Suspicious
Suspect

56668c98ff919d4550d1d67ae27a06aa

PE Executable
MD5: 56668c98ff919d4550d1d67ae27a06aa
Size: 66.05 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 56668c98ff919d4550d1d67ae27a06aa
Sha1 0b4c19164b64a95ad41458f36f24aebbc6fef557
Sha256 f407133c05f481c19c4715c2a8a967a7c6efa03109fe21f768338fa085f80b17
Sha384 5356830ffad8d53569372de7ebfdf26a6d3c0d2236f8df0b9b2ffd6b70b7cd07db9a7d934a7a427b36d899eda9e16173
Sha512 d2371d458b31760803e4e451335d22890ea6f12bf89dbf94c5b863a9273eeb90851cdedfd1735208fc0a6cce86e0d5ed9da7b1f17155e97a8c6378d103152aeb
SSDeep 1536:IMs0vS1fOPneNUUX5vKCGbb8wkypSJEQKpqKmY7:IX0vS8neNUUX5v1Gbb8v0SpZz
TLSH 13535C002798CA65E2ED4AF4ACF2550106F5D9772102DA5E7CC814DFAB9FFC64A027FA
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
56668c98ff919d4550d1d67ae27a06aa
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
zenithflow_app.exe
Full Name
zenithflow_app.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
zenithflow_app.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zenithflow_app
Assembly Version
1.0.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6.1
Total Strings
157
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
76
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0055: call System.Void Client.Helper.A::B()
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0040: leave IL_0055
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
leave IL_0055: call System.Void Client.Helper.A::B()
callvirt System.String System.Exception::get_Message()
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String)
pop <null>
leave IL_0055: call System.Void Client.Helper.A::B()
call System.Void Client.Helper.A::B()
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_006A: leave IL_0075
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_0075: nop
pop <null>
leave IL_0075: nop
nop <null>
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_008A: leave IL_0095
call System.Void Client.Helper.AntiProcess::StartBlock()
leave IL_0095: nop
pop <null>
leave IL_0095: nop
nop <null>
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00B4: leave IL_00BF
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00B4: leave IL_00BF
call System.Void Client.Helper.ProcessCritical::Set()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D4: leave IL_00DF
call System.Void Client.Install.NormalStartup::Install()
leave IL_00DF: call System.Void Client.Helper.Methods::PreventSleep()
pop <null>
leave IL_00DF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00F3: leave IL_00FE
call System.Void Client.Helper.Methods::ClearSetting()
leave IL_00FE: nop
pop <null>
leave IL_00FE: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_0113: leave IL_011E
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_011E: ldc.i4 5000
pop <null>
leave IL_011E: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00FE: nop
Module Name
zenithflow_app.exe
Full Name
zenithflow_app.exe
EntryPoint
System.Void Client.Program::Main()
Scope Name
zenithflow_app.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zenithflow_app
Assembly Version
1.0.7.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6.1
Total Strings
157
Main Method
System.Void Client.Program::Main()
Main IL Instruction Count
76
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
br IL_0015: ldloc.0
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldc.i4.1 <null>
add <null>
stloc.0 <null>
ldloc.0 <null>
ldsfld System.String Client.Settings::De_lay
call System.Int32 System.Convert::ToInt32(System.String)
blt.s IL_0007: ldc.i4 1000
call System.Boolean Client.Settings::InitializeSettings()
brtrue IL_0055: call System.Void Client.Helper.A::B()
ldsfld System.String Client.Settings::An_ti
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_0040: leave IL_0055
call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis()
leave IL_0055: call System.Void Client.Helper.A::B()
callvirt System.String System.Exception::get_Message()
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String)
pop <null>
leave IL_0055: call System.Void Client.Helper.A::B()
call System.Void Client.Helper.A::B()
call System.Boolean Client.Helper.MutexControl::CreateMutex()
brtrue IL_006A: leave IL_0075
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_0075: nop
pop <null>
leave IL_0075: nop
nop <null>
ldsfld System.String Client.Settings::Anti_Process
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_008A: leave IL_0095
call System.Void Client.Helper.AntiProcess::StartBlock()
leave IL_0095: nop
pop <null>
leave IL_0095: nop
nop <null>
ldsfld System.String Client.Settings::BS_OD
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00B4: leave IL_00BF
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00B4: leave IL_00BF
call System.Void Client.Helper.ProcessCritical::Set()
leave IL_00BF: nop
pop <null>
leave IL_00BF: nop
nop <null>
ldsfld System.String Client.Settings::In_stall
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse IL_00D4: leave IL_00DF
call System.Void Client.Install.NormalStartup::Install()
leave IL_00DF: call System.Void Client.Helper.Methods::PreventSleep()
pop <null>
leave IL_00DF: call System.Void Client.Helper.Methods::PreventSleep()
call System.Void Client.Helper.Methods::PreventSleep()
call System.Boolean Client.Helper.Methods::IsAdmin()
brfalse IL_00F3: leave IL_00FE
call System.Void Client.Helper.Methods::ClearSetting()
leave IL_00FE: nop
pop <null>
leave IL_00FE: nop
nop <null>
call System.Boolean Client.Connection.ClientSocket::get_IsConnected()
brtrue IL_0113: leave IL_011E
call System.Void Client.Connection.ClientSocket::Reconnect()
call System.Void Client.Connection.ClientSocket::InitializeClient()
leave IL_011E: ldc.i4 5000
pop <null>
leave IL_011E: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_00FE: nop
56668c98ff919d4550d1d67ae27a06aa
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙