Malicious
Malicious

cfeb81060c03bfd09b5adf5352e84af7

PE Executable
|
MD5: cfeb81060c03bfd09b5adf5352e84af7
|
Size: 46.08 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
cfeb81060c03bfd09b5adf5352e84af7
Sha1
a1e992b7ac636f77e19189075ca437f96badecf4
Sha256
fd919da6df0f0329adeac2e98a991d590fbe1e145bb549ddd99887fcafea265c
Sha384
d119df77b77ae6fbd53ff96e1fcbe19702b7fadc9542adcc8b2d7b5dcd9050d87563e58797dac18e6fc9bd55085cb0a6
Sha512
09ee89ac61ea37d55055fe1a180a7208d9ab853322e62e6dd7b329ff80f88179ea88c541920b0ae0141569654103e00e1c03e986cb5e2c8a0b0afa515e919250
SSDeep
768:WEcXJ9V5613uQ0GMqBTdkkbfFd99JictZiO9h73/5kr:WdXf+RzBTakbfX7Jict0O9B3Rkr
TLSH
9B235B0877F50126E2FF5BB059B22292E636A763A513D61F28D841DB2B53EC9C9403F6

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
cfeb81060c03bfd09b5adf5352e84af7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

XClient.exe
Full Name

XClient.exe
EntryPoint

System.Void Stub.JUjqBGI4b6RQ::oq6TTnOGLHbc()
Scope Name

XClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

XClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

237
Main Method

System.Void Stub.JUjqBGI4b6RQ::oq6TTnOGLHbc()
Main IL Instruction Count

83
Main IL

ldsfld System.Int32 ibcUoDcZvw4P::IBmovkQGaqxi ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String ibcUoDcZvw4P::5ofl4TFevsnq call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::5ofl4TFevsnq ldsfld System.String ibcUoDcZvw4P::QGQlShEMbzTg call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::QGQlShEMbzTg ldsfld System.String ibcUoDcZvw4P::FN3eIFKPPX4n call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::FN3eIFKPPX4n ldsfld System.String ibcUoDcZvw4P::QlXSMQW1Bkpk call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::QlXSMQW1Bkpk ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ leave.s IL_008A: call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_008A: call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH() call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH() brtrue.s IL_0097: ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ call System.String Stub.JUjqBGI4b6RQ::NXijwMSlAkim(System.String) stloc.0 <null> ldloc.0 <null> ldc.i4.1 <null> newarr System.Char stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> ldloc.s V_4 callvirt System.String[] System.String::Split(System.Char[]) ldc.i4.0 <null> ldelem.ref <null> stsfld System.String ibcUoDcZvw4P::tj1GFfxJQ7eO ldloc.0 <null> ldc.i4.1 <null> newarr System.Char stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> ldloc.s V_4 callvirt System.String[] System.String::Split(System.Char[]) ldc.i4.1 <null> ldelem.ref <null> stsfld System.String ibcUoDcZvw4P::bLeSfbeUudlv call System.Void Stub.uzrBa4G9ur6v::A1jLWigUL74d() ldnull <null> ldftn System.Void Stub.JUjqBGI4b6RQ::CU2CXpCrc9aU() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.JUjqBGI4b6RQ::CVvCElbbWYwz() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name

XClient.exe
Full Name

XClient.exe
EntryPoint

System.Void Stub.JUjqBGI4b6RQ::oq6TTnOGLHbc()
Scope Name

XClient.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

XClient
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

237
Main Method

System.Void Stub.JUjqBGI4b6RQ::oq6TTnOGLHbc()
Main IL Instruction Count

83
Main IL

ldsfld System.Int32 ibcUoDcZvw4P::IBmovkQGaqxi ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String ibcUoDcZvw4P::5ofl4TFevsnq call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::5ofl4TFevsnq ldsfld System.String ibcUoDcZvw4P::QGQlShEMbzTg call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::QGQlShEMbzTg ldsfld System.String ibcUoDcZvw4P::FN3eIFKPPX4n call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::FN3eIFKPPX4n ldsfld System.String ibcUoDcZvw4P::QlXSMQW1Bkpk call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::QlXSMQW1Bkpk ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ call System.Object Stub.HK8g2wzGDxEg::LE2X8qWm5AB3(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ leave.s IL_008A: call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_008A: call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH() call System.Boolean Stub.uzrBa4G9ur6v::Wjz8poQlBnQH() brtrue.s IL_0097: ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ibcUoDcZvw4P::y7qqBoWSyUQQ call System.String Stub.JUjqBGI4b6RQ::NXijwMSlAkim(System.String) stloc.0 <null> ldloc.0 <null> ldc.i4.1 <null> newarr System.Char stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> ldloc.s V_4 callvirt System.String[] System.String::Split(System.Char[]) ldc.i4.0 <null> ldelem.ref <null> stsfld System.String ibcUoDcZvw4P::tj1GFfxJQ7eO ldloc.0 <null> ldc.i4.1 <null> newarr System.Char stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> ldloc.s V_4 callvirt System.String[] System.String::Split(System.Char[]) ldc.i4.1 <null> ldelem.ref <null> stsfld System.String ibcUoDcZvw4P::bLeSfbeUudlv call System.Void Stub.uzrBa4G9ur6v::A1jLWigUL74d() ldnull <null> ldftn System.Void Stub.JUjqBGI4b6RQ::CU2CXpCrc9aU() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.JUjqBGI4b6RQ::CVvCElbbWYwz() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
cfeb81060c03bfd09b5adf5352e84af7 (46.08 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙