Suspicious
Suspect

70a1588593816c6b10d1de3ed58d43cd

Share on LinkedIn
Print
PE Executable
MD5: 70a1588593816c6b10d1de3ed58d43cd
Size: 1.3 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 70a1588593816c6b10d1de3ed58d43cd
Sha1 aa8337e0f927d381f9d0a1b108c5a7e0cc9e5a7e
Sha256 b4a7ddf60dea8767a93ea802ee13d39de4b2ac0ce9e1c4895d21235dd07130d2
Sha384 6334088ea612e70d2d307bbf97ef5266f268857a58a6f703091427b96016b5816ff3b83a4a37d4841f7c5c68862ff526
Sha512 143421170a5672f027bec63a7419cc7e69cc1fd2047b6cb86065756f262dac398aefc891243e6ec143c75d4e3a37d2e111fd3a81798f8885501af1310ad07c35
SSDeep 24576:lSiSdl5VWDWg26xdFo9L0hlxcdNYw1sl1G:lZSJVWDsMy9QhwdN3
TLSH AB5515243AFE502AF1B3EF759BE47496DA6FB7733B07645E1090038A4A13A41DEC153A
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
70a1588593816c6b10d1de3ed58d43cd
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Unity.Interception.Properties.Resources.resources
Unity.Interception.package.snk
NeonBadminton.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
LX_Sdq_n0aebwa.zip
11.exe
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILRepack.List
ILRepack.List
STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 5
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\Users\Administrator\AppData\Local\LX_CRYPTER\Temp\LX_Sdq_n0aebwa\ILRepack-9592-746425\LX_Sdq_n0aebwa.pdb
Module Name
LX_Sdq_n0aebwa
Full Name
LX_Sdq_n0aebwa
EntryPoint
System.Void BriefingRoom4DCS.Program::Main(System.String[])
Scope Name
LX_Sdq_n0aebwa
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
LX_Sdq_n0aebwa
Assembly Version
3.9.5.27
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
511
Main Method
System.Void BriefingRoom4DCS.Program::Main(System.String[])
Main IL Instruction Count
251
Main IL 
ldc.i4.0 <null>
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4.5 <null>
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4.s 26
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4 12345
newobj System.Void System.Nullable`1<System.Int32>::.ctor(System.Int32)
call System.Void BriefingRoom4DCS.Toolbox::Reseed(System.Nullable`1<System.Int32>)
ldc.i4.s 10
ldc.i4.s 20
call System.Int32 BriefingRoom4DCS.Toolbox::RandomInt(System.Int32,System.Int32)
pop <null>
call System.Double BriefingRoom4DCS.Toolbox::RandomDouble()
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
dup <null>
ldstr Apple
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Pear
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Cherry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Banana
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Strawberry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
call System.Collections.Generic.List`1<System.String> BriefingRoom4DCS.Toolbox::ShuffleList<System.String>(System.Collections.Generic.List`1<System.String>)
pop <null>
ldstr ["name"] = "Player",["skill"] = 100,["active"]=true,["role"]="Fighter"
stloc.0 <null>
ldloc.0 <null>
call System.Collections.Generic.Dictionary`2<System.String,System.Object> BriefingRoom4DCS.Toolbox::ToDictionaryObject(System.String)
pop <null>
leave.s IL_0089: newobj System.Void Razorvine.Serpent.Parser::.ctor()
pop <null>
leave.s IL_0089: newobj System.Void Razorvine.Serpent.Parser::.ctor()
newobj System.Void Razorvine.Serpent.Parser::.ctor()
stloc.1 <null>
ldc.i4.s 24
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 42
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr -9999999999
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 3.14159
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr True
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr False
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr None
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr 'hello world'
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr "string with \n escape"
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr b'bytes-data\x80'
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr (1+2j)
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldstr (1.2-3.4j)
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr -4.5j
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldstr ()
stelem.ref <null>
dup <null>
ldc.i4.s 13
ldstr (42,)
stelem.ref <null>
dup <null>
ldc.i4.s 14
ldstr ('a', 1, True)
stelem.ref <null>
dup <null>
ldc.i4.s 15
ldstr []
stelem.ref <null>
dup <null>
ldc.i4.s 16
ldstr [10, 20, 30]
stelem.ref <null>
dup <null>
ldc.i4.s 17
ldstr {}
stelem.ref <null>
dup <null>
ldc.i4.s 18
ldstr {'key1': 'value1', 42: False}
stelem.ref <null>
dup <null>
ldc.i4.s 19
ldstr {1, 2, 3, 2, 1}
stelem.ref <null>
dup <null>
ldc.i4.s 20
ldstr {'user': {'name': 'John', 'id': 101}, 'items': [1,2,3]}
stelem.ref <null>
dup <null>
ldc.i4.s 21
ldstr [1, 2, 3
stelem.ref <null>
dup <null>
ldc.i4.s 22
ldstr {'key': }
stelem.ref <null>
dup <null>
ldc.i4.s 23
ldstr 'unclosed string
stelem.ref <null>
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br.s IL_0187: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem.ref <null>
stloc.s V_6
ldloc.1 <null>
ldloc.s V_6
callvirt Razorvine.Serpent.Ast Razorvine.Serpent.Parser::Parse(System.String)
pop <null>
leave.s IL_0181: ldloc.s V_5
pop <null>
leave.s IL_0181: ldloc.s V_5
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt.s IL_016C: ldloc.s V_4
newobj System.Void BriefingRoom4DCS.Character::.ctor()
dup <null>
ldstr Sir Thryrallo
callvirt System.Void BriefingRoom4DCS.Character::set_Name(System.String)
dup <null>
ldc.i4.s 99
stfld System.Int32 BriefingRoom4DCS.Character::Level
dup <null>
ldc.i4.1 <null>
stfld System.Boolean BriefingRoom4DCS.Character::IsActive
dup <null>
ldc.r4 123.45
stfld System.Single BriefingRoom4DCS.Character::Health
dup <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
dup <null>
ldstr Slash
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Parry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Heal
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
stfld System.Collections.Generic.List`1<System.String> BriefingRoom4DCS.Character::Skills
dup <null>
newobj System.Void BriefingRoom4DCS.Weapon::.ctor()
dup <null>
ldstr HoyoBlade
callvirt System.Void BriefingRoom4DCS.Weapon::set_Name(System.String)
dup <null>
ldc.i4.s 50
stfld System.Int32 BriefingRoom4DCS.Weapon::Damage
stfld BriefingRoom4DCS.Weapon BriefingRoom4DCS.Character::EquippedWeapon
call System.String HoyoToon.Parser::Serialize(System.Object)
call BriefingRoom4DCS.Character HoyoToon.Parser::Deserialize<BriefingRoom4DCS.Character>(System.String)
pop <null>
ldstr 
%YAML 1.1
%TAG !u! tag:unity3d.com,2011:
--- !u!74 &7400000
AnimationClip:
  m_PPtrCurves:
  - curve:
    - time: 0
      value: {fileID: 2100000, guid: abc, type: 2}
    - time: 0.5
      value: {fileID: 2100000, guid: def, type: 2}
    attribute: m_Materials
    path: 
    classID: 23
    script: {fileID: 0}
  - curve:
    - time: 0.25
      value: {fileID: 2100000, guid: ghi, type: 2}
    attribute: m_SomeOtherAttribute
    path: 
    classID: 1
    script: {fileID: 0}
  m_Name: MyAnimation

stloc.2 <null>
ldstr test_animation.anim
stloc.3 <null>
ldloc.3 <null>
ldloc.2 <null>
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldloc.3 <null>
call HoyoToon.AnimationParser/Animation HoyoToon.AnimationParser::Parse(System.String)
pop <null>
leave.s IL_023C: ldc.i4.1
pop <null>
leave.s IL_023C: ldc.i4.1
ldloc.3 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_023B: endfinally
ldloc.3 <null>
call System.Void System.IO.File::Delete(System.String)
endfinally <null>
ldc.i4.1 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.2 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.3 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.4 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.s 11
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.s 22
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.0 <null>
call BriefingRoom4DCS.Data.Coalition BriefingRoom4DCS.Toolbox::GetEnemy(BriefingRoom4DCS.Data.Coalition)
pop <null>
ldc.i4.1 <null>
call BriefingRoom4DCS.Data.Coalition BriefingRoom4DCS.Toolbox::GetEnemy(BriefingRoom4DCS.Data.Coalition)
pop <null>
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ret <null>
Module Name
LX_Sdq_n0aebwa
Full Name
LX_Sdq_n0aebwa
EntryPoint
System.Void BriefingRoom4DCS.Program::Main(System.String[])
Scope Name
LX_Sdq_n0aebwa
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
LX_Sdq_n0aebwa
Assembly Version
3.9.5.27
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
511
Main Method
System.Void BriefingRoom4DCS.Program::Main(System.String[])
Main IL Instruction Count
251
Main IL 
ldc.i4.0 <null>
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4.5 <null>
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4.s 26
call System.String BriefingRoom4DCS.Toolbox::GetAlias(System.Int32)
pop <null>
ldc.i4 12345
newobj System.Void System.Nullable`1<System.Int32>::.ctor(System.Int32)
call System.Void BriefingRoom4DCS.Toolbox::Reseed(System.Nullable`1<System.Int32>)
ldc.i4.s 10
ldc.i4.s 20
call System.Int32 BriefingRoom4DCS.Toolbox::RandomInt(System.Int32,System.Int32)
pop <null>
call System.Double BriefingRoom4DCS.Toolbox::RandomDouble()
pop <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
dup <null>
ldstr Apple
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Pear
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Cherry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Banana
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Strawberry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
call System.Collections.Generic.List`1<System.String> BriefingRoom4DCS.Toolbox::ShuffleList<System.String>(System.Collections.Generic.List`1<System.String>)
pop <null>
ldstr ["name"] = "Player",["skill"] = 100,["active"]=true,["role"]="Fighter"
stloc.0 <null>
ldloc.0 <null>
call System.Collections.Generic.Dictionary`2<System.String,System.Object> BriefingRoom4DCS.Toolbox::ToDictionaryObject(System.String)
pop <null>
leave.s IL_0089: newobj System.Void Razorvine.Serpent.Parser::.ctor()
pop <null>
leave.s IL_0089: newobj System.Void Razorvine.Serpent.Parser::.ctor()
newobj System.Void Razorvine.Serpent.Parser::.ctor()
stloc.1 <null>
ldc.i4.s 24
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 42
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr -9999999999
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 3.14159
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr True
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr False
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr None
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr 'hello world'
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr "string with \n escape"
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr b'bytes-data\x80'
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr (1+2j)
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldstr (1.2-3.4j)
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldstr -4.5j
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldstr ()
stelem.ref <null>
dup <null>
ldc.i4.s 13
ldstr (42,)
stelem.ref <null>
dup <null>
ldc.i4.s 14
ldstr ('a', 1, True)
stelem.ref <null>
dup <null>
ldc.i4.s 15
ldstr []
stelem.ref <null>
dup <null>
ldc.i4.s 16
ldstr [10, 20, 30]
stelem.ref <null>
dup <null>
ldc.i4.s 17
ldstr {}
stelem.ref <null>
dup <null>
ldc.i4.s 18
ldstr {'key1': 'value1', 42: False}
stelem.ref <null>
dup <null>
ldc.i4.s 19
ldstr {1, 2, 3, 2, 1}
stelem.ref <null>
dup <null>
ldc.i4.s 20
ldstr {'user': {'name': 'John', 'id': 101}, 'items': [1,2,3]}
stelem.ref <null>
dup <null>
ldc.i4.s 21
ldstr [1, 2, 3
stelem.ref <null>
dup <null>
ldc.i4.s 22
ldstr {'key': }
stelem.ref <null>
dup <null>
ldc.i4.s 23
ldstr 'unclosed string
stelem.ref <null>
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_5
br.s IL_0187: ldloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldelem.ref <null>
stloc.s V_6
ldloc.1 <null>
ldloc.s V_6
callvirt Razorvine.Serpent.Ast Razorvine.Serpent.Parser::Parse(System.String)
pop <null>
leave.s IL_0181: ldloc.s V_5
pop <null>
leave.s IL_0181: ldloc.s V_5
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
ldlen <null>
conv.i4 <null>
blt.s IL_016C: ldloc.s V_4
newobj System.Void BriefingRoom4DCS.Character::.ctor()
dup <null>
ldstr Sir Thryrallo
callvirt System.Void BriefingRoom4DCS.Character::set_Name(System.String)
dup <null>
ldc.i4.s 99
stfld System.Int32 BriefingRoom4DCS.Character::Level
dup <null>
ldc.i4.1 <null>
stfld System.Boolean BriefingRoom4DCS.Character::IsActive
dup <null>
ldc.r4 123.45
stfld System.Single BriefingRoom4DCS.Character::Health
dup <null>
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
dup <null>
ldstr Slash
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Parry
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
dup <null>
ldstr Heal
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
stfld System.Collections.Generic.List`1<System.String> BriefingRoom4DCS.Character::Skills
dup <null>
newobj System.Void BriefingRoom4DCS.Weapon::.ctor()
dup <null>
ldstr HoyoBlade
callvirt System.Void BriefingRoom4DCS.Weapon::set_Name(System.String)
dup <null>
ldc.i4.s 50
stfld System.Int32 BriefingRoom4DCS.Weapon::Damage
stfld BriefingRoom4DCS.Weapon BriefingRoom4DCS.Character::EquippedWeapon
call System.String HoyoToon.Parser::Serialize(System.Object)
call BriefingRoom4DCS.Character HoyoToon.Parser::Deserialize<BriefingRoom4DCS.Character>(System.String)
pop <null>
ldstr 
%YAML 1.1
%TAG !u! tag:unity3d.com,2011:
--- !u!74 &7400000
AnimationClip:
  m_PPtrCurves:
  - curve:
    - time: 0
      value: {fileID: 2100000, guid: abc, type: 2}
    - time: 0.5
      value: {fileID: 2100000, guid: def, type: 2}
    attribute: m_Materials
    path: 
    classID: 23
    script: {fileID: 0}
  - curve:
    - time: 0.25
      value: {fileID: 2100000, guid: ghi, type: 2}
    attribute: m_SomeOtherAttribute
    path: 
    classID: 1
    script: {fileID: 0}
  m_Name: MyAnimation

stloc.2 <null>
ldstr test_animation.anim
stloc.3 <null>
ldloc.3 <null>
ldloc.2 <null>
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldloc.3 <null>
call HoyoToon.AnimationParser/Animation HoyoToon.AnimationParser::Parse(System.String)
pop <null>
leave.s IL_023C: ldc.i4.1
pop <null>
leave.s IL_023C: ldc.i4.1
ldloc.3 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_023B: endfinally
ldloc.3 <null>
call System.Void System.IO.File::Delete(System.String)
endfinally <null>
ldc.i4.1 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.2 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.3 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.4 <null>
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.s 11
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.s 22
call System.String BriefingRoom4DCS.Toolbox::GetOrdinalAdjective(System.Int32)
pop <null>
ldc.i4.0 <null>
call BriefingRoom4DCS.Data.Coalition BriefingRoom4DCS.Toolbox::GetEnemy(BriefingRoom4DCS.Data.Coalition)
pop <null>
ldc.i4.1 <null>
call BriefingRoom4DCS.Data.Coalition BriefingRoom4DCS.Toolbox::GetEnemy(BriefingRoom4DCS.Data.Coalition)
pop <null>
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙