Malicious
Malicious

29c0a123b530411741d4e7fb6062836c

PE Executable
MD5: 29c0a123b530411741d4e7fb6062836c
Size: 453.12 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 29c0a123b530411741d4e7fb6062836c
Sha1 26fbcb63b3d2dc77b9ea686aa9377b8b466f1a25
Sha256 56531b5bd04f6ddecc9a071d3be4d3d671012ce10b1bfc73a6911363c6fee769
Sha384 3f7372d897a1de00f535c7d171b3b2ce9ac4ba7722b59250890909a1bdcc6f6d720b2c4d0c29613c983149caa3f16c48
Sha512 80886619d59d0075491c1af469de200847652f45fdb6bb44bcd7adc5e9a0305bc1e12525061632932ca401297ce688f30440c5beeb6ea0dc8a0ace2858ff1c59
SSDeep 12288:5Sz0ZOBWIEfsy/lC+RUufN8WPx3w73/vPvh:WzBWmIF1ptEP
TLSH E0A423BAE821AE5CEBFA3B7CC3D1DC847B84E1490049D1470EB190A4F994F52D5CBD6A
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
29c0a123b530411741d4e7fb6062836c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
package.zip
Malicious
app
Malicious
index.html
index.html
0x000002AD.svg
0x000002AD.svg-preview.jpg
pay-qr.png
pay-qr.png-preview.png
css
styles.css
js
Malicious
app.js
app.js
0x00006056.svg
0x00006056.svg-preview.jpg
0x0000BCB4.svg
0x0001E1B3.svg
0x0001E1B3.svg-preview.jpg
0x0001E6DE.svg
0x0001E6DE.svg-preview.jpg
0x0001EA9D.svg
0x0001EA9D.svg-preview.jpg
0x0001EE66.svg
0x0001EE66.svg-preview.jpg
cloud.js
engine.js
Malicious
[PowerShell Command]
Malicious
signatures.js
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
sigs
db.json
Microsoft.Web.WebView2.Core.dll
[Authenticode]_fa30d052.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Microsoft.Web.WebView2.WinForms.dll
.Net Resources
Microsoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp
[Authenticode]_36287edc.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
WebView2Loader.dll
[Authenticode]_5688fb5a.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.tls
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
YuDun.exe
.Net Resources
localhost.pfx
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
ID:0007
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 12 STICH kept: 2secondary ignored: 10
bin 6img 4

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>arc:zip>scr:ps1~T1027~T1059.001~T1105
Shape pe:exe>arc:zip>scr:ps1
malicious 3 nodes
Path pe:exe>arc:zip>scr:ps1~T1027~T1059.001
Shape pe:exe>arc:zip>scr:ps1
malicious 3 nodes
Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
DomainShieldSetup.exe
Full Name
DomainShieldSetup.exe
EntryPoint
System.Void YuDunSetup.Program::Main()
Scope Name
DomainShieldSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DomainShieldSetup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
20
Main Method
System.Void YuDunSetup.Program::Main()
Main IL Instruction Count
323
Info
PE Detect: PeReader OK (file layout)
Main IL 
nop <null>
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr YuDunPCManager
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_003C: ldloc.0
nop <null>
ldstr 检测到已安装欲盾电脑管家。
如需重新安装，请先卸载旧版本。
ldstr 欲盾电脑管家安装程序
ldc.i4.0 <null>
ldc.i4.s 64
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave IL_035A: nop
ldloc.0 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
call System.String System.IO.Path::GetTempPath()
ldstr yudun_pkg.zip
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr package.zip
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.2 <null>
nop <null>
ldloc.2 <null>
ldnull <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_008A: ldloc.1
nop <null>
ldstr 安装包资源损坏，请重新下载。
ldstr 欲盾电脑管家安装程序
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave IL_035A: nop
ldloc.1 <null>
ldc.i4.2 <null>
ldc.i4.2 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess)
stloc.3 <null>
nop <null>
ldloc.2 <null>
ldloc.3 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
nop <null>
nop <null>
leave.s IL_00B1: nop
ldloc.3 <null>
ldnull <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_00B0: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
nop <null>
leave.s IL_00C7: nop
ldloc.2 <null>
ldnull <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_00C6: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
ldloc.1 <null>
ldloc.0 <null>
call System.Void System.IO.Compression.ZipFile::ExtractToDirectory(System.String,System.String)
nop <null>
nop <null>
ldloc.1 <null>
call System.Void System.IO.File::Delete(System.String)
nop <null>
nop <null>
leave.s IL_00E0: nop
pop <null>
nop <null>
nop <null>
leave.s IL_00E0: nop
nop <null>
ldloc.0 <null>
ldstr YuDun.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_4
nop <null>
ldc.i4.s 16
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stloc.s V_5
ldloc.s V_5
ldstr 欲盾电脑管家.lnk
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_6
ldstr WScript.Shell
call System.Type System.Type::GetTypeFromProgID(System.String)
stloc.s V_7
ldloc.s V_7
call System.Object System.Activator::CreateInstance(System.Type)
stloc.s V_8
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
brtrue.s IL_0164: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
ldc.i4.0 <null>
ldstr CreateShortcut
ldnull <null>
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.2 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldc.i4.1 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::InvokeMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Collections.Generic.IEnumerable`1<System.Type>,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
br.s IL_0164: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
ldfld System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
ldloc.s V_8
ldloc.s V_6
callvirt System.Object System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object,System.String)
stloc.s V_9
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
brtrue.s IL_01C6: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
ldc.i4.0 <null>
ldstr TargetPath
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.2 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldc.i4.1 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::SetMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
br.s IL_01C6: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
ldfld System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
ldloc.s V_9
ldloc.s V_4
callvirt System.Object System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object,System.String)
pop <null>
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
brtrue.s IL_0227: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
ldc.i4.0 <null>
ldstr WorkingDirectory
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.2 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldc.i4.1 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::SetMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
br.s IL_0227: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
ldfld System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
ldloc.s V_9
ldloc.0 <null>
callvirt System.Object System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object,System.String)
pop <null>
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
brtrue.s IL_0287: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
ldc.i4.0 <null>
ldstr Description
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.2 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldc.i4.3 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::SetMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
br.s IL_0287: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
ldfld System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
ldloc.s V_9
ldstr 欲盾电脑管家
callvirt System.Object System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object,System.String)
pop <null>
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
brtrue.s IL_02E5: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
ldc.i4 256
ldstr Save
ldnull <null>
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.1 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::InvokeMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Collections.Generic.IEnumerable`1<System.Type>,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
br.s IL_02E5: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
ldfld System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
ldloc.s V_9
callvirt System.Void System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object)
nop <null>
nop <null>
leave.s IL_0304: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0304: nop
nop <null>
ldstr 安装完成！
是否立即运行欲盾电脑管家？
ldstr 欲盾电脑管家安装程序
ldc.i4.4 <null>
ldc.i4.s 32
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
stloc.s V_10
ldloc.s V_10
ldc.i4.6 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_0331: nop
nop <null>
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
nop <null>
nop <null>
leave.s IL_0359: nop
stloc.s V_11
nop <null>
ldstr 安装失败：
ldloc.s V_11
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr 欲盾电脑管家安装程序
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_0359: nop
nop <null>
nop <null>
ret <null>
Module Name
DomainShieldSetup.exe
Full Name
DomainShieldSetup.exe
EntryPoint
System.Void YuDunSetup.Program::Main()
Scope Name
DomainShieldSetup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DomainShieldSetup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
20
Main Method
System.Void YuDunSetup.Program::Main()
Main IL Instruction Count
323
Main IL 
nop <null>
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr YuDunPCManager
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_003C: ldloc.0
nop <null>
ldstr 检测到已安装欲盾电脑管家。
如需重新安装，请先卸载旧版本。
ldstr 欲盾电脑管家安装程序
ldc.i4.0 <null>
ldc.i4.s 64
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave IL_035A: nop
ldloc.0 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
call System.String System.IO.Path::GetTempPath()
ldstr yudun_pkg.zip
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr package.zip
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.2 <null>
nop <null>
ldloc.2 <null>
ldnull <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_008A: ldloc.1
nop <null>
ldstr 安装包资源损坏，请重新下载。
ldstr 欲盾电脑管家安装程序
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave IL_035A: nop
ldloc.1 <null>
ldc.i4.2 <null>
ldc.i4.2 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess)
stloc.3 <null>
nop <null>
ldloc.2 <null>
ldloc.3 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
nop <null>
nop <null>
leave.s IL_00B1: nop
ldloc.3 <null>
ldnull <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_00B0: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
nop <null>
leave.s IL_00C7: nop
ldloc.2 <null>
ldnull <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_00C6: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
ldloc.1 <null>
ldloc.0 <null>
call System.Void System.IO.Compression.ZipFile::ExtractToDirectory(System.String,System.String)
nop <null>
nop <null>
ldloc.1 <null>
call System.Void System.IO.File::Delete(System.String)
nop <null>
nop <null>
leave.s IL_00E0: nop
pop <null>
nop <null>
nop <null>
leave.s IL_00E0: nop
nop <null>
ldloc.0 <null>
ldstr YuDun.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_4
nop <null>
ldc.i4.s 16
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stloc.s V_5
ldloc.s V_5
ldstr 欲盾电脑管家.lnk
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_6
ldstr WScript.Shell
call System.Type System.Type::GetTypeFromProgID(System.String)
stloc.s V_7
ldloc.s V_7
call System.Object System.Activator::CreateInstance(System.Type)
stloc.s V_8
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
brtrue.s IL_0164: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
ldc.i4.0 <null>
ldstr CreateShortcut
ldnull <null>
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.2 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldc.i4.1 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::InvokeMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Collections.Generic.IEnumerable`1<System.Type>,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
br.s IL_0164: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
ldfld System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site1
ldloc.s V_8
ldloc.s V_6
callvirt System.Object System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object,System.String)
stloc.s V_9
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
brtrue.s IL_01C6: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
ldc.i4.0 <null>
ldstr TargetPath
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.2 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldc.i4.1 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::SetMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
br.s IL_01C6: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
ldfld System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site2
ldloc.s V_9
ldloc.s V_4
callvirt System.Object System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object,System.String)
pop <null>
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
brtrue.s IL_0227: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
ldc.i4.0 <null>
ldstr WorkingDirectory
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.2 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldc.i4.1 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::SetMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
br.s IL_0227: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
ldfld System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site3
ldloc.s V_9
ldloc.0 <null>
callvirt System.Object System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object,System.String)
pop <null>
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
brtrue.s IL_0287: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
ldc.i4.0 <null>
ldstr Description
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.2 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
ldc.i4.1 <null>
ldc.i4.3 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::SetMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
br.s IL_0287: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
ldfld System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site4
ldloc.s V_9
ldstr 欲盾电脑管家
callvirt System.Object System.Func`4<System.Runtime.CompilerServices.CallSite,System.Object,System.String,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object,System.String)
pop <null>
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
brtrue.s IL_02E5: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
ldc.i4 256
ldstr Save
ldnull <null>
ldtoken YuDunSetup.Program
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4.1 <null>
newarr Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldc.i4.0 <null>
ldnull <null>
call Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String)
stelem.ref <null>
ldloc.s V_13
call System.Runtime.CompilerServices.CallSiteBinder Microsoft.CSharp.RuntimeBinder.Binder::InvokeMember(Microsoft.CSharp.RuntimeBinder.CSharpBinderFlags,System.String,System.Collections.Generic.IEnumerable`1<System.Type>,System.Type,System.Collections.Generic.IEnumerable`1<Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo>)
call System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>>::Create(System.Runtime.CompilerServices.CallSiteBinder)
stsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
br.s IL_02E5: ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
ldfld System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object> System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>>::Target
ldsfld System.Runtime.CompilerServices.CallSite`1<System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>> YuDunSetup.Program/<Main>o__SiteContainer0::<>p__Site5
ldloc.s V_9
callvirt System.Void System.Action`2<System.Runtime.CompilerServices.CallSite,System.Object>::Invoke(System.Runtime.CompilerServices.CallSite,System.Object)
nop <null>
nop <null>
leave.s IL_0304: nop
pop <null>
nop <null>
nop <null>
leave.s IL_0304: nop
nop <null>
ldstr 安装完成！
是否立即运行欲盾电脑管家？
ldstr 欲盾电脑管家安装程序
ldc.i4.4 <null>
ldc.i4.s 32
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
stloc.s V_10
ldloc.s V_10
ldc.i4.6 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldloc.s V_12
brtrue.s IL_0331: nop
nop <null>
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
nop <null>
nop <null>
leave.s IL_0359: nop
stloc.s V_11
nop <null>
ldstr 安装失败：
ldloc.s V_11
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr 欲盾电脑管家安装程序
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
nop <null>
leave.s IL_0359: nop
nop <null>
nop <null>
ret <null>
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
29c0a123b530411741d4e7fb6062836c
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
package.zip
Malicious
app
Malicious
index.html
index.html
0x000002AD.svg
0x000002AD.svg-preview.jpg
pay-qr.png
pay-qr.png-preview.png
css
styles.css
js
Malicious
app.js
app.js
0x00006056.svg
0x00006056.svg-preview.jpg
0x0000BCB4.svg
0x0001E1B3.svg
0x0001E1B3.svg-preview.jpg
0x0001E6DE.svg
0x0001E6DE.svg-preview.jpg
0x0001EA9D.svg
0x0001EA9D.svg-preview.jpg
0x0001EE66.svg
0x0001EE66.svg-preview.jpg
cloud.js
engine.js
Malicious
[PowerShell Command]
Malicious
signatures.js
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
sigs
db.json
Microsoft.Web.WebView2.Core.dll
[Authenticode]_fa30d052.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Microsoft.Web.WebView2.WinForms.dll
.Net Resources
Microsoft.Web.WebView2.WinForms.Microsoft.Web.WebView2.WinForm.WebView2.bmp
[Authenticode]_36287edc.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
WebView2Loader.dll
[Authenticode]_5688fb5a.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.fptable
.tls
_RDATA
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
YuDun.exe
.Net Resources
localhost.pfx
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0-preview.png
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0-preview.png
ID:0007
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhu
29c0a123b530411741d4e7fb6062836c › .Net Resources › package.zip › app › js › engine.js › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙