Suspicious
Suspect

c4bea1a44d80b69fc373b80e10a61f0e

PE Executable
MD5: c4bea1a44d80b69fc373b80e10a61f0e
Size: 48.64 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 c4bea1a44d80b69fc373b80e10a61f0e
Sha1 9cf8e4b0512572e9e9dd42b2395ceb28d26c71c6
Sha256 eff06ffe78c495491ce7eff1ed8b140f4ba023126edf85fb248fdf894f40a3c4
Sha384 665df3a36c2d0400c5f9c850bd8cf78f5ed7437ff5c9149a31cc5011d8765ca0d1bb9773c9a681700267b96e84392ff3
Sha512 42c53514affc61e265de9dcf6be9701e0185d98936e05141d3b753015de22e006a47d32bd3c5da5846d3dcb4e5f1e3a14599bca07a4fd81f8f482bbef131e8e5
SSDeep 768:UntwOZMOux807AKI/83uC9nNhR5hQqO/0Zkb6oXH+AbVOzh73kI:utrMOc7PII9nNnnVO/Ukb6oXpOzaI
TLSH 13235B4DB7A58125E1FE9FF098F27112C23AE22358039B6F28DD41970B13A8DCA417E6
c4bea1a44d80b69fc373b80e10a61f0e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
XX Client.exe
Full Name
XX Client.exe
EntryPoint
System.Void Stub.aTZWzqJSAD::IGnsT4DCwq()
Scope Name
XX Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XX Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
253
Main Method
System.Void Stub.aTZWzqJSAD::IGnsT4DCwq()
Main IL Instruction Count
208
Main IL 
ldsfld System.Int32 gMtwu0ccOt::DJNML1js0W
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String gMtwu0ccOt::tQ5rrU5QVa
call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String gMtwu0ccOt::tQ5rrU5QVa
ldsfld System.String gMtwu0ccOt::Fa0guDvtLi
call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String gMtwu0ccOt::Fa0guDvtLi
ldsfld System.String gMtwu0ccOt::pvX4MHtQqM
call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String gMtwu0ccOt::pvX4MHtQqM
ldsfld System.String gMtwu0ccOt::lNWNibB81q
call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String gMtwu0ccOt::lNWNibB81q
ldsfld System.String gMtwu0ccOt::I9BTsa6UY6
call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String gMtwu0ccOt::I9BTsa6UY6
ldsfld System.String gMtwu0ccOt::nqwz6pjCHd
call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String gMtwu0ccOt::nqwz6pjCHd
ldsfld System.String gMtwu0ccOt::6cEXVbo2ub
call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String gMtwu0ccOt::6cEXVbo2ub
ldsfld System.String gMtwu0ccOt::8QfOs5nfaP
call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String gMtwu0ccOt::8QfOs5nfaP
leave.s IL_00CB: call System.Boolean Stub.9AW9l3xE8h::VIEIUVdV2K()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00CB: call System.Boolean Stub.9AW9l3xE8h::VIEIUVdV2K()
call System.Boolean Stub.9AW9l3xE8h::VIEIUVdV2K()
brtrue.s IL_00D8: ldsfld System.String gMtwu0ccOt::6cEXVbo2ub
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String gMtwu0ccOt::6cEXVbo2ub
ldstr \
ldsfld System.String gMtwu0ccOt::8QfOs5nfaP
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_4
ldloc.s V_4
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_011A: ldloc.0
ldloc.s V_4
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0131: ldc.i4 1000
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldsfld System.String Stub.9AW9l3xE8h::zA23rXsZYX
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_015C: ldc.i4.7
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_015C: ldc.i4.7
ldc.i4.7 <null>
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr \
ldsfld System.String gMtwu0ccOt::8QfOs5nfaP
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldstr .lnk
call System.String System.String::Concat(System.String,System.String,System.String,System.String)
stloc.s V_7
ldstr WScript.Shell
ldstr 
call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String)
ldnull <null>
ldstr CreateShortcut
ldc.i4.1 <null>
newarr System.Object
stloc.s V_9
ldloc.s V_9
ldc.i4.0 <null>
ldloc.s V_7
stelem.ref <null>
ldloc.s V_9
stloc.s V_10
ldloc.s V_10
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_11
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldloc.s V_11
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_01E1: stloc.s V_12
ldloc.s V_10
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_7
stloc.s V_12
ldloc.s V_12
ldnull <null>
ldstr TargetPath
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_13
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldloc.s V_12
ldnull <null>
ldstr WorkingDirectory
ldc.i4.1 <null>
newarr System.Object
stloc.s V_13
ldloc.s V_13
ldc.i4.0 <null>
ldstr 
stelem.ref <null>
ldloc.s V_13
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldloc.s V_12
ldnull <null>
ldstr Save
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldnull <null>
stloc.s V_12
ldloc.s V_7
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Stub.9AW9l3xE8h::dbzjEHre8K
leave.s IL_0260: call System.Void Stub.9AW9l3xE8h::WhhBpTslrR()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0260: call System.Void Stub.9AW9l3xE8h::WhhBpTslrR()
call System.Void Stub.9AW9l3xE8h::WhhBpTslrR()
ldnull <null>
ldftn System.Void Stub.aTZWzqJSAD::6VN5DgeFA7()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.aTZWzqJSAD::l5i9vsIhvo()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
c4bea1a44d80b69fc373b80e10a61f0e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙