLoader.exe
EntryPoint
System.Void DllLoader.Program::Main()
Scope Name
DllLoader.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DllLoader
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
5
Main Method
System.Void DllLoader.Program::Main()
Main IL Instruction Count
99
Main IL 
nop <null>
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames()
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_002C: ldloc.2
ldloc.1 <null>
ldloc.2 <null>
ldelem.ref <null>
stloc.3 <null>
nop <null>
ldstr Found resource: 
ldloc.3 <null>
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
nop <null>
nop <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_0011: ldloc.1
ldstr DllLoader.ShellcodeLoader.dll
stloc.0 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.0 <null>
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_4
nop <null>
ldloc.s V_4
ldnull <null>
ceq <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0062: newobj System.Void System.IO.MemoryStream::.ctor()
nop <null>
ldstr DLL resource tidak ditemukan!
call System.Void System.Console::WriteLine(System.String)
nop <null>
leave IL_00E2: ret
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_10
nop <null>
ldloc.s V_4
ldloc.s V_10
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
nop <null>
ldloc.s V_10
callvirt System.Byte[] System.IO.MemoryStream::ToArray()
stloc.s V_5
nop <null>
leave.s IL_008D: ldloc.s V_5
ldloc.s V_10
brfalse.s IL_008C: endfinally
ldloc.s V_10
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ldloc.s V_5
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
stloc.s V_6
ldloc.s V_6
ldstr ShellcodeLoader.Program
callvirt System.Type System.Reflection.Assembly::GetType(System.String)
stloc.s V_7
ldloc.s V_7
ldstr Main
ldc.i4.s 56
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Reflection.BindingFlags)
stloc.s V_8
ldloc.s V_8
brtrue.s IL_00BA: ldloc.s V_8
br.s IL_00D2: nop
ldloc.s V_8
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
call System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
nop <null>
leave.s IL_00E2: ret
ldloc.s V_4
brfalse.s IL_00E1: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>

PDB Path PATH
D:\Cryhuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
D:\Cryhuhuhuhuhuhuhuhuhuhuhu
PDB Path PATH
C:\CI_huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙