Suspicious
Suspect

54320af90c676f3d3d0d083a79e03383

Share on LinkedIn
Print
PE Executable
MD5: 54320af90c676f3d3d0d083a79e03383
Size: 609.87 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 54320af90c676f3d3d0d083a79e03383
Sha1 05c4cf97b31c9a4e0579aba530f6a4f1c54106de
Sha256 446dea870ba05ccb6fb0038aca0d5d5bf5b8423b51f9ff40da74bb9fc603f4c4
Sha384 fc5f09368e652b71ddaaa84daf8bdf4058dd1384f2fcf0a908f1c5bb1c3a8e8c5c762e2b0dc49275715c94b8ecff40af
Sha512 d807ab881d969e898aa2b80f1c818e4208ea688b0a4d26e1ae07084834f205975b4c88664f33f2892605ab448de5fe2d0e0a9d41ff759e1f67dfd4ee4e666b67
SSDeep 6144:7Hv8sU89LWJ2dNq9jGyYSMCoI68zg/KWc0NPsyH5kqr1JCZ2cNI2/C4I159uvrAm:j2CWEdNq4yP76wSdPsyHCqr10u9Rm
TLSH 30D46B62737CDA3AC9FF0779B0B1162457B0E8226285E78F5804E5E91E973829D443FB
54320af90c676f3d3d0d083a79e03383
[Authenticode]_96c530e5.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
ScreenConnect.WindowsClient.exe
Full Name
ScreenConnect.WindowsClient.exe
EntryPoint
System.Int32 ScreenConnect.Program::Main(System.String[])
Scope Name
ScreenConnect.WindowsClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ScreenConnect.WindowsClient
Assembly Version
25.4.16.9293
Assembly Culture
<null>
Has PublicKey
True
PublicKey Token
4b14c015c87c1ad8
Target Framework
<null>
Total Strings
599
Main Method
System.Int32 ScreenConnect.Program::Main(System.String[])
Main IL Instruction Count
275
Main IL 
call System.Void ScreenConnect.Extensions::TrySubscribeToLogAppDomainException()
call System.Void ScreenConnect.WindowsExtensions::SubscribeToLogApplicationException()
call System.Void ScreenConnect.WindowsExtensions::FixupProcess()
call System.Void ScreenConnect.Extensions::FixupAppDomain()
ldarg.0 <null>
ldc.i4.0 <null>
call System.String ScreenConnect.Extensions::GetElementOrDefault<System.String>(System.String[],System.Int32)
ldstr RunFile
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_003A: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
call System.String ScreenConnect.Extensions::GetElementOrDefault<System.String>(System.String[],System.Int32)
ldstr RunFileElevated
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0055: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldnull <null>
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr RunFileElevated
call System.Boolean System.String::op_Equality(System.String,System.String)
call System.Void ScreenConnect.WindowsExtensions::StartProcessInSameDirectory(System.String,System.String,System.Boolean)
br IL_032E: ldc.i4.0
ldarg.0 <null>
ldc.i4.0 <null>
call System.String ScreenConnect.Extensions::GetElementOrDefault<System.String>(System.String[],System.Int32)
ldstr StartService
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_007E: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldarg.0 <null>
ldc.i4.2 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
ldnull <null>
call System.Void ScreenConnect.Program::StartService(System.String,System.Int32,System.Net.NetworkCredential)
br IL_032E: ldc.i4.0
ldarg.0 <null>
ldc.i4.0 <null>
call System.String ScreenConnect.Extensions::GetElementOrDefault<System.String>(System.String[],System.Int32)
ldstr Rerun
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00B7: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
call ScreenConnect.Toolkit ScreenConnect.Singleton`1<ScreenConnect.Toolkit>::get_Instance()
callvirt System.String ScreenConnect.Toolkit::GetCurrentProcessMainModuleFileName()
ldarg.0 <null>
ldc.i4.1 <null>
call System.Collections.Generic.IEnumerable`1<System.String> System.Linq.Enumerable::Skip<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Int32)
call System.Collections.Generic.IEnumerable`1<System.Object> System.Linq.Enumerable::Cast<System.Object>(System.Collections.IEnumerable)
call System.String ScreenConnect.Extensions::QuoteWindowsCommandLine(System.Collections.Generic.IEnumerable`1<System.Object>)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String,System.String)
pop <null>
br IL_032E: ldc.i4.0
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void ScreenConnect.MouseWheelMessageFilter::.ctor()
call System.Void System.Windows.Forms.Application::AddMessageFilter(System.Windows.Forms.IMessageFilter)
call System.Threading.ApartmentState System.Windows.Forms.Application::OleRequired()
pop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
brfalse.s IL_014F: ldnull
newobj System.Void ScreenConnect.TraceForm::.ctor()
ldsfld ScreenConnect.Proc`1<ScreenConnect.TraceForm> ScreenConnect.Program/<>c::<>9__0_0
dup <null>
brtrue.s IL_00FD: call ScreenConnect.TraceForm ScreenConnect.FunctionalExtensions::Mutate<ScreenConnect.TraceForm>(ScreenConnect.TraceForm,ScreenConnect.Proc`1<ScreenConnect.TraceForm>)
pop <null>
ldsfld ScreenConnect.Program/<>c ScreenConnect.Program/<>c::<>9
ldftn System.Void ScreenConnect.Program/<>c::<Main>b__0_0(ScreenConnect.TraceForm)
newobj System.Void ScreenConnect.Proc`1<ScreenConnect.TraceForm>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld ScreenConnect.Proc`1<ScreenConnect.TraceForm> ScreenConnect.Program/<>c::<>9__0_0
call ScreenConnect.TraceForm ScreenConnect.FunctionalExtensions::Mutate<ScreenConnect.TraceForm>(ScreenConnect.TraceForm,ScreenConnect.Proc`1<ScreenConnect.TraceForm>)
ldsfld ScreenConnect.Proc`1<ScreenConnect.TraceForm> ScreenConnect.Program/<>c::<>9__0_1
dup <null>
brtrue.s IL_0121: call ScreenConnect.TraceForm ScreenConnect.FunctionalExtensions::Mutate<ScreenConnect.TraceForm>(ScreenConnect.TraceForm,ScreenConnect.Proc`1<ScreenConnect.TraceForm>)
pop <null>
ldsfld ScreenConnect.Program/<>c ScreenConnect.Program/<>c::<>9
ldftn System.Void ScreenConnect.Program/<>c::<Main>b__0_1(ScreenConnect.TraceForm)
newobj System.Void ScreenConnect.Proc`1<ScreenConnect.TraceForm>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld ScreenConnect.Proc`1<ScreenConnect.TraceForm> ScreenConnect.Program/<>c::<>9__0_1
call ScreenConnect.TraceForm ScreenConnect.FunctionalExtensions::Mutate<ScreenConnect.TraceForm>(ScreenConnect.TraceForm,ScreenConnect.Proc`1<ScreenConnect.TraceForm>)
ldsfld ScreenConnect.Proc`1<ScreenConnect.TraceForm> ScreenConnect.Program/<>c::<>9__0_2
dup <null>
brtrue.s IL_0145: call ScreenConnect.TraceForm ScreenConnect.FunctionalExtensions::Mutate<ScreenConnect.TraceForm>(ScreenConnect.TraceForm,ScreenConnect.Proc`1<ScreenConnect.TraceForm>)
pop <null>
ldsfld ScreenConnect.Program/<>c ScreenConnect.Program/<>c::<>9
ldftn System.Void ScreenConnect.Program/<>c::<Main>b__0_2(ScreenConnect.TraceForm)
newobj System.Void ScreenConnect.Proc`1<ScreenConnect.TraceForm>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld ScreenConnect.Proc`1<ScreenConnect.TraceForm> ScreenConnect.Program/<>c::<>9__0_2
call ScreenConnect.TraceForm ScreenConnect.FunctionalExtensions::Mutate<ScreenConnect.TraceForm>(ScreenConnect.TraceForm,ScreenConnect.Proc`1<ScreenConnect.TraceForm>)
callvirt System.Void System.Windows.Forms.Control::Show()
ldnull <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldarg.0 <null>
ldc.i4.0 <null>
call System.String ScreenConnect.Extensions::GetElementOrDefault<System.String>(System.String[],System.Int32)
ldstr RunRole
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_018E: newobj System.Void ScreenConnect.Program/<>c__DisplayClass0_0::.ctor()
ldarg.0 <null>
ldc.i4.1 <null>
call System.String ScreenConnect.Extensions::GetElementOrDefault<System.String>(System.String[],System.Int32)
newobj System.Void ScreenConnect.PipeEndPointManager::.ctor(System.String)
stloc.0 <null>
ldarg.0 <null>
ldc.i4.2 <null>
call System.String ScreenConnect.Extensions::GetElementOrDefault<System.String>(System.String[],System.Int32)
ldc.i4.0 <null>
call System.Nullable`1<ScreenConnect.ClientRoles> ScreenConnect.Extensions::TryParseEnum<ScreenConnect.ClientRoles>(System.String,System.Boolean)
stloc.2 <null>
ldloca.s V_2
call ScreenConnect.ClientRoles System.Nullable`1<ScreenConnect.ClientRoles>::GetValueOrDefault()
stloc.1 <null>
br IL_02B4: ldloc.0
newobj System.Void ScreenConnect.Program/<>c__DisplayClass0_0::.ctor()
stloc.3 <null>
ldloc.3 <null>
ldnull <null>
stfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
ldarg.0 <null>
ldc.i4.0 <null>
call System.String ScreenConnect.Extensions::GetElementOrDefault<System.String>(System.String[],System.Int32)
stloc.s V_4
ldloc.s V_4
brtrue.s IL_01C0: ldloc.s V_4
call System.Void ScreenConnect.WindowsClientExtensions::ExtractManifestAttachmentsIfFirstRun()
call System.Deployment.Application.ApplicationDeployment System.Deployment.Application.ApplicationDeployment::get_CurrentDeployment()
callvirt System.Uri System.Deployment.Application.ApplicationDeployment::get_ActivationUri()
callvirt System.String System.Uri::get_Query()
stloc.s V_4
br.s IL_01F6: ldloc.3
ldloc.s V_4
ldc.i4.1 <null>
ldloca.s V_6
call System.Boolean System.Uri::TryCreate(System.String,System.UriKind,System.Uri&)
brfalse.s IL_01F6: ldloc.3
ldloc.3 <null>
ldloc.s V_6
callvirt System.String System.Uri::get_Host()
ldloc.s V_6
callvirt System.Int32 System.Uri::get_Port()
ldloc.s V_6
callvirt System.String System.Uri::get_PathAndQuery()
ldsfld ScreenConnect.ApplicationSettings ScreenConnect.ApplicationSettings::Instance
callvirt System.String ScreenConnect.ApplicationSettings::get_ClientLaunchParametersConstraint()
call ScreenConnect.ClientLaunchParameters ScreenConnect.ClientLaunchParameters::FromUrl(System.String,System.Int32,System.String,System.String)
stfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
ldloc.3 <null>
ldfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
brtrue.s IL_0215: ldloc.3
ldloc.3 <null>
ldloc.s V_4
ldsfld ScreenConnect.ApplicationSettings ScreenConnect.ApplicationSettings::Instance
callvirt System.String ScreenConnect.ApplicationSettings::get_ClientLaunchParametersConstraint()
call ScreenConnect.ClientLaunchParameters ScreenConnect.ClientLaunchParameters::FromQueryString(System.String,System.String)
stfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
ldloc.3 <null>
ldfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
brtrue.s IL_0228: ldc.i4.0
ldstr Must specify client launch parameters as argument or from ClickOnce context
newobj System.Void System.ArgumentException::.ctor(System.String)
throw <null>
ldc.i4.0 <null>
stloc.s V_5
ldloc.3 <null>
ldfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
callvirt ScreenConnect.ProcessType ScreenConnect.ClientLaunchParameters::get_ProcessType()
ldc.i4.2 <null>
bne.un.s IL_025B: ldloc.s V_5
ldloc.3 <null>
ldfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
callvirt ScreenConnect.SessionType ScreenConnect.ClientLaunchParameters::get_SessionType()
ldc.i4.1 <null>
beq.s IL_025B: ldloc.s V_5
ldloc.3 <null>
ldftn System.Void ScreenConnect.Program/<>c__DisplayClass0_0::<Main>b__3()
newobj System.Void ScreenConnect.Proc::.ctor(System.Object,System.IntPtr)
ldnull <null>
call System.Boolean ScreenConnect.Extensions::Try(ScreenConnect.Proc,System.Func`2<System.Exception,System.Boolean>)
stloc.s V_5
ldloc.s V_5
brtrue.s IL_02B4: ldloc.0
ldloc.3 <null>
ldfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
ldsfld ScreenConnect.CoreVersion ScreenConnect.Constants::ProductVersion
ldc.i4.1 <null>
newobj System.Void ScreenConnect.SocketEndPointManager::.ctor(ScreenConnect.ClientLaunchParameters,ScreenConnect.CoreVersion,ScreenConnect.ClientType)
stloc.0 <null>
ldloc.3 <null>
ldfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
callvirt ScreenConnect.ProcessType ScreenConnect.ClientLaunchParameters::get_ProcessType()
ldc.i4.2 <null>
bne.un.s IL_02B2: ldc.i4.3
ldloc.3 <null>
ldfld ScreenConnect.ClientLaunchParameters ScreenConnect.Program/<>c__DisplayClass0_0::clientLaunchParameters
callvirt ScreenConnect.SessionType ScreenConnect.ClientLaunchParameters::get_SessionType()
ldc.i4.1 <null>
beq.s IL_02B2: ldc.i4.3
ldloc.0 <null>
ldsfld System.EventHandler`1<ScreenConnect.EndPointManager/GuestConfigurationEventArgs> ScreenConnect.Program/<>c::<>9__0_4
dup <null>
brtrue.s IL_02AD: callvirt System.Void ScreenConnect.EndPointManager::add_GuestConfigurationRequested(System.EventHandler`1<ScreenConnect.EndPointManager/GuestConfigurationEventArgs>)
pop <null>
ldsfld ScreenConnect.Program/<>c ScreenConnect.Program/<>c::<>9
ldftn System.Void ScreenConnect.Program/<>c::<Main>b__0_4(System.Object,ScreenConnect.EndPointManager/GuestConfigurationEventArgs)
newobj System.Void System.EventHandler`1<ScreenConnect.EndPointManager/GuestConfigurationEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<ScreenConnect.EndPointManager/GuestConfigurationEventArgs> ScreenConnect.Program/<>c::<>9__0_4
callvirt System.Void ScreenConnect.EndPointManager::add_GuestConfigurationRequested(System.EventHandler`1<ScreenConnect.EndPointManager/GuestConfigurationEventArgs>)
ldc.i4.3 <null>
stloc.1 <null>
ldloc.0 <null>
brfalse.s IL_032E: ldc.i4.0
ldloc.0 <null>
newobj System.Void ScreenConnect.EndPointManagerActivityTracer::.ctor(ScreenConnect.EndPointManager)
call System.Void ScreenConnect.Activity::AddTracer(ScreenConnect.ActivityTracer)
ldloc.0 <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
callvirt System.Void ScreenConnect.ThreadRunnerBase::EnsureRunState(System.Boolean,System.Boolean)
call System.Version ScreenConnect.WindowsExtensions::GetTrueOSVersion()
ldc.i4.6 <null>
ldc.i4.0 <null>
newobj System.Void System.Version::.ctor(System.Int32,System.Int32)
call System.Boolean System.Version::op_GreaterThan(System.Version,System.Version)
brfalse.s IL_0310: ldc.i4 256
call System.Version ScreenConnect.WindowsExtensions::GetTrueOSVersion()
ldc.i4.6 <null>
ldc.i4.3 <null>
newobj System.Void System.Version::.ctor(System.Int32,System.Int32)
call System.Boolean System.Version::op_GreaterThanOrEqual(System.Version,System.Version)
brfalse.s IL_02F9: call System.Boolean ScreenConnect.WindowsNative::SetProcessDPIAware()
ldc.i4.2 <null>
call System.Boolean ScreenConnect.WindowsNative::SetProcessDpiAwarenessInternal(System.Int32)
pop <null>
br.s IL_02FF: ldstr "TaskbarCreated"
call System.Boolean ScreenConnect.WindowsNative::SetProcessDPIAware()
pop <null>
ldstr TaskbarCreated
call System.Int32 ScreenConnect.WindowsNative::RegisterWindowMessage(System.String)
ldc.i4.1 <null>
call System.IntPtr ScreenConnect.WindowsNative::ChangeWindowMessageFilter(System.Int32,System.UInt32)
pop <null>
ldc.i4 256
ldc.i4.0 <null>
call System.Boolean ScreenConnect.WindowsNative::SetProcessShutdownParameters(System.UInt32,System.UInt32)
pop <null>
ldloc.0 <null>
ldloc.1 <null>
newobj System.Void ScreenConnect.Client::.ctor(ScreenConnect.EndPointManager,ScreenConnect.ClientRoles)
dup <null>
call System.Void ScreenConnect.Extensions::InitializeItem<ScreenConnect.Client>(ScreenConnect.Client)
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ldc.i4.0 <null>
stloc.s V_7
leave.s IL_0343: ldloc.s V_7
dup <null>
ldc.i4.1 <null>
call System.Void ScreenConnect.Extensions::TryWriteExceptionToEventLog(System.Object,System.Int32)
callvirt System.Int32 System.ComponentModel.Win32Exception::get_NativeErrorCode()
stloc.s V_7
leave.s IL_0343: ldloc.s V_7
ldloc.s V_7
ret <null>
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x92600 size 10320 bytes
Info 
PDB Path: C:\builds\cc\cwcontrol\Product\WindowsClient\obj\Release\ScreenConnect.WindowsClient.pdb
An error has occurred. This application may no longer respond until reloaded. Reload 🗙