Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 ed22eea89ee3207e18847b0110e9c124
Sha1 351774e894c603bd12e23791d626cb11b522d215
Sha256 a874812d5f6518587a09b679236e71a2555702fb99458400613626651dc83f3b
Sha384 025a1fc55546e5a2ee93bc6efe0b03681b5d78eaf75cd45ccd9b0f2dbef5292cb769737e4933f8a923e40096bf316913
Sha512 e6a78dd22de70248075b00517dc0d37baf64caa303097bd5b64898c2e015a956ef4d2dbb6f98b4bb55011e587565f192fa706c3628e7fdd9fc9bdc76073f94df
SSDeep 24576:+rrja8tRItqUgF+lqQ3ly0hr7opz7TEXUPvQX0xJETK4T:+rrja8AtBgElqQ3kS7UnCUHQXOED
TLSH 5E55332DAF97F4B5D2FFCABE2911D593927D1324EF941B2248A563EC3C43A358215C28
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
ed22eea89ee3207e18847b0110e9c124
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
dwwebfq.Resources
Malicious
UID BYPASS V1.0.exe
Malicious
UID BYPASS V1.0.exe [GZip Decompressed]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
NXR_UID_BYPASS_FOR_SELL_PROJECT.Form1.resources
$this.Icon
[NBF]root.IconData
guna2PictureBox3.Image
[NBF]root.Data
[NBF]root.Data-preview.png
guna2PictureBox4.Image
[NBF]root.Data
[NBF]root.Data-preview.png
shayanHeader1.Logo
[NBF]root.Data
[NBF]root.Data-preview.png
nxr.NotificationForm.resources
NXR_UID_BYPASS_FOR_SELL_PROJECT.c8750f0d.0
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.pdb.compressed
costura.costura.pdb
costura.guna.ui2.dll.compressed
costura.guna.ui2.dll
Malicious
[Authenticode]_28203e69.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
G22190F0D5B1120504B3E00280003060D0F0F4F38724F222206070B01020F0F27012B0C.resources
icon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
Guna.UI2.Properties.Resources.resources
CheckedCheckbox_20px
[NBF]root.Data
[NBF]root.Data-preview.png
CheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
FullImage_64px
[NBF]root.Data
[NBF]root.Data-preview.png
ImageCalendar
[NBF]root.Data
[NBF]root.Data-preview.png
UncheckedCheckbox_20px
UncheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
ce_48px
[NBF]root.Data
[NBF]root.Data-preview.png
curv3
[NBF]root.Data
[NBF]root.Data-preview.png
curv3_w
[NBF]root.Data
[NBF]root.Data-preview.png
error
[NBF]root.Data
[NBF]root.Data-preview.png
info
[NBF]root.Data
[NBF]root.Data-preview.png
logo
[NBF]root.Data
[NBF]root.Data-preview.png
logo_w
[NBF]root.Data
[NBF]root.Data-preview.png
miring
[NBF]root.Data
[NBF]root.Data-preview.png
question
[NBF]root.Data
[NBF]root.Data-preview.png
warning
[NBF]root.Data
[NBF]root.Data-preview.png
G22190F0D5B1120504B250025230207091246250F300029390C06331B0E163B151735041C232100000E0B.resources
btDown.Image
btUp.Image
imageList1.ImageStream
[NBF]root.Data
costura.shayanui.dll.compressed
costura.shayanui.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.metadata
svchost.exe
Malicious
svchost.exe [GZip Decompressed]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
uid.exe
Full Name
uid.exe
EntryPoint
System.Void Program::Main()
Scope Name
uid.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uid
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
23
Main Method
System.Void Program::Main()
Main IL Instruction Count
57
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::DetectVirtualMachine()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::DetectVirtualMachine()
call System.Boolean Program::Emulator()
or <null>
call System.Boolean Program::DetectDebugger()
or <null>
call System.Boolean Program::DetectSandboxie()
or <null>
call System.Boolean Program::anyrun()
or <null>
brfalse.s IL_0040: leave.s IL_0050
ldnull <null>
call System.Void System.Environment::FailFast(System.String)
leave.s IL_0050: call System.Boolean Program::AdminCheck()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0050: call System.Boolean Program::AdminCheck()
call System.Boolean Program::AdminCheck()
brtrue.s IL_00B1: ldnull
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.1 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_00AF: br.s IL_00B8
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: br.s IL_00B8
br.s IL_00B8: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
Module Name
uid.exe
Full Name
uid.exe
EntryPoint
System.Void Program::Main()
Scope Name
uid.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
uid
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
23
Main Method
System.Void Program::Main()
Main IL Instruction Count
57
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::DetectVirtualMachine()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::DetectVirtualMachine()
call System.Boolean Program::Emulator()
or <null>
call System.Boolean Program::DetectDebugger()
or <null>
call System.Boolean Program::DetectSandboxie()
or <null>
call System.Boolean Program::anyrun()
or <null>
brfalse.s IL_0040: leave.s IL_0050
ldnull <null>
call System.Void System.Environment::FailFast(System.String)
leave.s IL_0050: call System.Boolean Program::AdminCheck()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.0 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0050: call System.Boolean Program::AdminCheck()
call System.Boolean Program::AdminCheck()
brtrue.s IL_00B1: ldnull
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.1 <null>
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.1 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_00AF: br.s IL_00B8
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00AF: br.s IL_00B8
br.s IL_00B8: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙