Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 9b01c6e935c70a1a330c241f6bcce45b
|
| Sha1 | 6f4673a60fb235a2d2033a876ce6086b9e302742
|
| Sha256 | 6115cb9c24482cc35f770ece1e08ae4014341d2242a30bf262d2fbff1fc578a1
|
| Sha384 | 188cef7ea6f20d7a36e5ec7e2a1e9d27b7318688ea9c8e3aa15f34893c49821385dddc463e0dd8f115205020027846ab
|
| Sha512 | fc6449a5b3e6750ce7ab55a567c274b1cafa8b28547658fab1e8f9fc5079b1ef3c0a0028abba51850de9e825df45dba216e90ddb06e3b9f6afaf4c04e3e72e9f
|
| SSDeep | 768:fujYG1TUET1/WUT1V9mo2qzro+I/JtByhwPISajb5gX3i86SP5FVtjU0DPiBDZ8I:fujYG1TU0r2woL/JCS2bWXS8N5ftI0od
|
| TLSH | DA232A003BE8C12BF6BE4FB86CF26145867AF2637603D54A1C8455D71A23FC58A52AFD
|
PeID
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | OVRCRHl3TjlWU2habGgzbG8zZ0s3TDlrb29Ick1sMU4= |
| Pastebin | - |
| Certificate | MIIE5DCCAsygAwIBAgIQAOc250/jBXH7PusRfV4KKzANBgkqhkiG9w0BAQ0FADATMREwDwYDVQQDDAhBc3luY1JBVDAgFw0yNTEyMTQxNTM0MjFaGA85OTk5MTIzMTIzNTk1OVowEzERMA8GA1UEAwwIQXN5bmNSQVQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC3hbrOJGE/Ncxr2hD4zwR5WwrlT40PQHZSYRdpnqR2/7/cw8e4m6IS/kPj2TSnF3yYhOkR08loqxZDE8g9vaF8pLg+pyFwXjs8+Tjb6rGW2uRjpX92Pyhjh8LBpkQ8ZVWmHgnrg6rG0F60rBKz4ew8WXbKcUo3Q+oz/td4gqFQDlhw1kKoLeUmr+9QKyInnm/2UOlpU4DY3Vpgw9RKXcNYyUemiFybYORXhX5itphsOy7VNGbmDGcokwXemsR8Dxtx/fxqxdTSIJt2+bnMbPPCL05l7xkOyVQMnLIGcsDBoQXotDfeKlpluqyut2YjHGluh/uIUb/c37ZW17RCI+CtrNRGQjB8ErSBSWGtlxKh6a7DtgUD3Ixy87tueEKyeiHIjKNGM2DeeYpPp94vQ1L9omOqV6XBPRIlE8dZG2wIEh9U7nAbyILI5CsDNK3ZKIo9rFYVDCqRpjSpDW6EE3X+megquYTgBmYwz0wc3Nm7DyXpYWw9M6ubgwJOY4IuNEV3JNHsxHdX457CHJ1B3pvyDSRoD4GGQWzFrod/rSdbc6h0Znk520NtZ7qkP+AA3KumXQoREuIENMqFyEeb4jAL/o+NLZJ2s25y37AhIULalSXUWRpFFN4afCogVBX2Lq5fTnARunBy+iM0cTCITKg1PzdagOzpIYZ1301QYewT1wIDAQABozIwMDAdBgNVHQ4EFgQUwIO7jdsbGYhuyUURLCnL8u8aCiswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAPXoIXK5CvTxz3g1MuFheFwcA6CSzDoKFPW4zVdDtZTjVtAd9wnPaH7HpQXLwpPUb3WM8iEX/zgdze8q36+IWIv7LOpMKCDr3+dyeR5dyuSF0HNggANxw64nb8ggfquNYXofQDR8B2fp/c1iXT3NQcZ4CsM37nMLyvKC7n2hWWArrhshFMKZ/AnT+3r996JaT0BopXowQsSIzBNFez3KrBQ2fKj8HuJPZ3VJKnAH+sUBvTup/5qk5+aijalDJU/APvTFLKBom0ifAqZoYgwI/B9H0mEO7qYXokEVtEPX9LS41ALFQl/naWldHpnhmMgpN3Y30HgI+CJIyUxR9k7f0AIYXdGHdXeqc+MhZa25H+ESwSwI7N7FMyxkdzkikWAXIYoKK3o1mdb9+0s1/CstbjWs8QAzUYmZTb1vUAg9tUMhL2LqaWlpnzOOXdQUhRqk1JuYoBAvlesZ5qsgrZxzaQtDZ7hq6oWsqdDScXGUt7SrPvtXFjFXHjdCrfVHISH0RcEsmaSSV6+cjvcSZe3gb/t5lfjmaDMgWvlIHtKONjneUbCKzoYY2OHU/gy4DkWdt4q8SX1a0jLYXkYr7KPKFaDR/oc85PRUsCKg/vhCtRIbTAJ1CCf0RCk61CuONfs18uIvo08JwHJgWVwN/1lq94mdsEzo1SPA5 |
| ServerSignature | OUSvcxhk/7J9dm3M19qnTziItkx0rn2aqV4x0v5dCc7BUxERQmvSdS8d9XCo0WPVBLdJ6ABc8yTPQGhw+g9v1jPOue1loKdDNhXX6Ka7Mr0MjhtF85XDPPN8EpwTn/bDbQ+Kh7q/T8i5nGUW4L7aQ+fx+Hyp67/8HJvAIbpOskMRzwtmAg4ILZTXcDAh9/cw4s/0lLfVbP/qtZuHvOyppKRxR5yTi3xoMb4WIevi8K+l4pg9cMRRmqzHdFW7ZvSwdbxlmqYrMZF3eHuYECS7YQSMI8Y8bTWVzmXYglcDC9jEX/1NSKBIUgqVuGOtLblfQLTrEldjqJDFkcDHPz4drRmxMdfLsFf0YJcuSfwQvj+TY+cNn32IgFHCLmpKqV3XscSO3d0B2HRzPDE+B+DKlKNjG56aiO3ekXuY5WAr1pX3O0unc4nfYOOYj1/srk0eq6hmAONwKkq4HgJgy02z+mNll1uF4RE6fCmMGpepcWtD7zzQEOzqPxDpUjQKqo+POIQMK5tIfX00qrOF4aPgJ06uU1JzXMdxF38+xN9pZ4051Ih6+Dn3FSQueCaqZrBzF9nwAAb4BccivPBMwDjOYUbUNMwOPiSHMvpj5UWkCXBrfRgTbW7xxzHmKJQ5mugBykBxzs8KIKgdV2gfEeyfJ/Udp8gCHwMB |
| Install | true |
| BDOS | false |
| Anti-VM | false |
| Install File | CloudflareWARP.exe |
| Install-Folder | %AppData% |
| Ports | 80,443,5555,6606 |
| Mutex | qhB6lCyleULS |
| Version | 0.5.8 |
| Delay | 3 |
| Group | Default |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | Cloudflare WARP.exe |
| Full Name | Cloudflare WARP.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | Cloudflare WARP.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Cloudflare WARP |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 120 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 51 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop |
| Module Name | Cloudflare WARP.exe |
| Full Name | Cloudflare WARP.exe |
| EntryPoint | System.Void Client.Program::Main() |
| Scope Name | Cloudflare WARP.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | Cloudflare WARP |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | .NETFramework,Version=v4.0,Profile=Client |
| Total Strings | 120 |
| Main Method | System.Void Client.Program::Main() |
| Main IL Instruction Count | 51 |
| Main IL | ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String Client.Settings::Delay call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean Client.Settings::InitializeSettings() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean Client.Helper.MutexControl::CreateMutex() brtrue IL_0043: ldsfld System.String Client.Settings::Anti ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String Client.Settings::Anti call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String Client.Settings::Install call System.Void Client.Helper.Anti_Analysis::RunAntiAnalysis() ldsfld System.String Client.Settings::Install call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String Client.Settings::BDOS call System.Void Client.Install.NormalStartup::Install() ldsfld System.String Client.Settings::BDOS call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Boolean Client.Helper.Methods::IsAdmin() brfalse IL_0089: call System.Void Client.Helper.Methods::PreventSleep() call System.Void Client.Helper.ProcessCritical::Set() call System.Void Client.Helper.Methods::PreventSleep() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean Client.Connection.ClientSocket::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void Client.Connection.ClientSocket::Reconnect() call System.Void Client.Connection.ClientSocket::InitializeClient() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop |
|
Name0 | Value |
|---|---|
| Key (AES_256) | OVRCRHl3TjlWU2habGgzbG8zZ0s3TDlrb29Ick1sMU4= |
| Ports | 80 |
| Ports | 443 |
| Ports | 5555 |
| Ports | 6606 |
| Mutex | qhB6lCyleULS |
|
Config. Field0 | Value |
|---|---|
| Key (AES_256) | OVRCRHl3TjlWU2habGgzbG8zZ0s3TDlrb29Ick1sMU4= |
| Pastebin | - |
| Certificate | MIIE5DCCAsygAwIBAgIQAOc250/jBXH7PusRfV4KKzANBgkqhkiG9w0BAQ0FADATMREwDwYDVQQDDAhBc3luY1JBVDAgFw0yNTEyMTQxNTM0MjFaGA85OTk5MTIzMTIzNTk1OVowEzERMA8GA1UEAwwIQXN5bmNSQVQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC3hbrOJGE/Ncxr2hD4zwR5WwrlT40PQHZSYRdpnqR2/7/cw8e4m6IS/kPj2TSnF3yYhOkR08loqxZDE8g9vaF8pLg+pyFwXjs8+Tjb6rGW2uRjpX92Pyhjh8LBpkQ8ZVWmHgnrg6rG0F60rBKz4ew8WXbKcUo3Q+oz/td4gqFQDlhw1kKoLeUmr+9QKyInnm/2UOlpU4DY3Vpgw9RKXcNYyUemiFybYORXhX5itphsOy7VNGbmDGcokwXemsR8Dxtx/fxqxdTSIJt2+bnMbPPCL05l7xkOyVQMnLIGcsDBoQXotDfeKlpluqyut2YjHGluh/uIUb/c37ZW17RCI+CtrNRGQjB8ErSBSWGtlxKh6a7DtgUD3Ixy87tueEKyeiHIjKNGM2DeeYpPp94vQ1L9omOqV6XBPRIlE8dZG2wIEh9U7nAbyILI5CsDNK3ZKIo9rFYVDCqRpjSpDW6EE3X+megquYTgBmYwz0wc3Nm7DyXpYWw9M6ubgwJOY4IuNEV3JNHsxHdX457CHJ1B3pvyDSRoD4GGQWzFrod/rSdbc6h0Znk520NtZ7qkP+AA3KumXQoREuIENMqFyEeb4jAL/o+NLZJ2s25y37AhIULalSXUWRpFFN4afCogVBX2Lq5fTnARunBy+iM0cTCITKg1PzdagOzpIYZ1301QYewT1wIDAQABozIwMDAdBgNVHQ4EFgQUwIO7jdsbGYhuyUURLCnL8u8aCiswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOCAgEAPXoIXK5CvTxz3g1MuFheFwcA6CSzDoKFPW4zVdDtZTjVtAd9wnPaH7HpQXLwpPUb3WM8iEX/zgdze8q36+IWIv7LOpMKCDr3+dyeR5dyuSF0HNggANxw64nb8ggfquNYXofQDR8B2fp/c1iXT3NQcZ4CsM37nMLyvKC7n2hWWArrhshFMKZ/AnT+3r996JaT0BopXowQsSIzBNFez3KrBQ2fKj8HuJPZ3VJKnAH+sUBvTup/5qk5+aijalDJU/APvTFLKBom0ifAqZoYgwI/B9H0mEO7qYXokEVtEPX9LS41ALFQl/naWldHpnhmMgpN3Y30HgI+CJIyUxR9k7f0AIYXdGHdXeqc+MhZa25H+ESwSwI7N7FMyxkdzkikWAXIYoKK3o1mdb9+0s1/CstbjWs8QAzUYmZTb1vUAg9tUMhL2LqaWlpnzOOXdQUhRqk1JuYoBAvlesZ5qsgrZxzaQtDZ7hq6oWsqdDScXGUt7SrPvtXFjFXHjdCrfVHISH0RcEsmaSSV6+cjvcSZe3gb/t5lfjmaDMgWvlIHtKONjneUbCKzoYY2OHU/gy4DkWdt4q8SX1a0jLYXkYr7KPKFaDR/oc85PRUsCKg/vhCtRIbTAJ1CCf0RCk61CuONfs18uIvo08JwHJgWVwN/1lq94mdsEzo1SPA5 |
| ServerSignature | OUSvcxhk/7J9dm3M19qnTziItkx0rn2aqV4x0v5dCc7BUxERQmvSdS8d9XCo0WPVBLdJ6ABc8yTPQGhw+g9v1jPOue1loKdDNhXX6Ka7Mr0MjhtF85XDPPN8EpwTn/bDbQ+Kh7q/T8i5nGUW4L7aQ+fx+Hyp67/8HJvAIbpOskMRzwtmAg4ILZTXcDAh9/cw4s/0lLfVbP/qtZuHvOyppKRxR5yTi3xoMb4WIevi8K+l4pg9cMRRmqzHdFW7ZvSwdbxlmqYrMZF3eHuYECS7YQSMI8Y8bTWVzmXYglcDC9jEX/1NSKBIUgqVuGOtLblfQLTrEldjqJDFkcDHPz4drRmxMdfLsFf0YJcuSfwQvj+TY+cNn32IgFHCLmpKqV3XscSO3d0B2HRzPDE+B+DKlKNjG56aiO3ekXuY5WAr1pX3O0unc4nfYOOYj1/srk0eq6hmAONwKkq4HgJgy02z+mNll1uF4RE6fCmMGpepcWtD7zzQEOzqPxDpUjQKqo+POIQMK5tIfX00qrOF4aPgJ06uU1JzXMdxF38+xN9pZ4051Ih6+Dn3FSQueCaqZrBzF9nwAAb4BccivPBMwDjOYUbUNMwOPiSHMvpj5UWkCXBrfRgTbW7xxzHmKJQ5mugBykBxzs8KIKgdV2gfEeyfJ/Udp8gCHwMB |
| Install | true |
| BDOS | false |
| Anti-VM | false |
| Install File | CloudflareWARP.exe |
| Install-Folder | %AppData% |
| Ports | 80,443,5555,6606 |
| Mutex | qhB6lCyleULS |
| Version | 0.5.8 |
| Delay | 3 |
| Group | Default |
|
Name0 | Value | Location |
|---|---|---|
| Key (AES_256) | OVRCRHl3TjlWU2habGgzbG8zZ0s3TDlrb29Ick1sMU4= Malicious |
9b01c6e935c70a1a330c241f6bcce45b |
| Ports | 80 Malicious |
9b01c6e935c70a1a330c241f6bcce45b |
| Ports | 443 Malicious |
9b01c6e935c70a1a330c241f6bcce45b |
| Ports | 5555 Malicious |
9b01c6e935c70a1a330c241f6bcce45b |
| Ports | 6606 Malicious |
9b01c6e935c70a1a330c241f6bcce45b |
| Mutex | qhB6lCyleULS Malicious |
9b01c6e935c70a1a330c241f6bcce45b |