Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
667f6fffd727dbaeca3e4cd0d21244a5
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:0
Config. Field Value
cnc_host [st] 5.tcphuhuhuhuhuhuhu
cnc_port [PT] 1huhuhuhu
ml Fhuhuhuhu
hid %huhuhuhu
UAC Fhuhuhuhu
NE Syhuhuhuhu
Trs WWW.huhuhuhuhuhuhu
Dow 55huhuhuhu
Bt3 2huhuhuhu
Bt4 %huhuhuhu
TipoDeIconesMensagem Quhuhuhuhu
TipoDeButaoMensagem Aborthuhuhuhuhuhuhu
TituleMensagem Ehuhuhuhu
TxtMensagem Systehuhuhuhuhuhuhu
OutreMensagems %Outrhuhuhuhuhuhuhu
packet_size [b] 5huhuhuhu
directory [DR] Thuhuhuhu
executable_name [EXE] Qasimhuhuhuhuhuhuhu
Cc Syhuhuhuhu
Cz Syhuhuhuhu
Ts 5huhuhuhu
M $huhuhuhu
BR $huhuhuhu
is_dir_defined [Idr] Fhuhuhuhu
is_startup_folder [IsF] Fhuhuhuhu
is_user_reg [Isu] Fhuhuhuhu
Cs Fhuhuhuhu
Hi Fhuhuhuhu
Sle Fhuhuhuhu
Ant Fhuhuhuhu
Tss Fhuhuhuhu
Us Fhuhuhuhu
csh Fhuhuhuhu
Ln Fhuhuhuhu
JS Fhuhuhuhu
VB Fhuhuhuhu
shh Fhuhuhuhu
Msg Fhuhuhuhu
Prs Fhuhuhuhu
Trr Fhuhuhuhu
Bc3 Fhuhuhuhu
cnc_host [HH] Fhuhuhuhu
KLG Fhuhuhuhu
reg_key [RG] Syhuhuhuhu
reg_path [sf] Softwahuhuhuhuhuhuhuhuhuhuhu
victim_name [VN] Hahuhuhuhu
splitter [Y] |huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void OK::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
503
Main Method
System.Void OK::main()
Main IL Instruction Count
37
Main IL 
ldsfld System.Boolean OK::HH
brfalse.s IL_0086: call System.Void OK::ko()
ldsfld System.IO.FileInfo OK::LO
callvirt System.String System.IO.FileSystemInfo::get_FullName()
call System.Object OK::HHK(System.String)
pop <null>
call My.MyComputer My.MyProject::get_Computer()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_LocalMachine()
ldsfld System.String OK::sf
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String OK::RG
ldsfld System.String OK::a
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
ldsfld Microsoft.VisualBasic.Devices.Computer OK::F
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_LocalMachine()
ldsfld System.String OK::sf
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String OK::RG
ldsfld System.String OK::a
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_0086: call System.Void OK::ko()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
ldloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
ldloc.0 <null>
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0086: call System.Void OK::ko()
call System.Void OK::ko()
ret <null>
Module Name
Stub.exe
Full Name
Stub.exe
EntryPoint
System.Void OK::main()
Scope Name
Stub.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v2.0.50727
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Stub
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
503
Main Method
System.Void OK::main()
Main IL Instruction Count
37
Main IL 
ldsfld System.Boolean OK::HH
brfalse.s IL_0086: call System.Void OK::ko()
ldsfld System.IO.FileInfo OK::LO
callvirt System.String System.IO.FileSystemInfo::get_FullName()
call System.Object OK::HHK(System.String)
pop <null>
call My.MyComputer My.MyProject::get_Computer()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_LocalMachine()
ldsfld System.String OK::sf
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String OK::RG
ldsfld System.String OK::a
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
ldsfld Microsoft.VisualBasic.Devices.Computer OK::F
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_LocalMachine()
ldsfld System.String OK::sf
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String OK::RG
ldsfld System.String OK::a
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_0086: call System.Void OK::ko()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
ldloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
ldloc.0 <null>
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0086: call System.Void OK::ko()
call System.Void OK::ko()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙