Suspicious
Suspect

PE Executable
MD5: c1bc86589d12eddcb7c1e9b74031a223
Size: 2.76 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 c1bc86589d12eddcb7c1e9b74031a223
Sha1 1b49da57973fbeb1dd478021dfdb33b3e602d603
Sha256 912c36f958867dfdce9b197f2a4efaaf651a2c1fdd0e77835add985e30513d1a
Sha384 72d5e70abde4f2cb763d864e633cf8e6329777c47b126de9d896120fa119053975b7ad527a4887ede4251832f33c5394
Sha512 5e70347a3886b1f4d13ca20c77ddc9e95aefe429dea566665dda65914bde5db406ba420d6d1d2296aa65412be0b4162d2786ce8a6afe905d13a858080b129517
SSDeep 49152:NnoDE9dM5zQE4GZJuy/R5uQj4mIxlwK1C25DaWWFkI2nRcbEEjCL3khxamj:aV5UQJb5uQvYlNR/WG4bxyS8
TLSH 72D5332650C3C21CC21711B5AEF134290C95E793A6BEFE3C4C9DA42AD93AE7895167E3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
c1bc86589d12eddcb7c1e9b74031a223
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
euTz8nVTC5G6.bz9H6.qNLzh
euTz8nVTC5G6.yF32sU.dwVQW
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\10\boot\Downloader_win\DownloaderApp\DownloaderApp\obj\Release\DownloaderApp.pdb
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
43
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
95
Main IL 
call System.Boolean A.B::C()
brtrue.s IL_0015: call System.Boolean System.Environment::get_UserInteractive()
call System.Void A.B::D()
leave.s IL_0014: ret
pop <null>
leave IL_0121: ret
ret <null>
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_0027: ldstr "svchosthelper.exe"
newobj System.Void A.E::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
ldstr svchosthelper.exe
stloc.0 <null>
ldstr systemhelper.exe
stloc.1 <null>
ldstr WindowsLogsHelper
stloc.2 <null>
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.0 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.1 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_4
ldstr euTz8nVTC5G6.bz9H6.qNLzh
ldloc.3 <null>
call System.Void A.B::F(System.String,System.String)
ldstr euTz8nVTC5G6.yF32sU.dwVQW
ldloc.s V_4
call System.Void A.B::F(System.String,System.String)
ldloc.3 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_4
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.3 <null>
call System.Void A.B::G(System.String)
ldloc.s V_4
call System.Void A.B::G(System.String)
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void A.B::H(System.String)
ldloc.3 <null>
ldloc.2 <null>
call System.Void A.B::I(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c start "" "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c start "" "
ldloc.s V_4
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0121: ret
pop <null>
leave.s IL_0121: ret
ret <null>
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
43
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
95
Main IL 
call System.Boolean A.B::C()
brtrue.s IL_0015: call System.Boolean System.Environment::get_UserInteractive()
call System.Void A.B::D()
leave.s IL_0014: ret
pop <null>
leave IL_0121: ret
ret <null>
call System.Boolean System.Environment::get_UserInteractive()
brtrue.s IL_0027: ldstr "svchosthelper.exe"
newobj System.Void A.E::.ctor()
call System.Void System.ServiceProcess.ServiceBase::Run(System.ServiceProcess.ServiceBase)
ret <null>
ldstr svchosthelper.exe
stloc.0 <null>
ldstr systemhelper.exe
stloc.1 <null>
ldstr WindowsLogsHelper
stloc.2 <null>
ldc.i4.s 36
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
dup <null>
ldloc.0 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.3 <null>
ldloc.1 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_4
ldstr euTz8nVTC5G6.bz9H6.qNLzh
ldloc.3 <null>
call System.Void A.B::F(System.String,System.String)
ldstr euTz8nVTC5G6.yF32sU.dwVQW
ldloc.s V_4
call System.Void A.B::F(System.String,System.String)
ldloc.3 <null>
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_4
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.3 <null>
call System.Void A.B::G(System.String)
ldloc.s V_4
call System.Void A.B::G(System.String)
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void A.B::H(System.String)
ldloc.3 <null>
ldloc.2 <null>
call System.Void A.B::I(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c start "" "
ldloc.3 <null>
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr cmd.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr /c start "" "
ldloc.s V_4
ldstr "
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0121: ret
pop <null>
leave.s IL_0121: ret
ret <null>
c1bc86589d12eddcb7c1e9b74031a223
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
euTz8nVTC5G6.bz9H6.qNLzh
euTz8nVTC5G6.yF32sU.dwVQW
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙