Suspicious
Suspect

acd23d42f3df5b6b8737536e40479a68

Share on LinkedIn
Print
PE Executable
MD5: acd23d42f3df5b6b8737536e40479a68
Size: 5.06 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 acd23d42f3df5b6b8737536e40479a68
Sha1 a7f91cd15d95c7f6c54307d315e88dfdf8af5416
Sha256 57d36e6e837bd2980d23bbb8cf872953c9e791396c30b8fbc25f7794326fc8d4
Sha384 6075ee1637eedbc0a204b921178cc05989667bfc147deb313a5a07422a34390a22e5761945f920f6e47dc2d8beda9bf9
Sha512 68aa8ce4c95fc07c6c68c3ed3d838dba329306649b380a54b278f696db6944d624b370518ba3eb45abf571ce28bdce3d07d774a58f312ef56f303a2156d8a09e
SSDeep 98304:WAWJliJS1vlo4PbLhldQz0TiG+Kn+YHVPu4FDZtfl93T1Kn5GrdbHEMvg:WAWJliJS1vm4PzRmG+K+aPuiDZFT1Kns
TLSH 1A361212B7F7D076CD1212318A196FB581FAD7290B3048C777848E6E3B34DD59A3AA1B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamUPolyX 0.3 -> delikon
acd23d42f3df5b6b8737536e40479a68
.Net Resources
XMAING.Launcher.xaml
XMAING.DefaultConfig.json
XMAING.Assets.launcher-background.jpg
XMAING.Assets.launcher.ico
XMAING.Assets.news-banner.jpg
XMAING.Assets.news-banner.jpg.exif
XMAING.Assets.news-banner.jpg-preview.png
XMAING.Assets.news-card.jpg
XMAING.Assets.news-card.jpg-preview.png
XMAING.Assets.promo-2x.jpg
XMAING.Assets.promo-2x.jpg-preview.png
XMAING.Assets.promo-extra.jpg
XMAING.Assets.promo-extra.jpg-preview.png
XMAING.Assets.rp-keyart.png
XMAING.Assets.rp-keyart.png-preview.png
XMAING.Assets.xmaing-logo.png
XMAING.Assets.xmaing-logo.png-preview.png
XMAING.7za.exe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.sxdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
RT_MANIFEST
ID:0001
ID:1033
7z-stream @ 0x000C9950.7z
acd23d42f3df5b6b8737536e40479a68
0x00140128.svg
0x00140128.svg-preview.jpg
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
7z-stream @ 0x004B5DEC.7z
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 2secondary ignored: 5
bin 3img 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:exe>arc:7zsfx
Shape pe:exe>pe:exe>arc:7zsfx
3 nodes
Path pe:exe>arc:7zsfx
Shape pe:exe>arc:7zsfx
2 nodes
Name Value
Module Name
AmazingLauncher.exe
Full Name
AmazingLauncher.exe
EntryPoint
System.Void AmazingLauncherApp.Program::Main()
Scope Name
AmazingLauncher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AmazingLauncher
Assembly Version
1.4.10.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
437
Main Method
System.Void AmazingLauncherApp.Program::Main()
Main IL Instruction Count
67
Main IL 
newobj System.Void AmazingLauncherApp.Program/<>c__DisplayClass4::.ctor()
stloc.3 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler AmazingLauncherApp.Program::CS$<>9__CachedAnonymousMethodDelegate3
brtrue.s IL_0023: ldsfld System.UnhandledExceptionEventHandler AmazingLauncherApp.Program::CS$<>9__CachedAnonymousMethodDelegate3
ldnull <null>
ldftn System.Void AmazingLauncherApp.Program::<Main>b__0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
stsfld System.UnhandledExceptionEventHandler AmazingLauncherApp.Program::CS$<>9__CachedAnonymousMethodDelegate3
ldsfld System.UnhandledExceptionEventHandler AmazingLauncherApp.Program::CS$<>9__CachedAnonymousMethodDelegate3
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
newobj System.Void System.Windows.Application::.ctor()
stfld System.Windows.Application AmazingLauncherApp.Program/<>c__DisplayClass4::app
ldloc.3 <null>
ldfld System.Windows.Application AmazingLauncherApp.Program/<>c__DisplayClass4::app
ldc.i4.2 <null>
callvirt System.Void System.Windows.Application::set_ShutdownMode(System.Windows.ShutdownMode)
newobj System.Void AmazingLauncherApp.Program/<>c__DisplayClass6::.ctor()
stloc.1 <null>
ldloc.1 <null>
ldloc.3 <null>
stfld AmazingLauncherApp.Program/<>c__DisplayClass4 AmazingLauncherApp.Program/<>c__DisplayClass6::CS$<>8__locals5
ldloc.1 <null>
newobj System.Void AmazingLauncherApp.LauncherWindow::.ctor()
stfld AmazingLauncherApp.LauncherWindow AmazingLauncherApp.Program/<>c__DisplayClass6::launcher
call System.String AmazingLauncherApp.Program::get_BasePath()
newobj System.Void AmazingLauncherApp.StartupSplash::.ctor(System.String)
stloc.0 <null>
ldloc.1 <null>
ldc.i4.0 <null>
stfld System.Boolean AmazingLauncherApp.Program/<>c__DisplayClass6::launcherShown
ldloc.0 <null>
ldloc.1 <null>
ldftn System.Void AmazingLauncherApp.Program/<>c__DisplayClass6::<Main>b__1(System.Object,System.EventArgs)
newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void AmazingLauncherApp.StartupSplash::add_Completed(System.EventHandler)
ldloc.0 <null>
ldloc.1 <null>
ldftn System.Void AmazingLauncherApp.Program/<>c__DisplayClass6::<Main>b__2(System.Object,System.EventArgs)
newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Windows.Window::add_Closed(System.EventHandler)
ldloc.3 <null>
ldfld System.Windows.Application AmazingLauncherApp.Program/<>c__DisplayClass4::app
ldloc.0 <null>
callvirt System.Void System.Windows.Application::set_MainWindow(System.Windows.Window)
ldloc.0 <null>
callvirt System.Void System.Windows.Window::Show()
ldloc.3 <null>
ldfld System.Windows.Application AmazingLauncherApp.Program/<>c__DisplayClass4::app
callvirt System.Int32 System.Windows.Application::Run()
pop <null>
leave.s IL_00D9: ret
stloc.2 <null>
ldstr Не удалось открыть лаунчер.


ldloc.2 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr XMAZING
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.MessageBoxResult System.Windows.MessageBox::Show(System.String,System.String,System.Windows.MessageBoxButton,System.Windows.MessageBoxImage)
pop <null>
ldloc.2 <null>
call System.Void AmazingLauncherApp.Program::WriteError(System.Object)
leave.s IL_00D9: ret
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
AmazingLauncher.exe
Full Name
AmazingLauncher.exe
EntryPoint
System.Void AmazingLauncherApp.Program::Main()
Scope Name
AmazingLauncher.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
AmazingLauncher
Assembly Version
1.4.10.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
437
Main Method
System.Void AmazingLauncherApp.Program::Main()
Main IL Instruction Count
67
Main IL 
newobj System.Void AmazingLauncherApp.Program/<>c__DisplayClass4::.ctor()
stloc.3 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler AmazingLauncherApp.Program::CS$<>9__CachedAnonymousMethodDelegate3
brtrue.s IL_0023: ldsfld System.UnhandledExceptionEventHandler AmazingLauncherApp.Program::CS$<>9__CachedAnonymousMethodDelegate3
ldnull <null>
ldftn System.Void AmazingLauncherApp.Program::<Main>b__0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
stsfld System.UnhandledExceptionEventHandler AmazingLauncherApp.Program::CS$<>9__CachedAnonymousMethodDelegate3
ldsfld System.UnhandledExceptionEventHandler AmazingLauncherApp.Program::CS$<>9__CachedAnonymousMethodDelegate3
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
newobj System.Void System.Windows.Application::.ctor()
stfld System.Windows.Application AmazingLauncherApp.Program/<>c__DisplayClass4::app
ldloc.3 <null>
ldfld System.Windows.Application AmazingLauncherApp.Program/<>c__DisplayClass4::app
ldc.i4.2 <null>
callvirt System.Void System.Windows.Application::set_ShutdownMode(System.Windows.ShutdownMode)
newobj System.Void AmazingLauncherApp.Program/<>c__DisplayClass6::.ctor()
stloc.1 <null>
ldloc.1 <null>
ldloc.3 <null>
stfld AmazingLauncherApp.Program/<>c__DisplayClass4 AmazingLauncherApp.Program/<>c__DisplayClass6::CS$<>8__locals5
ldloc.1 <null>
newobj System.Void AmazingLauncherApp.LauncherWindow::.ctor()
stfld AmazingLauncherApp.LauncherWindow AmazingLauncherApp.Program/<>c__DisplayClass6::launcher
call System.String AmazingLauncherApp.Program::get_BasePath()
newobj System.Void AmazingLauncherApp.StartupSplash::.ctor(System.String)
stloc.0 <null>
ldloc.1 <null>
ldc.i4.0 <null>
stfld System.Boolean AmazingLauncherApp.Program/<>c__DisplayClass6::launcherShown
ldloc.0 <null>
ldloc.1 <null>
ldftn System.Void AmazingLauncherApp.Program/<>c__DisplayClass6::<Main>b__1(System.Object,System.EventArgs)
newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void AmazingLauncherApp.StartupSplash::add_Completed(System.EventHandler)
ldloc.0 <null>
ldloc.1 <null>
ldftn System.Void AmazingLauncherApp.Program/<>c__DisplayClass6::<Main>b__2(System.Object,System.EventArgs)
newobj System.Void System.EventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Windows.Window::add_Closed(System.EventHandler)
ldloc.3 <null>
ldfld System.Windows.Application AmazingLauncherApp.Program/<>c__DisplayClass4::app
ldloc.0 <null>
callvirt System.Void System.Windows.Application::set_MainWindow(System.Windows.Window)
ldloc.0 <null>
callvirt System.Void System.Windows.Window::Show()
ldloc.3 <null>
ldfld System.Windows.Application AmazingLauncherApp.Program/<>c__DisplayClass4::app
callvirt System.Int32 System.Windows.Application::Run()
pop <null>
leave.s IL_00D9: ret
stloc.2 <null>
ldstr Не удалось открыть лаунчер.


ldloc.2 <null>
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
ldstr XMAZING
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.MessageBoxResult System.Windows.MessageBox::Show(System.String,System.String,System.Windows.MessageBoxButton,System.Windows.MessageBoxImage)
pop <null>
ldloc.2 <null>
call System.Void AmazingLauncherApp.Program::WriteError(System.Object)
leave.s IL_00D9: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙