Suspicious
Suspect

7f7edf1d0fc333a67f67559219b90671

PE Executable
MD5: 7f7edf1d0fc333a67f67559219b90671
Size: 16.84 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 7f7edf1d0fc333a67f67559219b90671
Sha1 05e87dde530141661320f41ea2554e0a02e4c015
Sha256 bdcdd7e8a1780076e09fa5f1635603ed07199a0f8a595e7ad5c089887d5a4cbf
Sha384 a48be59e605c19b8a3862d76c57df8a001daf8b784d9a0f49dfaa5bd933836ee63944936a7b1ac20c9a6d6fea9d05af9
Sha512 56492633d4f82d8444b16f3c38bad876f3019016045a9c516658b1fbd7d61cd84de809d07a6bb4a567ffeeec583ef111bf8163d68635dffb7aec5e594769d1e2
SSDeep 393216:akCCkNsgsNvShEYkxXn+DrDA64u1q584hzWfZwlRcmUitHunGRBGQsaw:akCCZjNvrYk03Dr1q55hzWfZwsP1GR49
TLSH 10073349F3E3D981E28639F3D144E2F70E20D8491F619E308764AB788F9D539A45FA8D
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
7f7edf1d0fc333a67f67559219b90671
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yfhluu.Resources
Extreme Injector v3 .exe
Rust.exe
settings.xml
steam.exe
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Extreme Injector v3.exe
Full Name
Extreme Injector v3.exe
EntryPoint
System.Void Program::Main()
Scope Name
Extreme Injector v3.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Extreme Injector v3
Assembly Version
3.7.3.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
17
Main Method
System.Void Program::Main()
Main IL Instruction Count
40
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brtrue.s IL_007A: ldnull
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0078: br.s IL_0081
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0022: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: br.s IL_0081
br.s IL_0081: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
Module Name
Extreme Injector v3.exe
Full Name
Extreme Injector v3.exe
EntryPoint
System.Void Program::Main()
Scope Name
Extreme Injector v3.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Extreme Injector v3
Assembly Version
3.7.3.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
17
Main Method
System.Void Program::Main()
Main IL Instruction Count
40
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brtrue.s IL_007A: ldnull
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0078: br.s IL_0081
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0022: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: br.s IL_0081
br.s IL_0081: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
7f7edf1d0fc333a67f67559219b90671
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
yfhluu.Resources
Extreme Injector v3 .exe
Rust.exe
settings.xml
steam.exe
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙