Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 7a0e83e0e040cc7431ad73b416196b72
Size: 747.01 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 7a0e83e0e040cc7431ad73b416196b72
Sha1 35aff4c4f46824f51d0be16739c593d91e22a08e
Sha256 6d0143dd66ca4f5b6d342c88feb3a564c81e18e3db7805c85e7f5895acb059bb
Sha384 1edc4716bbb69aa13c2c14e7f2c93d92a97701a716b237f2e572425884bd06882eea798b0946df12b20d0ef7bba52876
Sha512 ae2d82429905f8eebf03cc9d9714636560e5f597998e8c390882b94a6c0663fd2c6590d8832cf9c976630556639be0212ca0b369f6d974699df720a3f5c1de4c
SSDeep 12288:OoyfLPHe/bJEfPATO26Td8zOJMrhqET53M0TZQgF/HfSEH2DKByf:OPfjHe/bJEnAC2gd84MrYK3M0ZJ1Hfd2
TLSH 08F412447109D812D8716FB465A1D3B612BA8E9EFC07E383ACDCFCA77B7B7821156281
7a0e83e0e040cc7431ad73b416196b72
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Game15.Game15.resources
$this.Icon
[NBF]root.IconData
menuStrip1.TrayLocation
sa
[NBF]root.Data
DemoSaver.Properties.Resources.resources
bcHE
[NBF]root.Data
[NBF]root.Data-preview.png
Name Value
Module Name
Uxmu.exe
Full Name
Uxmu.exe
EntryPoint
System.Void DemoSaver.Program::Main(System.String[])
Scope Name
Uxmu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Uxmu
Assembly Version
2.8.5.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
111
Main Method
System.Void DemoSaver.Program::Main(System.String[])
Main IL Instruction Count
45
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void Game15.Game15::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldarg.0 <null>
call DemoSaver.Program/ScreenSaverArgs DemoSaver.Program::ParseSaverArgs(System.String[])
stloc.0 <null>
newobj System.Void DemoSaver.ScreenSaverVisualizer::.ctor()
stloc.1 <null>
ldloc.1 <null>
newobj System.Void DemoSaver.ScreenSaverWindow::.ctor(DemoSaver.IScreenSaverVisualizer)
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
ldloc.0 <null>
ldfld DemoSaver.Program/ScreenSaverStates DemoSaver.Program/ScreenSaverArgs::SaverMode
stloc.s V_4
ldloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0082: ldloc.3
ldc.i4.1 <null>
stloc.3 <null>
br.s IL_0082: ldloc.3
ldc.i4.1 <null>
stloc.3 <null>
ldloc.0 <null>
ldfld System.IntPtr DemoSaver.Program/ScreenSaverArgs::TargetHandle
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr)
brfalse.s IL_0082: ldloc.3
ldloc.2 <null>
ldloc.0 <null>
ldfld System.IntPtr DemoSaver.Program/ScreenSaverArgs::TargetHandle
callvirt System.Void DemoSaver.ScreenSaverWindow::SetSaverPreviewMode(System.IntPtr)
br.s IL_0082: ldloc.3
ldstr No configuration available.
ldstr Test Saver
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
ldloc.3 <null>
brfalse.s IL_008B: ret
ldloc.2 <null>
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ret <null>
PDB Path PATH
Uxhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙