Suspicious
Suspect

898d994607ccd834cdbddc7fb4cc8242

Share on LinkedIn
Print
PE Executable
MD5: 898d994607ccd834cdbddc7fb4cc8242
Size: 483.33 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 898d994607ccd834cdbddc7fb4cc8242
Sha1 97479f00486752b22b3d19feffde5fc4e23c615f
Sha256 46deeb93c5d7be110d5459abc663ab8edc4bf2d8e098e0d3e96f613205d556f9
Sha384 2198b8c8c27c039143b66ea8074b29ea7d39f568456d9c775cf9e849a343f64088e6f7c446c4a69ba9eae0fbfcac5f18
Sha512 24f46d4a7e8780a5cd0efd0e6eb6b0263b8de0c406b474c236180d3c23e493b646bdd3833372f3f68ac9588840d81841f9d9fe07bea62a77d736c06594292e79
SSDeep 12288:/u9NJjDBVI/p6fySG5psHTg/5vq1g6KVoCF2Y7fERIpBkU:/u9NJjDBAOySGv3BvqhqfbE+p1
TLSH 68A4F1D52BED1515F2FB6F70AAB1B6114A3BB9A38C31D31E0589308D0A36F90DA51F63
PeID
Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rsrc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
costura.antidebugging.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
ID:0007
ID:0
ID:0008
ID:0
ID:0009
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.ecmascript.net.dll.compressed
.Net Resources
EcmaScript.NET.Resources.Messages.resources
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
.Net Resources
FxResources.System.Buffers.SR.resources
[Authenticode]_46bcb82a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.codedom.dll.compressed
[Authenticode]_4f7fbd47.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.CodeDom.SR.resources
ILLink.Substitutions.xml
costura.system.management.dll.compressed
[Authenticode]_2ae08752.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
System.Management.resources
costura.system.security.principal.windows.dll.compressed
.Net Resources
ILLink.Substitutions.xml
[Authenticode]_2846fe66.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.yahoo.yui.compressor.dll.compressed
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
STICH beta

No STICH Path has been generated for this analysis yet.

5 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Scanner.exe
Full Name
Scanner.exe
EntryPoint
System.Void h::a(System.String[])
Scope Name
Scanner.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Scanner
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
1115
Main Method
System.Void h::a(System.String[])
Main IL Instruction Count
331
Main IL
call System.Text.Encoding System.Text.Encoding::get_UTF8()
call System.Void System.Console::set_OutputEncoding(System.Text.Encoding)
ldstr Trem Do R v2 — Scanner Ultra-Rápido
call System.Void System.Console::set_Title(System.String)
ldc.i4.0 <null>
call System.Void System.Console::set_CursorVisible(System.Boolean)
ldc.i4.0 <null>
call System.Void System.Console::set_BackgroundColor(System.ConsoleColor)
call System.Void System.Console::Clear()
ldc.i4 128
ldc.i4 128
call System.Boolean System.Threading.ThreadPool::SetMinThreads(System.Int32,System.Int32)
pop <null>
ldc.i4 512
ldc.i4 512
call System.Boolean System.Threading.ThreadPool::SetMaxThreads(System.Int32,System.Int32)
pop <null>
ldc.i4 512
call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32)
call System.Void h::a()
call System.Boolean h::a()
brtrue.s IL_005C: call System.Void System.Console::Clear()
ret <null>
call System.Void System.Console::Clear()
call System.Void h::a()
call System.Void h::a()
ldc.i4.2 <null>
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr 
  Iniciando varredura ultra-rápida...

call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
ldnull <null>
ldftn System.Void h::a()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.s 20
newarr System.Threading.Tasks.Task
dup <null>
ldc.i4.0 <null>
ldsfld System.Action h/i::b
dup <null>
brtrue.s IL_00C5: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::b
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldsfld System.Action h/i::c
dup <null>
brtrue.s IL_00EC: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::c
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldsfld System.Action h/i::d
dup <null>
brtrue.s IL_0113: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::d
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldsfld System.Action h/i::e
dup <null>
brtrue.s IL_013A: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::e
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldsfld System.Action h/i::f
dup <null>
brtrue.s IL_0161: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::f
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldsfld System.Action h/i::g
dup <null>
brtrue.s IL_0188: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::g
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldsfld System.Action h/i::h
dup <null>
brtrue.s IL_01AF: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::h
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldsfld System.Action h/i::i
dup <null>
brtrue.s IL_01D6: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::i
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldsfld System.Action h/i::j
dup <null>
brtrue.s IL_01FD: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::j
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldsfld System.Action h/i::k
dup <null>
brtrue.s IL_0225: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::k
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldsfld System.Action h/i::l
dup <null>
brtrue.s IL_024D: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::l
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldsfld System.Action h/i::m
dup <null>
brtrue.s IL_0275: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::m
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldsfld System.Action h/i::n
dup <null>
brtrue.s IL_029D: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::n
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 13
ldsfld System.Action h/i::o
dup <null>
brtrue.s IL_02C5: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::o
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 14
ldsfld System.Action h/i::p
dup <null>
brtrue.s IL_02ED: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::p
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 15
ldsfld System.Action h/i::q
dup <null>
brtrue.s IL_0315: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::q
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 16
ldsfld System.Action h/i::r
dup <null>
brtrue.s IL_033D: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::r
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 17
ldsfld System.Action h/i::s
dup <null>
brtrue.s IL_0365: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::s
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 18
ldsfld System.Action h/i::t
dup <null>
brtrue.s IL_038D: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::t
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
dup <null>
ldc.i4.s 19
ldsfld System.Action h/i::u
dup <null>
brtrue.s IL_03B5: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld h/i h/i::a
ldftn System.Void h/i::a()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action h/i::u
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
stelem.ref <null>
ldc.r8 20
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
call System.Boolean System.Threading.Tasks.Task::WaitAll(System.Threading.Tasks.Task[],System.TimeSpan)
brtrue.s IL_03F0: ldc.i4.1
ldc.i4.s 12
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr 
  [!] Timeout global — cancelando...
call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
ldsfld System.Threading.CancellationTokenSource h::k
callvirt System.Void System.Threading.CancellationTokenSource::Cancel()
ldc.i4.1 <null>
volatile. <null>
stsfld System.Boolean modreq(System.Runtime.CompilerServices.IsVolatile) h::i
ldc.i4 350
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void System.Console::WriteLine()
call System.Void h::a()
call System.Void h::a()
ldc.i4.2 <null>
call System.Void System.Console::set_ForegroundColor(System.ConsoleColor)
ldstr 
  [OK] Concluído. Relatórios salvos na Área de Trabalho.
call System.Void System.Console::WriteLine(System.String)
ldstr 
  Pressione qualquer tecla para sair...
call System.Void System.Console::WriteLine(System.String)
call System.Void System.Console::ResetColor()
ldc.i4.1 <null>
call System.ConsoleKeyInfo System.Console::ReadKey(System.Boolean)
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙