Suspicious
Suspect

408088b186386bb92b4e1732fb48b852

PE Executable
|
MD5: 408088b186386bb92b4e1732fb48b852
|
Size: 299.01 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Medium

Hash
 Hash Value
MD5
408088b186386bb92b4e1732fb48b852
Sha1
09b60853339ef4cb46e0f56865c29038f9db3857
Sha256
b5354d383f528d71b398637bf763b3ee38f698aff3f41927fec71df7e6167a12
Sha384
01f5b5069344e604ea5562f6f930d0a09b40413b7763bf66e41a24fb27e92d9520308afec1f4b3304748690fc8778f07
Sha512
e14a3bbeac1ba21cf2f9c9cdc1e8bb988938e9aca02ea5d57673db551fc97170798430b612ce7f6775827bc176e7f05558825b103dd61020660af033ef9dce8d
SSDeep
6144:+pcUs50q7fEvoBpkgXC9MJb7Z75k6e/io:LUs5lfTX7ld66e/
TLSH
4154C7243BEA4418F1BBAF755BF475968A3FF6B33A13955E0491034B0A32E40DD91B3A

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
408088b186386bb92b4e1732fb48b852
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

Cliente_misarchivos12_duckdns_org_3026.exe
Full Name

Cliente_misarchivos12_duckdns_org_3026.exe
EntryPoint

System.Void NVnGCUW.CIvEdUh::Main(System.String[])
Scope Name

Cliente_misarchivos12_duckdns_org_3026.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Cliente_misarchivos12_duckdns_org_3026
Assembly Version

3.8.2964.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

1581
Main Method

System.Void NVnGCUW.CIvEdUh::Main(System.String[])
Main IL Instruction Count

61
Main IL

call System.Boolean NVnGCUW.CIvEdUh::SetProcessDPIAware() pop <null> leave.s IL_000B: ldc.i4 4080 pop <null> leave.s IL_000B: ldc.i4 4080 ldc.i4 4080 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) leave.s IL_001A: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee pop <null> leave.s IL_001A: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee brtrue.s IL_0032: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldnull <null> ldftn System.Boolean NVnGCUW.CIvEdUh::<Main>b__d(System.Object,System.Security.Cryptography.X509Certificates.X509Certificate,System.Security.Cryptography.X509Certificates.X509Chain,System.Net.Security.SslPolicyErrors) newobj System.Void System.Net.Security.RemoteCertificateValidationCallback::.ctor(System.Object,System.IntPtr) stsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee call System.Void System.Net.ServicePointManager::set_ServerCertificateValidationCallback(System.Net.Security.RemoteCertificateValidationCallback) leave.s IL_0041: ldc.i4.0 pop <null> leave.s IL_0041: ldc.i4.0 ldc.i4.0 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) leave.s IL_004C: ldc.i4.s 100 pop <null> leave.s IL_004C: ldc.i4.s 100 ldc.i4.s 100 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) leave.s IL_0058: ldnull pop <null> leave.s IL_0058: ldnull ldnull <null> call System.Void NVnGCUW.CIvEdUh::StartKeylogger(System.Net.Sockets.NetworkStream) ldarg.0 <null> brfalse.s IL_0076: ldc.i4.0 ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.0 <null> ble.s IL_0076: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --elevated call System.Boolean System.String::op_Equality(System.String,System.String) br.s IL_0077: stloc.0 ldc.i4.0 <null> stloc.0 <null> ldloc.0 <null> brtrue.s IL_0080: leave.s IL_0085 call System.Void NVnGCUW.CIvEdUh::UzFdfKe() leave.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj() pop <null> leave.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj() call System.Void NVnGCUW.CIvEdUh::MvSuBnj() leave.s IL_008F: ldc.i4 5135 pop <null> leave.s IL_008F: ldc.i4 5135 ldc.i4 5135 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj()
Module Name

Cliente_misarchivos12_duckdns_org_3026.exe
Full Name

Cliente_misarchivos12_duckdns_org_3026.exe
EntryPoint

System.Void NVnGCUW.CIvEdUh::Main(System.String[])
Scope Name

Cliente_misarchivos12_duckdns_org_3026.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Cliente_misarchivos12_duckdns_org_3026
Assembly Version

3.8.2964.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

1581
Main Method

System.Void NVnGCUW.CIvEdUh::Main(System.String[])
Main IL Instruction Count

61
Main IL

call System.Boolean NVnGCUW.CIvEdUh::SetProcessDPIAware() pop <null> leave.s IL_000B: ldc.i4 4080 pop <null> leave.s IL_000B: ldc.i4 4080 ldc.i4 4080 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) leave.s IL_001A: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee pop <null> leave.s IL_001A: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee brtrue.s IL_0032: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldnull <null> ldftn System.Boolean NVnGCUW.CIvEdUh::<Main>b__d(System.Object,System.Security.Cryptography.X509Certificates.X509Certificate,System.Security.Cryptography.X509Certificates.X509Chain,System.Net.Security.SslPolicyErrors) newobj System.Void System.Net.Security.RemoteCertificateValidationCallback::.ctor(System.Object,System.IntPtr) stsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee call System.Void System.Net.ServicePointManager::set_ServerCertificateValidationCallback(System.Net.Security.RemoteCertificateValidationCallback) leave.s IL_0041: ldc.i4.0 pop <null> leave.s IL_0041: ldc.i4.0 ldc.i4.0 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) leave.s IL_004C: ldc.i4.s 100 pop <null> leave.s IL_004C: ldc.i4.s 100 ldc.i4.s 100 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) leave.s IL_0058: ldnull pop <null> leave.s IL_0058: ldnull ldnull <null> call System.Void NVnGCUW.CIvEdUh::StartKeylogger(System.Net.Sockets.NetworkStream) ldarg.0 <null> brfalse.s IL_0076: ldc.i4.0 ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.0 <null> ble.s IL_0076: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --elevated call System.Boolean System.String::op_Equality(System.String,System.String) br.s IL_0077: stloc.0 ldc.i4.0 <null> stloc.0 <null> ldloc.0 <null> brtrue.s IL_0080: leave.s IL_0085 call System.Void NVnGCUW.CIvEdUh::UzFdfKe() leave.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj() pop <null> leave.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj() call System.Void NVnGCUW.CIvEdUh::MvSuBnj() leave.s IL_008F: ldc.i4 5135 pop <null> leave.s IL_008F: ldc.i4 5135 ldc.i4 5135 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj()
408088b186386bb92b4e1732fb48b852 (299.01 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙