Malicious
Malicious

d99b405b724e29ae66e5e58d22eb04a8

PE Executable
|
MD5: d99b405b724e29ae66e5e58d22eb04a8
|
Size: 1.99 MB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
d99b405b724e29ae66e5e58d22eb04a8
Sha1
c2cc072bd827c2bfef918bccdfabeda8a770533e
Sha256
dffbd774b50dd2319bff54a998b59872b1a5a2b7dcab844e7e0e6d00bd428af3
Sha384
a402754cbb86d9ab1600a03aa7d5e1cfed1f5526ae2eb2a62946bc0b279f219f1d07901add644f927c220ef6bb51b571
Sha512
4f3038475c7d2fcf787e1f47f69f28dceb5c4d916362360fd10f3b25fe16a1c371fa040097bc9ed6b6f175e2613c88eb6539e7cbc66456f9fdee0fc05fea05fb
SSDeep
49152:WxHta7anKy1S9/aOHRnMovgncO3JVO71O7t:WxHta7im/aOFgnRJK4
TLSH
2395F10B72494870D169A63EC5DB4109E3F6B9456323F78F7988139A4D233E9ED2E783

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ v6.0 DLL
Microsoft Visual Studio .NET
File Structure
d99b405b724e29ae66e5e58d22eb04a8
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
i4Ir3FTXDXFEwLVebp.F6wATQdWmnsm7NRetG
Syntex_Spoofer.Menu.resources
9e0H7cprhu0tTlDJ19.Ms21KEvXXENS5nlQps
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.guna.ui2.dll.compressed
costura.guna.ui2.dll
Malicious
[Authenticode]_28203e69.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
G22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
icon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Guna.UI2.Properties.Resources.resources
CheckedCheckbox_20px
[NBF]root.Data
[NBF]root.Data-preview.png
CheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
FullImage_64px
[NBF]root.Data
[NBF]root.Data-preview.png
ImageCalendar
[NBF]root.Data
[NBF]root.Data-preview.png
UncheckedCheckbox_20px
UncheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
ce_48px
[NBF]root.Data
[NBF]root.Data-preview.png
curv3
[NBF]root.Data
[NBF]root.Data-preview.png
curv3_w
[NBF]root.Data
[NBF]root.Data-preview.png
error
[NBF]root.Data
[NBF]root.Data-preview.png
info
[NBF]root.Data
[NBF]root.Data-preview.png
logo
[NBF]root.Data
[NBF]root.Data-preview.png
logo_w
[NBF]root.Data
[NBF]root.Data-preview.png
miring
[NBF]root.Data
[NBF]root.Data-preview.png
question
[NBF]root.Data
[NBF]root.Data-preview.png
warning
[NBF]root.Data
[NBF]root.Data-preview.png
G22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
btDown.Image
btUp.Image
imageList1.ImageStream
[NBF]root.Data
costura.metadata
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

PDB Path: Syntex Spoofer.pdb
Module Name

Syntex Spoofer.exe
Full Name

Syntex Spoofer.exe
EntryPoint

System.Void BXVDlM0OypT0vCgs2O.uVVJHLDgZmgMRj2jXg::qjL4Pb8Aq()
Scope Name

Syntex Spoofer.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Syntex Spoofer
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8
Total Strings

44
Main Method

System.Void BXVDlM0OypT0vCgs2O.uVVJHLDgZmgMRj2jXg::qjL4Pb8Aq()
Main IL Instruction Count

36
Main IL

ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0040: newobj System.Void Syntex_Spoofer.Menu::.ctor() ret <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 2 br IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) newobj System.Void Syntex_Spoofer.Menu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 1 ldsfld <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1} <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_a8d141fb5bc44cf1979fb95973d0ddff ldfld System.Int32 <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_32b10266f5a14fa4a1e1461992d9f648 brfalse IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) pop <null> ldc.i4 0 br IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) call System.Void iN3lVXvqSBDDFiteJf4.w9qT1Iv4hsjdQkNmjqb::uTf5MoFn2i() ldc.i4 0 ldsfld <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1} <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_a8d141fb5bc44cf1979fb95973d0ddff ldfld System.Int32 <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_c7bc41a18bf5409daf7e3627ec0a67ed brfalse IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) pop <null> ldc.i4 0 br IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 2 ldsfld <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1} <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_a8d141fb5bc44cf1979fb95973d0ddff ldfld System.Int32 <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_4c59714964dc4c6fb2d1cba9838d3310 brfalse IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) pop <null> ldc.i4 4 br IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069)
Module Name

Syntex Spoofer.exe
Full Name

Syntex Spoofer.exe
EntryPoint

System.Void BXVDlM0OypT0vCgs2O.uVVJHLDgZmgMRj2jXg::qjL4Pb8Aq()
Scope Name

Syntex Spoofer.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Syntex Spoofer
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8
Total Strings

44
Main Method

System.Void BXVDlM0OypT0vCgs2O.uVVJHLDgZmgMRj2jXg::qjL4Pb8Aq()
Main IL Instruction Count

36
Main IL

ldc.i4 3 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0040: newobj System.Void Syntex_Spoofer.Menu::.ctor() ret <null> call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4 2 br IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) newobj System.Void Syntex_Spoofer.Menu::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ldc.i4 1 ldsfld <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1} <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_a8d141fb5bc44cf1979fb95973d0ddff ldfld System.Int32 <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_32b10266f5a14fa4a1e1461992d9f648 brfalse IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) pop <null> ldc.i4 0 br IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) call System.Void iN3lVXvqSBDDFiteJf4.w9qT1Iv4hsjdQkNmjqb::uTf5MoFn2i() ldc.i4 0 ldsfld <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1} <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_a8d141fb5bc44cf1979fb95973d0ddff ldfld System.Int32 <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_c7bc41a18bf5409daf7e3627ec0a67ed brfalse IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) pop <null> ldc.i4 0 br IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) ldc.i4 2 ldsfld <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1} <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_a8d141fb5bc44cf1979fb95973d0ddff ldfld System.Int32 <Module>{cd2aff44-2d4d-45c2-a5b7-ae8dca34e9e1}::m_4c59714964dc4c6fb2d1cba9838d3310 brfalse IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069) pop <null> ldc.i4 4 br IL_0012: switch(IL_0040,IL_0030,IL_008D,IL_0031,IL_0069)
d99b405b724e29ae66e5e58d22eb04a8 (1.99 MB)
File Structure
d99b405b724e29ae66e5e58d22eb04a8
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
i4Ir3FTXDXFEwLVebp.F6wATQdWmnsm7NRetG
Syntex_Spoofer.Menu.resources
9e0H7cprhu0tTlDJ19.Ms21KEvXXENS5nlQps
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.guna.ui2.dll.compressed
costura.guna.ui2.dll
Malicious
[Authenticode]_28203e69.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
G22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
icon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Guna.UI2.Properties.Resources.resources
CheckedCheckbox_20px
[NBF]root.Data
[NBF]root.Data-preview.png
CheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
FullImage_64px
[NBF]root.Data
[NBF]root.Data-preview.png
ImageCalendar
[NBF]root.Data
[NBF]root.Data-preview.png
UncheckedCheckbox_20px
UncheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
ce_48px
[NBF]root.Data
[NBF]root.Data-preview.png
curv3
[NBF]root.Data
[NBF]root.Data-preview.png
curv3_w
[NBF]root.Data
[NBF]root.Data-preview.png
error
[NBF]root.Data
[NBF]root.Data-preview.png
info
[NBF]root.Data
[NBF]root.Data-preview.png
logo
[NBF]root.Data
[NBF]root.Data-preview.png
logo_w
[NBF]root.Data
[NBF]root.Data-preview.png
miring
[NBF]root.Data
[NBF]root.Data-preview.png
question
[NBF]root.Data
[NBF]root.Data-preview.png
warning
[NBF]root.Data
[NBF]root.Data-preview.png
G22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
btDown.Image
btUp.Image
imageList1.ImageStream
[NBF]root.Data
costura.metadata
aR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resources
$this.Icon
[NBF]root.IconData
progressBar1.Modifiers
$this.Language
$this.GridSize
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙