Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
Symbol obfuscation
Very low
5 malicious · 172 files
EXEcac3dbbaaf45e05912676501adbf78ce
Structure
P7B[Authenticode]_3e3d0b14.p7b
BINfil0FDA5AB4AA10015B271F2ED69FF28F70
BINfil27B706E8A9E6D8AD458734A819C15B05
BINfil366097B0D580FD8971D330537AAD14C8
BINfil39D09F326B50A9B9FD462D8D108F489B
BINfil3C8448AC656876010758240095E190E3
BINfil4147BA34AF2BD9CDAC80E2E1F291EABB
BINfil4517D84B41F9415797264E6DFF9DFE4A
BINfil48636DA438BF25B26F25CF618C08CAF6
BINfil48AB6017152B9AA38F63DD37AFFA8662
BINfil51274E9F7D1C607FC99B19BB6A204529
BINfil5E1ECE36E158CC592D4A43BF3621B766
BINfil6395A29290CF12B500317986733B7D20
BINfil64EA2F98FA34FBA9C45630E41B1253F3
BINfil6FBB3F11FE8FDAE5FB32DC1B76882A47
BINfil70971AA32F236D52B745FDA23CFC5F8E
BINfil76476A322B4EFD9826EBD1F0B99C6D35
BINfil76F8BDF3BF4276A79149D44B4A70C9AD
BINfil81B4CF9764F72AE10DF2BCCD6BE567E8
BINfil88366075384FB9AFF2523F4CB4C195FD
BINfil955E0A3F550090081D94AC99086D21F3
BINfil95C5B810AE937B47BA212A73C41F9543
BINfil9772AD83B05EEE2344F6EAB49F89FEED
BINfil99BDBE75E8C3FD4F3C59F8C1B5B70E76
BINfilB4687185FE6798F205135E5F8E8A04FB
BINfilB4C882F9C143C13762119D2E9AA2A7A0
BINfilC70F08A213E713893D853BF08D3A492D
BINfilCF0A2B5C3FDA45BC0C69A86278A86721
BINfilE86988E9F810AC16A165E5A71EA8C929
BINfilFF535B5E2A95A20CE1B2A4C52A0EA608
BIN.Net Resources
OFFISO2DiscEdition_signed.msi
BINRoot Entry
BIN䡀䌏䈯
BIN䡀䈖䌧䠤
BIN䡀䌋䄱䜵
BIN䡀㬿䏲䐸䖱
BIN䡀㽿䅤䈯䠶
BIN䡀䈏䗤䕸䠨
BIN䡀䕙䓲䕨䜷
BIN䡀䌍䈵䗦䕲䠼
BIN䡀䒌䓰䑲䑨䠷
BIN䡀㼿䕷䑬㭪䗤䠤
BIN䡀㼿䕷䑬㹪䒲䠯
BIN䡀㿿䏤䇬䗤䒬䠱
BIN䡀䖖㯬䏬㱨䖤䠫
BIN䡀䘌䗶䐲䆊䌷䑲
BIN㽚 䈍䌶䑪䕨䆾䅤
BINfil64EA2F98FA34FBA9C45630E41B1253F3
BINfil6FBB3F11FE8FDAE5FB32DC1B76882A47
ZIPfil81B4CF9764F72AE10DF2BCCD6BE567E8
OFF[Repaired @0x00053352]
BIN䡀䇊䌰㾱㼒䔨䈸䆱䠨
BIN䡀䈏䗤䕸㬨䐲䒳䈱䗱䠶
BIN䡀䑒䗶䏤㾯㼒䔨䈸䆱䠨
BIN䡀䇊䌰㮱䈻䘦䈷䈜䘴䑨䈦
BIN䡀䇊䗹䛎䆨䗸㼨䔨䈸䆱䠨
BIN䡀䑒䗶䏤㮯䈻䘦䈷䈜䘴䑨䈦
BINDigitalSignature
BINSummaryInformation
BINMsiDigitalSignatureEx
Name Value
Info
Authenticode present at 0x1572400 size 15840 bytes
Module Name
ISO2Disc_Silent_Installer.exe
Full Name
ISO2Disc_Silent_Installer.exe
EntryPoint
System.Int32 Program::Main()
Scope Name
ISO2Disc_Silent_Installer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ISO2Disc_Silent_Installer
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
6
Main Method
System.Int32 Program::Main()
Main IL Instruction Count
101
Main IL 
call System.String System.IO.Path::GetTempPath()
ldstr ISO2DiscInstaller_
call System.Guid System.Guid::NewGuid()
stloc.s V_9
ldloca.s V_9
ldstr N
call System.String System.Guid::ToString(System.String)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
ldstr ISO2DiscEdition_signed.msi
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr ISO2DiscEdition_signed.msi
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.2 <null>
ldloc.2 <null>
brtrue.s IL_0056: ldloc.1
ldc.i4.1 <null>
stloc.s V_8
leave IL_0103: ldloc.s V_8
ldloc.1 <null>
call System.IO.FileStream System.IO.File::Create(System.String)
stloc.3 <null>
ldloc.2 <null>
ldloc.3 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
leave.s IL_0070: leave.s IL_007C
ldloc.3 <null>
brfalse.s IL_006F: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_007C: ldstr "msiexec.exe"
ldloc.2 <null>
brfalse.s IL_007B: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr msiexec.exe
ldstr /i "{0}" /qn /norestart
ldloc.1 <null>
call System.String System.String::Format(System.String,System.Object)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String,System.String)
stloc.s V_7
ldloc.s V_7
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_7
stloc.s V_4
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00DE: leave.s IL_00EC
ldloc.s V_5
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldloc.s V_5
callvirt System.Int32 System.Diagnostics.Process::get_ExitCode()
stloc.s V_6
ldloc.0 <null>
ldc.i4.1 <null>
call System.Void System.IO.Directory::Delete(System.String,System.Boolean)
leave.s IL_00D8: ldloc.s V_6
pop <null>
leave.s IL_00D8: ldloc.s V_6
ldloc.s V_6
stloc.s V_8
leave.s IL_0103: ldloc.s V_8
leave.s IL_00EC: ldloc.0
ldloc.s V_5
brfalse.s IL_00EB: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.0 <null>
ldc.i4.1 <null>
call System.Void System.IO.Directory::Delete(System.String,System.Boolean)
leave.s IL_00F8: ldc.i4.1
pop <null>
leave.s IL_00F8: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_8
leave.s IL_0103: ldloc.s V_8
pop <null>
ldc.i4.1 <null>
stloc.s V_8
leave.s IL_0103: ldloc.s V_8
ldloc.s V_8
ret <null>
Module Name
ISO2Disc_Silent_Installer.exe
Full Name
ISO2Disc_Silent_Installer.exe
EntryPoint
System.Int32 Program::Main()
Scope Name
ISO2Disc_Silent_Installer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ISO2Disc_Silent_Installer
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
6
Main Method
System.Int32 Program::Main()
Main IL Instruction Count
101
Main IL 
call System.String System.IO.Path::GetTempPath()
ldstr ISO2DiscInstaller_
call System.Guid System.Guid::NewGuid()
stloc.s V_9
ldloca.s V_9
ldstr N
call System.String System.Guid::ToString(System.String)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
ldstr ISO2DiscEdition_signed.msi
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.1 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldstr ISO2DiscEdition_signed.msi
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.2 <null>
ldloc.2 <null>
brtrue.s IL_0056: ldloc.1
ldc.i4.1 <null>
stloc.s V_8
leave IL_0103: ldloc.s V_8
ldloc.1 <null>
call System.IO.FileStream System.IO.File::Create(System.String)
stloc.3 <null>
ldloc.2 <null>
ldloc.3 <null>
callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream)
leave.s IL_0070: leave.s IL_007C
ldloc.3 <null>
brfalse.s IL_006F: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_007C: ldstr "msiexec.exe"
ldloc.2 <null>
brfalse.s IL_007B: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldstr msiexec.exe
ldstr /i "{0}" /qn /norestart
ldloc.1 <null>
call System.String System.String::Format(System.String,System.Object)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String,System.String)
stloc.s V_7
ldloc.s V_7
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
ldloc.s V_7
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_7
stloc.s V_4
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00DE: leave.s IL_00EC
ldloc.s V_5
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldloc.s V_5
callvirt System.Int32 System.Diagnostics.Process::get_ExitCode()
stloc.s V_6
ldloc.0 <null>
ldc.i4.1 <null>
call System.Void System.IO.Directory::Delete(System.String,System.Boolean)
leave.s IL_00D8: ldloc.s V_6
pop <null>
leave.s IL_00D8: ldloc.s V_6
ldloc.s V_6
stloc.s V_8
leave.s IL_0103: ldloc.s V_8
leave.s IL_00EC: ldloc.0
ldloc.s V_5
brfalse.s IL_00EB: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.0 <null>
ldc.i4.1 <null>
call System.Void System.IO.Directory::Delete(System.String,System.Boolean)
leave.s IL_00F8: ldc.i4.1
pop <null>
leave.s IL_00F8: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_8
leave.s IL_0103: ldloc.s V_8
pop <null>
ldc.i4.1 <null>
stloc.s V_8
leave.s IL_0103: ldloc.s V_8
ldloc.s V_8
ret <null>
PE Layout UNKNWOWNsuspect
Memoryhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
fihuhuhuhu
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #3 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #5 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #6 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #7 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #8 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #9 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #10 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #11 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #12 URIsuspect
http:/huhuhuhuhuhuhu
URLs in VB Code - #13 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #14 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙