Suspicious
Suspect

95837df8829d551c99eb0eb84e8d5fed

PE Executable
MD5: 95837df8829d551c99eb0eb84e8d5fed
Size: 1.84 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 95837df8829d551c99eb0eb84e8d5fed
Sha1 b046a3dda448f4a3b1d1bad281ee7abe9758d55e
Sha256 cd7cf89608d3cccd358648d9dd55c3852281898beab02e133ebe95450e167773
Sha384 c2201e4788dc6c553e6bd67badb00ba6d765f4a961973efad4d8f3c3756943221468699c7a21fd80ec73578554826e1f
Sha512 29c01bb534c71d3144d729e8f4fd4c1de026241f537c73369058ed9ef0b807c2a86f541e8ca5340e433e5c3ba6cf855d646552b92e4adcb13ff0651244a47ee2
SSDeep 49152:mAxgG2UEvuJLpeJG1yJU+E5Zu2vO+ZRmtorMFlpxq4:BxZ1FTte3+ZUtoETxz
TLSH 4685330E27A19525D4BE42B4AFAADF720A35D05C0F70D3461ECB11FCB919B38B85BE91
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
95837df8829d551c99eb0eb84e8d5fed
.Net Resources
payload.zpk
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0007
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2img 1
Name Value
Module Name
Setup.exe
Full Name
Setup.exe
EntryPoint
System.Int32 ZhaoFiscalNavSetup.Program::Main(System.String[])
Scope Name
Setup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Setup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
213
Main Method
System.Int32 ZhaoFiscalNavSetup.Program::Main(System.String[])
Main IL Instruction Count
171
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldnull <null>
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
ldnull <null>
stloc.s V_4
ldarg.0 <null>
brfalse IL_00B0: ldloc.1
ldc.i4.0 <null>
stloc.s V_5
br IL_00A6: ldloc.s V_5
ldarg.0 <null>
ldloc.s V_5
ldelem.ref <null>
stloc.s V_6
ldloc.s V_6
ldstr /uninstall
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brtrue.s IL_003D: ldc.i4.1
ldloc.s V_6
ldstr /u
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brfalse.s IL_0041: ldloc.s V_6
ldc.i4.1 <null>
stloc.0 <null>
br.s IL_00A0: ldloc.s V_5
ldloc.s V_6
ldstr --selftest
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0053: ldloc.s V_6
ldc.i4.1 <null>
stloc.1 <null>
br.s IL_00A0: ldloc.s V_5
ldloc.s V_6
ldstr --shot
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0076: ldloc.2
ldloc.s V_5
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_0076: ldloc.2
ldc.i4.1 <null>
stloc.3 <null>
ldarg.0 <null>
ldloc.s V_5
ldc.i4.1 <null>
add <null>
ldelem.ref <null>
stloc.s V_4
br.s IL_00A0: ldloc.s V_5
ldloc.2 <null>
brtrue.s IL_00A0: ldloc.s V_5
ldloc.s V_6
ldstr /D=
callvirt System.Boolean System.String::StartsWith(System.String)
brfalse.s IL_00A0: ldloc.s V_5
ldloc.s V_6
ldc.i4.3 <null>
callvirt System.String System.String::Substring(System.Int32)
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0019: ldarg.0
ldloc.1 <null>
brfalse.s IL_00B9: ldloc.3
call System.Int32 ZhaoFiscalNavSetup.Program::SilentSelfTest()
ret <null>
ldloc.3 <null>
brfalse.s IL_00CA: nop
newobj System.Void System.Windows.Application::.ctor()
pop <null>
ldloc.s V_4
call System.Int32 ZhaoFiscalNavSetup.Program::ShotOffscreen(System.String)
ret <null>
nop <null>
newobj System.Void System.Windows.Application::.ctor()
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Windows.Application::set_ShutdownMode(System.Windows.ShutdownMode)
stloc.s V_7
ldloc.s V_7
ldsfld System.Windows.Threading.DispatcherUnhandledExceptionEventHandler ZhaoFiscalNavSetup.Program/<>c::<>9__0_0
dup <null>
brtrue.s IL_00FA: callvirt System.Void System.Windows.Application::add_DispatcherUnhandledException(System.Windows.Threading.DispatcherUnhandledExceptionEventHandler)
pop <null>
ldsfld ZhaoFiscalNavSetup.Program/<>c ZhaoFiscalNavSetup.Program/<>c::<>9
ldftn System.Void ZhaoFiscalNavSetup.Program/<>c::<Main>b__0_0(System.Object,System.Windows.Threading.DispatcherUnhandledExceptionEventArgs)
newobj System.Void System.Windows.Threading.DispatcherUnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Windows.Threading.DispatcherUnhandledExceptionEventHandler ZhaoFiscalNavSetup.Program/<>c::<>9__0_0
callvirt System.Void System.Windows.Application::add_DispatcherUnhandledException(System.Windows.Threading.DispatcherUnhandledExceptionEventHandler)
ldloc.0 <null>
brfalse.s IL_0111: ldloc.s V_7
ldloc.s V_7
newobj System.Void ZhaoFiscalNavSetup.UninstallWindow::.ctor()
callvirt System.Int32 System.Windows.Application::Run(System.Windows.Window)
pop <null>
br.s IL_011E: ldc.i4.0
ldloc.s V_7
newobj System.Void ZhaoFiscalNavSetup.SetupWindow::.ctor()
callvirt System.Int32 System.Windows.Application::Run(System.Windows.Window)
pop <null>
ldc.i4.0 <null>
stloc.s V_8
leave.s IL_0184: ldloc.s V_8
stloc.s V_9
ldc.i4.6 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 运行失败：
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.s V_9
callvirt System.Type System.Exception::GetType()
callvirt System.String System.Reflection.MemberInfo::get_Name()
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 

stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldloc.s V_9
callvirt System.String System.Exception::get_Message()
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr 

位置：

stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldloc.s V_9
callvirt System.String System.Exception::get_StackTrace()
ldc.i4.8 <null>
call System.String ZhaoFiscalNavSetup.Program::FirstStackLines(System.String,System.Int32)
stelem.ref <null>
call System.String System.String::Concat(System.String[])
ldstr 赵师傅财会网址导航
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.MessageBoxResult System.Windows.MessageBox::Show(System.String,System.String,System.Windows.MessageBoxButton,System.Windows.MessageBoxImage)
pop <null>
ldc.i4.1 <null>
stloc.s V_8
leave.s IL_0184: ldloc.s V_8
ldloc.s V_8
ret <null>
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\Users\Administrator\WorkBuddy\2026-09-29-08-15-14\inst_decomp\obj\Release\net40\Setup.pdb
Module Name
Setup.exe
Full Name
Setup.exe
EntryPoint
System.Int32 ZhaoFiscalNavSetup.Program::Main(System.String[])
Scope Name
Setup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Setup
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
213
Main Method
System.Int32 ZhaoFiscalNavSetup.Program::Main(System.String[])
Main IL Instruction Count
171
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldnull <null>
stloc.2 <null>
ldc.i4.0 <null>
stloc.3 <null>
ldnull <null>
stloc.s V_4
ldarg.0 <null>
brfalse IL_00B0: ldloc.1
ldc.i4.0 <null>
stloc.s V_5
br IL_00A6: ldloc.s V_5
ldarg.0 <null>
ldloc.s V_5
ldelem.ref <null>
stloc.s V_6
ldloc.s V_6
ldstr /uninstall
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brtrue.s IL_003D: ldc.i4.1
ldloc.s V_6
ldstr /u
ldc.i4.5 <null>
call System.Boolean System.String::Equals(System.String,System.String,System.StringComparison)
brfalse.s IL_0041: ldloc.s V_6
ldc.i4.1 <null>
stloc.0 <null>
br.s IL_00A0: ldloc.s V_5
ldloc.s V_6
ldstr --selftest
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0053: ldloc.s V_6
ldc.i4.1 <null>
stloc.1 <null>
br.s IL_00A0: ldloc.s V_5
ldloc.s V_6
ldstr --shot
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0076: ldloc.2
ldloc.s V_5
ldc.i4.1 <null>
add <null>
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
bge.s IL_0076: ldloc.2
ldc.i4.1 <null>
stloc.3 <null>
ldarg.0 <null>
ldloc.s V_5
ldc.i4.1 <null>
add <null>
ldelem.ref <null>
stloc.s V_4
br.s IL_00A0: ldloc.s V_5
ldloc.2 <null>
brtrue.s IL_00A0: ldloc.s V_5
ldloc.s V_6
ldstr /D=
callvirt System.Boolean System.String::StartsWith(System.String)
brfalse.s IL_00A0: ldloc.s V_5
ldloc.s V_6
ldc.i4.3 <null>
callvirt System.String System.String::Substring(System.Int32)
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
ldloc.s V_5
ldc.i4.1 <null>
add <null>
stloc.s V_5
ldloc.s V_5
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0019: ldarg.0
ldloc.1 <null>
brfalse.s IL_00B9: ldloc.3
call System.Int32 ZhaoFiscalNavSetup.Program::SilentSelfTest()
ret <null>
ldloc.3 <null>
brfalse.s IL_00CA: nop
newobj System.Void System.Windows.Application::.ctor()
pop <null>
ldloc.s V_4
call System.Int32 ZhaoFiscalNavSetup.Program::ShotOffscreen(System.String)
ret <null>
nop <null>
newobj System.Void System.Windows.Application::.ctor()
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Windows.Application::set_ShutdownMode(System.Windows.ShutdownMode)
stloc.s V_7
ldloc.s V_7
ldsfld System.Windows.Threading.DispatcherUnhandledExceptionEventHandler ZhaoFiscalNavSetup.Program/<>c::<>9__0_0
dup <null>
brtrue.s IL_00FA: callvirt System.Void System.Windows.Application::add_DispatcherUnhandledException(System.Windows.Threading.DispatcherUnhandledExceptionEventHandler)
pop <null>
ldsfld ZhaoFiscalNavSetup.Program/<>c ZhaoFiscalNavSetup.Program/<>c::<>9
ldftn System.Void ZhaoFiscalNavSetup.Program/<>c::<Main>b__0_0(System.Object,System.Windows.Threading.DispatcherUnhandledExceptionEventArgs)
newobj System.Void System.Windows.Threading.DispatcherUnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Windows.Threading.DispatcherUnhandledExceptionEventHandler ZhaoFiscalNavSetup.Program/<>c::<>9__0_0
callvirt System.Void System.Windows.Application::add_DispatcherUnhandledException(System.Windows.Threading.DispatcherUnhandledExceptionEventHandler)
ldloc.0 <null>
brfalse.s IL_0111: ldloc.s V_7
ldloc.s V_7
newobj System.Void ZhaoFiscalNavSetup.UninstallWindow::.ctor()
callvirt System.Int32 System.Windows.Application::Run(System.Windows.Window)
pop <null>
br.s IL_011E: ldc.i4.0
ldloc.s V_7
newobj System.Void ZhaoFiscalNavSetup.SetupWindow::.ctor()
callvirt System.Int32 System.Windows.Application::Run(System.Windows.Window)
pop <null>
ldc.i4.0 <null>
stloc.s V_8
leave.s IL_0184: ldloc.s V_8
stloc.s V_9
ldc.i4.6 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 运行失败：
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.s V_9
callvirt System.Type System.Exception::GetType()
callvirt System.String System.Reflection.MemberInfo::get_Name()
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr 

stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldloc.s V_9
callvirt System.String System.Exception::get_Message()
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr 

位置：

stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldloc.s V_9
callvirt System.String System.Exception::get_StackTrace()
ldc.i4.8 <null>
call System.String ZhaoFiscalNavSetup.Program::FirstStackLines(System.String,System.Int32)
stelem.ref <null>
call System.String System.String::Concat(System.String[])
ldstr 赵师傅财会网址导航
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.MessageBoxResult System.Windows.MessageBox::Show(System.String,System.String,System.Windows.MessageBoxButton,System.Windows.MessageBoxImage)
pop <null>
ldc.i4.1 <null>
stloc.s V_8
leave.s IL_0184: ldloc.s V_8
ldloc.s V_8
ret <null>
95837df8829d551c99eb0eb84e8d5fed
.Net Resources
payload.zpk
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0-preview.png
ID:0002
ID:0
ID:0-preview.png
ID:0003
ID:0
ID:0004
ID:0
ID:0-preview.png
ID:0005
ID:0
ID:0-preview.png
ID:0006
ID:0
ID:0007
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙