Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
b65f70b2181be52f792520cf30325763
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key 4wOduOhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 1huhuhuhu
Host 45.1huhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 0huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey Windhuhuhuhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Ofhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::弃ﬧ塲≞歇ᤪꏺ㔕渋ࢊ䓙燀�䊼ﺱ啭ỽ⟠뵟(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 훒㎁⟐諮鼳씧豾礅�᫉灌㟝ჭ湆绬꠯ꝅ︮::률㚯Ϻ겪鍖犡ߋ즿롙랚਻葿꧔⦄?遤˘()
brfalse.s IL_0040: call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::糄杕鐴횹閭毕紗爱䴺ⶦ꿼⮂﫬갽⽐鷱䛰홧Ắ()
call System.Boolean �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::顆䤺⪺켡쀳ክ๲虸텄倬㴘窭㍜룅诵㺤壓()
brfalse.s IL_0040: call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::糄杕鐴횹閭毕紗爱䴺ⶦ꿼⮂﫬갽⽐鷱䛰홧Ắ()
call System.Boolean 텵⁝푲뾈詜ᢞ搮殺Ⓧ봃䦥ㄺ견풼㗽蟮䠷抏襫::get_Exiting()
brtrue.s IL_0040: call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::糄杕鐴횹閭毕紗爱䴺ⶦ꿼⮂﫬갽⽐鷱䛰홧Ắ()
ldsfld 텵⁝푲뾈詜ᢞ搮殺Ⓧ봃䦥ㄺ견풼㗽蟮䠷抏襫 �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::녪䙯扼Ώ덀࡯䬛턞뱦陶�媸㎞釄쎉ꤖឋ
callvirt System.Void 텵⁝푲뾈詜ᢞ搮殺Ⓧ봃䦥ㄺ견풼㗽蟮䠷抏襫::ꕩ⫫鯰蔮驽ậ裑鳿픃㗸ٔ諿傠흣㏦㋱�()
call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::糄杕鐴횹閭毕紗爱䴺ⶦ꿼⮂﫬갽⽐鷱䛰홧Ắ()
call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::誁�Ꮍ蛵ڠ䆞迵ﰠ걿룼奶捋늉姰ꅔᵵᆕ㷁璵()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::弃ﬧ塲≞歇ᤪꏺ㔕渋ࢊ䓙燀�䊼ﺱ啭ỽ⟠뵟(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 훒㎁⟐諮鼳씧豾礅�᫉灌㟝ჭ湆绬꠯ꝅ︮::률㚯Ϻ겪鍖犡ߋ즿롙랚਻葿꧔⦄?遤˘()
brfalse.s IL_0040: call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::糄杕鐴횹閭毕紗爱䴺ⶦ꿼⮂﫬갽⽐鷱䛰홧Ắ()
call System.Boolean �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::顆䤺⪺켡쀳ክ๲虸텄倬㴘窭㍜룅诵㺤壓()
brfalse.s IL_0040: call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::糄杕鐴횹閭毕紗爱䴺ⶦ꿼⮂﫬갽⽐鷱䛰홧Ắ()
call System.Boolean 텵⁝푲뾈詜ᢞ搮殺Ⓧ봃䦥ㄺ견풼㗽蟮䠷抏襫::get_Exiting()
brtrue.s IL_0040: call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::糄杕鐴횹閭毕紗爱䴺ⶦ꿼⮂﫬갽⽐鷱䛰홧Ắ()
ldsfld 텵⁝푲뾈詜ᢞ搮殺Ⓧ봃䦥ㄺ견풼㗽蟮䠷抏襫 �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::녪䙯扼Ώ덀࡯䬛턞뱦陶�媸㎞釄쎉ꤖឋ
callvirt System.Void 텵⁝푲뾈詜ᢞ搮殺Ⓧ봃䦥ㄺ견풼㗽蟮䠷抏襫::ꕩ⫫鯰蔮驽ậ裑鳿픃㗸ٔ諿傠흣㏦㋱�()
call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::糄杕鐴횹閭毕紗爱䴺ⶦ꿼⮂﫬갽⽐鷱䛰홧Ắ()
call System.Void �匇捇㦓ಾ矜⪕بꠇ処몫蠏⊔ᇩ䨮硊�Ꮜ䏩::誁�Ꮍ蛵ڠ䆞迵ﰠ걿룼奶捋늉姰ꅔᵵᆕ㷁璵()
ret <null>
CnC CNCmalicious
45.1huhuhuhuhuhuhu
Port PORTmalicious
1huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙