Malicious
Malicious
Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Low

Hash
 Hash Value
MD5
ed22eea89ee3207e18847b0110e9c124
Sha1
351774e894c603bd12e23791d626cb11b522d215
Sha256
a874812d5f6518587a09b679236e71a2555702fb99458400613626651dc83f3b
Sha384
025a1fc55546e5a2ee93bc6efe0b03681b5d78eaf75cd45ccd9b0f2dbef5292cb769737e4933f8a923e40096bf316913
Sha512
e6a78dd22de70248075b00517dc0d37baf64caa303097bd5b64898c2e015a956ef4d2dbb6f98b4bb55011e587565f192fa706c3628e7fdd9fc9bdc76073f94df
SSDeep
24576:+rrja8tRItqUgF+lqQ3ly0hr7opz7TEXUPvQX0xJETK4T:+rrja8AtBgElqQ3kS7UnCUHQXOED
TLSH
5E55332DAF97F4B5D2FFCABE2911D593927D1324EF941B2248A563EC3C43A358215C28

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
ed22eea89ee3207e18847b0110e9c124
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
dwwebfq.Resources
Malicious
UID BYPASS V1.0.exe
Malicious
UID BYPASS V1.0.exe [GZip Decompressed]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
NXR_UID_BYPASS_FOR_SELL_PROJECT.Form1.resources
$this.Icon
[NBF]root.IconData
guna2PictureBox3.Image
[NBF]root.Data
[NBF]root.Data-preview.png
guna2PictureBox4.Image
[NBF]root.Data
[NBF]root.Data-preview.png
shayanHeader1.Logo
[NBF]root.Data
[NBF]root.Data-preview.png
nxr.NotificationForm.resources
NXR_UID_BYPASS_FOR_SELL_PROJECT.c8750f0d.0
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.guna.ui2.dll.compressed
costura.guna.ui2.dll
Malicious
[Authenticode]_28203e69.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
G22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
icon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Guna.UI2.Properties.Resources.resources
CheckedCheckbox_20px
[NBF]root.Data
[NBF]root.Data-preview.png
CheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
FullImage_64px
[NBF]root.Data
[NBF]root.Data-preview.png
ImageCalendar
[NBF]root.Data
[NBF]root.Data-preview.png
UncheckedCheckbox_20px
UncheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
ce_48px
[NBF]root.Data
[NBF]root.Data-preview.png
curv3
[NBF]root.Data
[NBF]root.Data-preview.png
curv3_w
[NBF]root.Data
[NBF]root.Data-preview.png
error
[NBF]root.Data
[NBF]root.Data-preview.png
info
[NBF]root.Data
[NBF]root.Data-preview.png
logo
[NBF]root.Data
[NBF]root.Data-preview.png
logo_w
[NBF]root.Data
[NBF]root.Data-preview.png
miring
[NBF]root.Data
[NBF]root.Data-preview.png
question
[NBF]root.Data
[NBF]root.Data-preview.png
warning
[NBF]root.Data
[NBF]root.Data-preview.png
G22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
btDown.Image
btUp.Image
imageList1.ImageStream
[NBF]root.Data
costura.shayanui.dll.compressed
costura.shayanui.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
svchost.exe
Malicious
svchost.exe [GZip Decompressed]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Malware Configuration - XWorm config.
Config. Field
 Value
family

xworm
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

uid.exe
Full Name

uid.exe
EntryPoint

System.Void Program::Main()
Scope Name

uid.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

uid
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

23
Main Method

System.Void Program::Main()
Main IL Instruction Count

57
Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::DetectVirtualMachine() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::DetectVirtualMachine() call System.Boolean Program::Emulator() or <null> call System.Boolean Program::DetectDebugger() or <null> call System.Boolean Program::DetectSandboxie() or <null> call System.Boolean Program::anyrun() or <null> brfalse.s IL_0040: leave.s IL_0050 ldnull <null> call System.Void System.Environment::FailFast(System.String) leave.s IL_0050: call System.Boolean Program::AdminCheck() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.0 <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0050: call System.Boolean Program::AdminCheck() call System.Boolean Program::AdminCheck() brtrue.s IL_00B1: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.1 <null> ldloc.1 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.1 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.1 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.1 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_00AF: br.s IL_00B8 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00AF: br.s IL_00B8 br.s IL_00B8: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>
Module Name

uid.exe
Full Name

uid.exe
EntryPoint

System.Void Program::Main()
Scope Name

uid.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

uid
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

<null>
Total Strings

23
Main Method

System.Void Program::Main()
Main IL Instruction Count

57
Main IL

ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Boolean Program::CreateMutex() brtrue.s IL_001B: call System.Boolean Program::DetectVirtualMachine() call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Boolean Program::DetectVirtualMachine() call System.Boolean Program::Emulator() or <null> call System.Boolean Program::DetectDebugger() or <null> call System.Boolean Program::DetectSandboxie() or <null> call System.Boolean Program::anyrun() or <null> brfalse.s IL_0040: leave.s IL_0050 ldnull <null> call System.Void System.Environment::FailFast(System.String) leave.s IL_0050: call System.Boolean Program::AdminCheck() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.0 <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0050: call System.Boolean Program::AdminCheck() call System.Boolean Program::AdminCheck() brtrue.s IL_00B1: ldnull newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.1 <null> ldloc.1 <null> call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.1 <null> ldstr runas callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) ldloc.1 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.1 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) leave.s IL_00AF: br.s IL_00B8 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.2 <null> call System.Int32 System.Environment::get_ExitCode() call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00AF: br.s IL_00B8 br.s IL_00B8: ret ldnull <null> call System.Object Program::WorkF(System.Object) pop <null> ret <null>
ed22eea89ee3207e18847b0110e9c124 (1.38 MB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙