Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: d104fd33294068d25672b6c6964c0b32
Size: 356.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 d104fd33294068d25672b6c6964c0b32
Sha1 e2f50ba7d4bf3fafc3f144311351aef2f2b40154
Sha256 01b462aa8a19eceb190df746c76cd7021fff5361ded45ac71eb6fb50ed23a89c
Sha384 a82e93a05c7ae7cfad88c7d694e9af8d190961beaa168d31351a2eaf7fdae119f3b33e5ce6d6c9607ebfc1ab65186c7d
Sha512 466076e9118c96520c561c41a57e549d5347f5d426c893405419608955f7a8458491035b8657a0f8902a0f1c4e3d3f21d5c2364640c15a0f30631ea8e78d7eb7
SSDeep 6144:C46bPXhLApfpJ+RCIoqAbD4hXggF7B5o23X2dzaBTTe:nmhApKCWugF7BCYX2dzaBe
TLSH CB748D5773A4E53BD1FD173AE43246050BB0D887B612F38B5A6C46B96D233868D923B3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d104fd33294068d25672b6c6964c0b32
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
Config. Field Value
Conf. AES-Salt BF-EB-huhuhuhuhuhuhuhuhuhuhu
Conf. AES-Key Kt5tujhuhuhuhuhuhuhu
Version 1.huhuhuhu
Port 7.tcphuhuhuhuhuhuhu
Host 7.tcphuhuhuhuhuhuhu
ReconnectDelay 3huhuhuhu
Key 1WvgEMhuhuhuhuhuhuhu
AuthKey NcFtjbhuhuhuhuhuhuhuhuhuhuhu
SubDirectory Suhuhuhuhu
InstallName Clihuhuhuhu
Install 0huhuhuhu
Startup 1huhuhuhu
Mutex QSR_Mhuhuhuhuhuhuhu
StartupKey svhuhuhuhu
HideFile 0huhuhuhu
EnableLogger 1huhuhuhu
Tag Sİhuhuhuhu
LogDirectory Lhuhuhuhu
HideLogDirectory 0huhuhuhu
HideLogSubdirectory 0huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::턑ቧ媄쾲⢲ݐ吟ẙꌵꞅ넝�脁悾꜐(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 鵰釦魘잞܏ⷼ䊫�嫔噞ー嶘摏믅�銻Vਇ::팂퓣昅શ댥㋖ᶃ냽戚돨솷暞䶿錗輶돏()
brfalse.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ()
call System.Boolean 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::✊ᎍ：㰾滺ꊿ䓨熯蚔挌덦쿄ꄺ찈䬯櫈粸()
brfalse.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ()
call System.Boolean ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴::get_Exiting()
brtrue.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ()
ldsfld ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴ 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::펵髟팶፜域ૺ�붒䋨䢙ᡡ牝ᇻ烆枘풥Ԍ褊
callvirt System.Void ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴::嚹๨񧎥ꮣ밦綆ፒ벂偝ᵜ徒ὃ窄ਗ਼壧Օ똺㛝ꌛ()
call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ()
call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::殠쵳悃憴淣ㆭ䔃뷖㏥ᨇ఩꿠᫹䒻ొꆼᦽ()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::Main(System.String[])
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.3.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0,Profile=Client
Total Strings
896
Main Method
System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::Main(System.String[])
Main IL Instruction Count
19
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::턑ቧ媄쾲⢲ݐ吟ẙꌵꞅ넝�脁悾꜐(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean 鵰釦魘잞܏ⷼ䊫�嫔噞ー嶘摏믅�銻Vਇ::팂퓣昅શ댥㋖ᶃ냽戚돨솷暞䶿錗輶돏()
brfalse.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ()
call System.Boolean 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::✊ᎍ：㰾滺ꊿ䓨熯蚔挌덦쿄ꄺ찈䬯櫈粸()
brfalse.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ()
call System.Boolean ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴::get_Exiting()
brtrue.s IL_0040: call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ()
ldsfld ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴ 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::펵髟팶፜域ૺ�붒䋨䢙ᡡ牝ᇻ烆枘풥Ԍ褊
callvirt System.Void ႂ韊ᏹᇴꝯ첦✒헀ᴧℾ伎៲⓲饦䁵廓䷽̴::嚹๨񧎥ꮣ밦綆ፒ벂偝ᵜ徒ὃ窄ਗ਼壧Օ똺㛝ꌛ()
call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::ﶆ䌛➧栖髞㖨龗뫳䩟덁폰β闀ᔭᐳ漢瞘ꔄ()
call System.Void 礍悳Ღᔳ厩깚熓鉺ῷ꛰ꃌ㢉᥁ᖿ洠鶤篽䂋::殠쵳悃憴淣ㆭ䔃뷖㏥ᨇ఩꿠᫹䒻ొꆼᦽ()
ret <null>
CnC CNCmalicious
7.tcphuhuhuhuhuhuhu
Port PORTmalicious
7.tcphuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙