Suspicious
Suspect

70a1588593816c6b10d1de3ed58d43cd

PE Executable
MD5: 70a1588593816c6b10d1de3ed58d43cd
Size: 1.3 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 70a1588593816c6b10d1de3ed58d43cd
Sha1 aa8337e0f927d381f9d0a1b108c5a7e0cc9e5a7e
Sha256 b4a7ddf60dea8767a93ea802ee13d39de4b2ac0ce9e1c4895d21235dd07130d2
Sha384 6334088ea612e70d2d307bbf97ef5266f268857a58a6f703091427b96016b5816ff3b83a4a37d4841f7c5c68862ff526
Sha512 143421170a5672f027bec63a7419cc7e69cc1fd2047b6cb86065756f262dac398aefc891243e6ec143c75d4e3a37d2e111fd3a81798f8885501af1310ad07c35
SSDeep 24576:lSiSdl5VWDWg26xdFo9L0hlxcdNYw1sl1G:lZSJVWDsMy9QhwdN3
TLSH AB5515243AFE502AF1B3EF759BE47496DA6FB7733B07645E1090038A4A13A41DEC153A
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Unity.Interception.Properties.Resources.resources
Unity.Interception.package.snk
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILRepack.List
ILRepack.List
STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 5
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\Administrator\AppData\Local\LX_CRYPTER\Temp\LX_Sdq_n0aebwa\ILRepack-9592-746425\LX_Sdq_n0aebwa.pdb
Module Name
LX_Sdq_n0aebwa
Full Name
LX_Sdq_n0aebwa
EntryPoint
System.Void BriefingRoom4DCS.Program::Main(System.String[])
Scope Name
LX_Sdq_n0aebwa
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
LX_Sdq_n0aebwa
Assembly Version
3.9.5.27
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
511
Main Method
System.Void BriefingRoom4DCS.Program::Main(System.String[])
Main IL Instruction Count
251
Main IL
ldc.i4.0 <null>
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4.5 <null>
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4.s 26
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4 12345
newobj System.Void System.Nullable`1<System.Int32>::.ctor(System.Int32)
call System.Void BriefingRoom4DCS.Toolbox::Reseed(System.Nullable`1<System.Int32>)
ldc.i4.s 10
ldc.i4.s 20
call System.Int32 BriefingRoom4DCS.Toolbox::RandomInt(System.Int32,System.Int32)
pop <null>
call System.Double BriefingRoom4DCS.Toolbox::RandomDouble()
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
dup <null>
ldstr Apple
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Pear
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Cherry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Banana
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Strawberry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
call System.Collections.Generic.List`1<System.String> BriefingRoom4DCS.Toolbox::ShuffleList<System.String>(System.Collections.Generic.List`1<System.String>)
pop <null>
ldstr ["name"] = "Player",["skill"] = 100,["active"]=true,["role"]="Fighter"
stloc.0 <null>
ldloc.0 <null>
call System.Collections.Generic.Dictionary`2<System.String,System.Object> BriefingRoom4DCS.Toolbox::ToDictionaryObject(System.String)
pop <null>
leave.s IL_0089: newobj System.Void Razorvine.Serpent.Parser::.ctor()
pop <null>
leave.s IL_0089: newobj System.Void Razorvine.Serpent.Parser::.ctor()
newobj System.Void Razorvine.Serpent.Parser::.ctor()
stloc.1 <null>
ldc.i4.s 24
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 42
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr -9999999999
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 3.14159
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr True
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr False
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr None
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr 'hello world'
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr "string with \n escape"
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr b'bytes-data\x80'
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr (1+2j)
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldstr (1.2-3.4j)
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr -4.5j
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldstr ()
stelem.ref <null>
dup <null>
ldc.i4.s 13
ldstr (42,)
stelem.ref <null>
dup <null>
ldc.i4.s 14
ldstr ('a', 1, True)
stelem.ref <null>
dup <null>
ldc.i4.s 15
ldstr []
stelem.ref <null>
dup <null>
ldc.i4.s 16
ldstr [10, 20, 30]
stelem.ref <null>
dup <null>
ldc.i4.s 17
ldstr {}
stelem.ref <null>
dup <null>
ldc.i4.s 18
ldstr {'key1': 'value1', 42: False}
stelem.ref <null>
dup <null>
ldc.i4.s 19
ldstr {1, 2, 3, 2, 1}
stelem.ref <null>
dup <null>
ldc.i4.s 20
ldstr {'user': {'name': 'John', 'id': 101}, 'items': [1,2,3]}
stelem.ref <null>
dup <null>
ldc.i4.s 21
ldstr [1, 2, 3
stelem.ref <null>
dup <null>
ldc.i4.s 22
ldstr {'key': }
stelem.ref <null>
dup <null>
ldc.i4.s 23
ldstr 'unclosed string
stelem.ref <null>
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br.s IL_0187: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem.ref <null>
stloc.s V_6
ldloc.1 <null>
ldloc.s V_6
callvirt Razorvine.Serpent.Ast Razorvine.Serpent.Parser::Parse(System.String)
pop <null>
leave.s IL_0181: ldloc.s V_5
pop <null>
leave.s IL_0181: ldloc.s V_5
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt.s IL_016C: ldloc.s V_4
newobj System.Void BriefingRoom4DCS.Character::.ctor()
dup <null>
ldstr Sir Thryrallo
callvirt System.Void BriefingRoom4DCS.Character::set_Name(System.String)
dup <null>
ldc.i4.s 99
stfld System.Int32 BriefingRoom4DCS.Character::Level
dup <null>
ldc.i4.1 <null>
stfld System.Boolean BriefingRoom4DCS.Character::IsActive
dup <null>
ldc.r4 123.45
stfld System.Single BriefingRoom4DCS.Character::Health
dup <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
dup <null>
ldstr Slash
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Parry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Heal
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
stfld System.Collections.Generic.List`1<System.String> BriefingRoom4DCS.Character::Skills
dup <null>
newobj System.Void BriefingRoom4DCS.Weapon::.ctor()
dup <null>
ldstr HoyoBlade
callvirt System.Void BriefingRoom4DCS.Weapon::set_Name(System.String)
dup <null>
ldc.i4.s 50
stfld System.Int32 BriefingRoom4DCS.Weapon::Damage
stfld BriefingRoom4DCS.Weapon BriefingRoom4DCS.Character::EquippedWeapon
call System.String HoyoToon.Parser::Serialize(System.Object)
call BriefingRoom4DCS.Character HoyoToon.Parser::Deserialize<BriefingRoom4DCS.Character>(System.String)
pop <null>
ldstr 
%YAML 1.1
%TAG !u! tag:unity3d.com,2011:
--- !u!74 &7400000
AnimationClip:
  m_PPtrCurves:
  - curve:
    - time: 0
      value: {fileID: 2100000, guid: abc, type: 2}
    - time: 0.5
      value: {fileID: 2100000, guid: def, type: 2}
    attribute: m_Materials
    path: 
    classID: 23
    script: {fileID: 0}
  - curve:
    - time: 0.25
      value: {fileID: 2100000, guid: ghi, type: 2}
    attribute: m_SomeOtherAttribute
    path: 
    classID: 1
    script: {fileID: 0}
  m_Name: MyAnimation

stloc.2 <null>
ldstr test_animation.anim
stloc.3 <null>
ldloc.3 <null>
ldloc.2 <null>
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldloc.3 <null>
call HoyoToon.AnimationParser/Animation HoyoToon.AnimationParser::Parse(System.String)
pop <null>
leave.s IL_023C: ldc.i4.1
pop <null>
leave.s IL_023C: ldc.i4.1
ldloc.3 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_023B: endfinally
ldloc.3 <null>
call System.Void System.IO.File::Delete(System.String)
endfinally <null>
ldc.i4.1 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.2 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.3 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.4 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.s 11
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.s 22
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.0 <null>
call BriefingRoom4DCS.Data.Coalition BriefingRoom4DCS.Toolbox::GetEnemy(BriefingRoom4DCS.Data.Coalition)
pop <null>
ldc.i4.1 <null>
call BriefingRoom4DCS.Data.Coalition BriefingRoom4DCS.Toolbox::GetEnemy(BriefingRoom4DCS.Data.Coalition)
pop <null>
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ret <null>
Module Name
LX_Sdq_n0aebwa
Full Name
LX_Sdq_n0aebwa
EntryPoint
System.Void BriefingRoom4DCS.Program::Main(System.String[])
Scope Name
LX_Sdq_n0aebwa
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
LX_Sdq_n0aebwa
Assembly Version
3.9.5.27
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
511
Main Method
System.Void BriefingRoom4DCS.Program::Main(System.String[])
Main IL Instruction Count
251
Main IL
ldc.i4.0 <null>
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4.5 <null>
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4.s 26
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4 12345
newobj System.Void System.Nullable`1<System.Int32>::.ctor(System.Int32)
call System.Void BriefingRoom4DCS.Toolbox::Reseed(System.Nullable`1<System.Int32>)
ldc.i4.s 10
ldc.i4.s 20
call System.Int32 BriefingRoom4DCS.Toolbox::RandomInt(System.Int32,System.Int32)
pop <null>
call System.Double BriefingRoom4DCS.Toolbox::RandomDouble()
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
dup <null>
ldstr Apple
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Pear
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Cherry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Banana
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Strawberry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
call System.Collections.Generic.List`1<System.String> BriefingRoom4DCS.Toolbox::ShuffleList<System.String>(System.Collections.Generic.List`1<System.String>)
pop <null>
ldstr ["name"] = "Player",["skill"] = 100,["active"]=true,["role"]="Fighter"
stloc.0 <null>
ldloc.0 <null>
call System.Collections.Generic.Dictionary`2<System.String,System.Object> BriefingRoom4DCS.Toolbox::ToDictionaryObject(System.String)
pop <null>
leave.s IL_0089: newobj System.Void Razorvine.Serpent.Parser::.ctor()
pop <null>
leave.s IL_0089: newobj System.Void Razorvine.Serpent.Parser::.ctor()
newobj System.Void Razorvine.Serpent.Parser::.ctor()
stloc.1 <null>
ldc.i4.s 24
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 42
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr -9999999999
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 3.14159
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr True
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr False
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr None
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr 'hello world'
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr "string with \n escape"
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr b'bytes-data\x80'
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr (1+2j)
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldstr (1.2-3.4j)
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr -4.5j
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldstr ()
stelem.ref <null>
dup <null>
ldc.i4.s 13
ldstr (42,)
stelem.ref <null>
dup <null>
ldc.i4.s 14
ldstr ('a', 1, True)
stelem.ref <null>
dup <null>
ldc.i4.s 15
ldstr []
stelem.ref <null>
dup <null>
ldc.i4.s 16
ldstr [10, 20, 30]
stelem.ref <null>
dup <null>
ldc.i4.s 17
ldstr {}
stelem.ref <null>
dup <null>
ldc.i4.s 18
ldstr {'key1': 'value1', 42: False}
stelem.ref <null>
dup <null>
ldc.i4.s 19
ldstr {1, 2, 3, 2, 1}
stelem.ref <null>
dup <null>
ldc.i4.s 20
ldstr {'user': {'name': 'John', 'id': 101}, 'items': [1,2,3]}
stelem.ref <null>
dup <null>
ldc.i4.s 21
ldstr [1, 2, 3
stelem.ref <null>
dup <null>
ldc.i4.s 22
ldstr {'key': }
stelem.ref <null>
dup <null>
ldc.i4.s 23
ldstr 'unclosed string
stelem.ref <null>
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br.s IL_0187: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem.ref <null>
stloc.s V_6
ldloc.1 <null>
ldloc.s V_6
callvirt Razorvine.Serpent.Ast Razorvine.Serpent.Parser::Parse(System.String)
pop <null>
leave.s IL_0181: ldloc.s V_5
pop <null>
leave.s IL_0181: ldloc.s V_5
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt.s IL_016C: ldloc.s V_4
newobj System.Void BriefingRoom4DCS.Character::.ctor()
dup <null>
ldstr Sir Thryrallo
callvirt System.Void BriefingRoom4DCS.Character::set_Name(System.String)
dup <null>
ldc.i4.s 99
stfld System.Int32 BriefingRoom4DCS.Character::Level
dup <null>
ldc.i4.1 <null>
stfld System.Boolean BriefingRoom4DCS.Character::IsActive
dup <null>
ldc.r4 123.45
stfld System.Single BriefingRoom4DCS.Character::Health
dup <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
dup <null>
ldstr Slash
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Parry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Heal
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
stfld System.Collections.Generic.List`1<System.String> BriefingRoom4DCS.Character::Skills
dup <null>
newobj System.Void BriefingRoom4DCS.Weapon::.ctor()
dup <null>
ldstr HoyoBlade
callvirt System.Void BriefingRoom4DCS.Weapon::set_Name(System.String)
dup <null>
ldc.i4.s 50
stfld System.Int32 BriefingRoom4DCS.Weapon::Damage
stfld BriefingRoom4DCS.Weapon BriefingRoom4DCS.Character::EquippedWeapon
call System.String HoyoToon.Parser::Serialize(System.Object)
call BriefingRoom4DCS.Character HoyoToon.Parser::Deserialize<BriefingRoom4DCS.Character>(System.String)
pop <null>
ldstr 
%YAML 1.1
%TAG !u! tag:unity3d.com,2011:
--- !u!74 &7400000
AnimationClip:
  m_PPtrCurves:
  - curve:
    - time: 0
      value: {fileID: 2100000, guid: abc, type: 2}
    - time: 0.5
      value: {fileID: 2100000, guid: def, type: 2}
    attribute: m_Materials
    path: 
    classID: 23
    script: {fileID: 0}
  - curve:
    - time: 0.25
      value: {fileID: 2100000, guid: ghi, type: 2}
    attribute: m_SomeOtherAttribute
    path: 
    classID: 1
    script: {fileID: 0}
  m_Name: MyAnimation

stloc.2 <null>
ldstr test_animation.anim
stloc.3 <null>
ldloc.3 <null>
ldloc.2 <null>
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldloc.3 <null>
call HoyoToon.AnimationParser/Animation HoyoToon.AnimationParser::Parse(System.String)
pop <null>
leave.s IL_023C: ldc.i4.1
pop <null>
leave.s IL_023C: ldc.i4.1
ldloc.3 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_023B: endfinally
ldloc.3 <null>
call System.Void System.IO.File::Delete(System.String)
endfinally <null>
ldc.i4.1 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.2 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.3 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.4 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.s 11
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.s 22
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.0 <null>
call BriefingRoom4DCS.Data.Coalition BriefingRoom4DCS.Toolbox::GetEnemy(BriefingRoom4DCS.Data.Coalition)
pop <null>
ldc.i4.1 <null>
call BriefingRoom4DCS.Data.Coalition BriefingRoom4DCS.Toolbox::GetEnemy(BriefingRoom4DCS.Data.Coalition)
pop <null>
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ret <null>
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Unity.Interception.Properties.Resources.resources
Unity.Interception.package.snk
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILRepack.List
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙