Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 610cf410b594790106bfe7ea5bfeda75
|
| Sha1 | 1be977fa20e4ff896843b0eeaf568c53280a49fc
|
| Sha256 | 6a24ba25482c73d193fcc208d8ae267236b870b9ab30c44cabe2dc8bfb7a1073
|
| Sha384 | 662a361b11f6c9dce8c218952a9f3ccd897a74fcec4e54b61dfa6794bf1c67d771c4bba787f4558d0a79a32913590349
|
| Sha512 | a0c54054596fbbe41944674fec8e2dd138280ecc89ee03f927c28ba5c945ceabe30b8ac6dea7b0294556b8f2b7c171f92e124054c1fc7154fea2d1e7a75dbaea
|
| SSDeep | 1536:ZUFwcxbUTCrmPMV+mLyhFIqH1bs/5tQzc2LVclN:ZU6cxbgwmPMVl+hNH1bsTQPBY
|
| TLSH | 38735C013BD88D26F26E47B9ACF251074EF4D1576502CE5E3CC840DD6A6BBC58A037EA
|
PeID
|
Name0 | Value |
|---|---|
| Module Name | start.exe |
| Full Name | start.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | start.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | start |
| Assembly Version | 6.0.1.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 252 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 94 |
| Main IL | ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr MyData call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld Params.KeylogParams Client.Keylogger::Params callvirt System.Void Params.KeylogParams::LoadFromFile() ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.0 <null> br IL_0050: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0042: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_006D: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0086: leave IL_0091 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0091: call System.Void Client.Helper.A::B() pop <null> leave IL_0091: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_00A6: leave IL_00B1 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_00B1: nop pop <null> leave IL_00B1: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C6: leave IL_00D1 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00D1: nop pop <null> leave IL_00D1: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00F0: leave IL_00FB call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.ProcessCritical::Set() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0110: leave IL_011B call System.Void Client.Install.NormalStartup::Install() leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_012F: leave IL_013A call System.Void Client.Helper.Methods::ClearSetting() leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 pop <null> leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 dup <null> brtrue IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.Void Client.Keylogger::Run() call System.Void System.Windows.Forms.Application::Run() ret <null> |
| Module Name | start.exe |
| Full Name | start.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | start.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | start |
| Assembly Version | 6.0.1.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0 |
| Total Strings | 252 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 94 |
| Main IL | ldc.i4.s 26 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr MyData call System.String System.IO.Path::Combine(System.String,System.String) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldsfld Params.KeylogParams Client.Keylogger::Params callvirt System.Void Params.KeylogParams::LoadFromFile() ldc.i4.1 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) ldc.i4 3072 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) ldc.i4 9999 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) ldc.i4.0 <null> stloc.0 <null> br IL_0050: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::De_lay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0042: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_006D: call System.Void Client.Helper.SetRegistry::InitRegistry() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Client.Helper.SetRegistry::InitRegistry() ldsfld System.String Client.Settings::An_ti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0086: leave IL_0091 call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() leave IL_0091: call System.Void Client.Helper.A::B() pop <null> leave IL_0091: call System.Void Client.Helper.A::B() call System.Void Client.Helper.A::B() call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_00A6: leave IL_00B1 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_00B1: nop pop <null> leave IL_00B1: nop nop <null> ldsfld System.String Client.Settings::Anti_Process call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00C6: leave IL_00D1 call System.Void Client.Helper.AntiProcess::StartBlock() leave IL_00D1: nop pop <null> leave IL_00D1: nop nop <null> ldsfld System.String Client.Settings::BS_OD call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_00F0: leave IL_00FB call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_00F0: leave IL_00FB call System.Void Client.Helper.ProcessCritical::Set() leave IL_00FB: nop pop <null> leave IL_00FB: nop nop <null> ldsfld System.String Client.Settings::In_stall call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0110: leave IL_011B call System.Void Client.Install.NormalStartup::Install() leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() pop <null> leave IL_011B: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_012F: leave IL_013A call System.Void Client.Helper.Methods::ClearSetting() leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 pop <null> leave IL_013A: ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 ldsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 dup <null> brtrue IL_015C: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldsfld Client.Program/<>c Client.Program/<>c::<>9 ldftn System.Void Client.Program/<>c::<Main>b__0_0() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart Client.Program/<>c::<>9__0_0 newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) call System.Void System.Threading.Thread::Start() call System.Void Client.Keylogger::Run() call System.Void System.Windows.Forms.Application::Run() ret <null> |