Suspicious
Suspect

a56c6535190873cb1f01d5e913b1be52

PE Executable
|
MD5: a56c6535190873cb1f01d5e913b1be52
|
Size: 84.99 KB
|
application/x-dosexec

Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
a56c6535190873cb1f01d5e913b1be52
Sha1
01b4d89836ff3fd5f4b7576f5cdbd16d59e64589
Sha256
8691a072f80c86869292458f5322ee6887076f4d8ad552e0e687ab1e23f70df5
Sha384
f77ab385869a8129804d4bdbf411e4e632a59b44c96564140028bae7033c3997ff9cd7d2386ae98d1a8b696c6d6d7247
Sha512
97bdc565fdb955cd5258026aeabb24d2ecfca35dc3e19dedbfc934d5bdeac28385e7d32efc647a53ee08a32648e739f74b1657fca6781d924a04451cd3042252
SSDeep
1536:y5TfEXMU/nfsOtGBwOtjICLfTxm8Oy/g5Uifbwz4pVh:eYXMU/0AGq8MCYyIPfbwz4pz
TLSH
F1836B0EBB51CA58D16D1E7396A390CC81F6E4A774B7FB7B29C869F12C2249CC64BD40

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
File Structure
a56c6535190873cb1f01d5e913b1be52
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Module Name

XWormClient.exe
Full Name

XWormClient.exe
EntryPoint

System.Void Stub.Main::Main()
Scope Name

XWormClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

XWormClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

0
Main Method

System.Void Stub.Main::Main()
Main IL Instruction Count

104
Main IL

ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> ldc.i4 263 ldc.i4 349 call System.Void Stub.Messages::Ⴍ(System.Int32,System.Int32,System.Int32) ldc.i4.3 <null> stloc.s V_4 ldloc.s V_4 switch dnlib.DotNet.Emit.Instruction[] ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 199 ldc.i4 204 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 261 ldc.i4 270 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::Port ldc.i4.5 <null> stloc.s V_4 br.s IL_001D: ldloc.s V_4 ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 603 ldc.i4 592 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4.s 28 ldc.i4.s 23 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::SPL ldc.i4.0 <null> stloc.s V_4 br IL_001D: ldloc.s V_4 ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 451 ldc.i4 456 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4.s 117 ldc.i4.s 126 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::USBNM leave.s IL_011F: ldc.i4.0 dup <null> ldc.i4 601 ldc.i4 637 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Char) stloc.2 <null> ldc.i4.0 <null> ldc.i4 734 ldc.i4 645 call System.Void Stub.Messages::Ⴍ(System.Int32,System.Int32,System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_011F: ldc.i4.0 ldc.i4.0 <null> stloc.s V_6 ldloc.s V_6 switch dnlib.DotNet.Emit.Instruction[] call System.Boolean Ⴈ.Ⴀ::Ⴓ() brtrue.s IL_0155: ldc.i4.1 ldc.i4.3 <null> stloc.s V_6 br.s IL_0122: ldloc.s V_6 ldc.i4.1 <null> br.s IL_0151: stloc.s V_6 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Ⴈ.Ⴀ::Ⴈ() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldc.i4.4 <null> stloc.s V_6 br.s IL_0122: ldloc.s V_6 ldloc.0 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Join() ret <null> ldtoken System.Void Stub.Main::Main() pop <null> ret <null>
Module Name

XWormClient.exe
Full Name

XWormClient.exe
EntryPoint

System.Void Stub.Main::Main()
Scope Name

XWormClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

XWormClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

0
Main Method

System.Void Stub.Main::Main()
Main IL Instruction Count

104
Main IL

ldsfld System.Int32 Settings::Sleep ldc.i4 1000 mul.ovf <null> ldc.i4 263 ldc.i4 349 call System.Void Stub.Messages::Ⴍ(System.Int32,System.Int32,System.Int32) ldc.i4.3 <null> stloc.s V_4 ldloc.s V_4 switch dnlib.DotNet.Emit.Instruction[] ldsfld System.String Settings::Hosts call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 199 ldc.i4 204 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::Hosts ldsfld System.String Settings::Port call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 261 ldc.i4 270 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::Port ldc.i4.5 <null> stloc.s V_4 br.s IL_001D: ldloc.s V_4 ldsfld System.String Settings::KEY call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 603 ldc.i4 592 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::KEY ldsfld System.String Settings::SPL call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4.s 28 ldc.i4.s 23 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::SPL ldc.i4.0 <null> stloc.s V_4 br IL_001D: ldloc.s V_4 ldsfld System.String Settings::Groub call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4 451 ldc.i4 456 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::Groub ldsfld System.String Settings::USBNM call System.Object Stub.AlgorithmAES::Decrypt(System.String) ldc.i4.s 117 ldc.i4.s 126 call System.String Stub.AlgorithmAES::Ⴃ<System.Object>(System.Object,System.Int32,System.Char) stsfld System.String Settings::USBNM leave.s IL_011F: ldc.i4.0 dup <null> ldc.i4 601 ldc.i4 637 call System.Void Stub.Messages::Ⴅ<System.Exception>(System.Exception,System.Int16,System.Char) stloc.2 <null> ldc.i4.0 <null> ldc.i4 734 ldc.i4 645 call System.Void Stub.Messages::Ⴍ(System.Int32,System.Int32,System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_011F: ldc.i4.0 ldc.i4.0 <null> stloc.s V_6 ldloc.s V_6 switch dnlib.DotNet.Emit.Instruction[] call System.Boolean Ⴈ.Ⴀ::Ⴓ() brtrue.s IL_0155: ldc.i4.1 ldc.i4.3 <null> stloc.s V_6 br.s IL_0122: ldloc.s V_6 ldc.i4.1 <null> br.s IL_0151: stloc.s V_6 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Ⴈ.Ⴀ::Ⴈ() ldnull <null> ldftn System.Void Stub.Main::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.0 <null> ldnull <null> ldftn System.Void Stub.Main::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldc.i4.4 <null> stloc.s V_6 br.s IL_0122: ldloc.s V_6 ldloc.0 <null> castclass System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Start() ldloc.1 <null> isinst System.Threading.Thread callvirt System.Void System.Threading.Thread::Join() ret <null> ldtoken System.Void Stub.Main::Main() pop <null> ret <null>
a56c6535190873cb1f01d5e913b1be52 (84.99 KB)
File Structure
a56c6535190873cb1f01d5e913b1be52
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙