Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
f20613bf3ee0b8561192ceb16e2a655b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xClient.Properties.Resources.resources
information
[NBF]root.Data
[NBF]root.Data-preview.png
xClient.Resource1.resources
AGG_Binary
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.rsrc
.reloc
Resources
EXE
ID:0065
ID:1033
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
.Net Resources
Stager.Properties.Resources.resources
Dll32
Dll64
Service32
Service64
RT_MANIFEST
ID:0001
ID:1033
AGG_Install
AS2
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources

ID:0000
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
FxResources.Microsoft.Win32.Registry.SR.resources
ILRepack.List
AutoPatchETSStatic
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
ILRepack.List
InvisibleWindow_vmp
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0001
ID:1033
ManualMapInjector_x86
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
RealUnblockScreenshot_x86
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.fptable
.5g,
.w&C
.?<i
.rsrc
.reloc
install_interception
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rsrc
.reloc
Resources
DRIVER
ID:0000
ID:0
[Authenticode]_7eb46018.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
PAGE
INIT
.rsrc
.reloc
.pdata
.sdata
Optional Header (x64)
Resources
RT_VERSION
ID:0001
ID:1033
[Authenticode]_4a033877.p7b
[Authenticode]_b8a8be74.p7b
[Authenticode]_36920bdc.p7b
[Authenticode]_bc62cbef.p7b
[Authenticode]_006eba76.p7b
[Authenticode]_6d2ebe00.p7b
[Authenticode]_813573bb.p7b
[Authenticode]_6345dcf2.p7b
[Authenticode]_acfaac5f.p7b
[Authenticode]_79f996dd.p7b
[Authenticode]_25e96bd9.p7b
[Authenticode]_67bb18b3.p7b
[Authenticode]_b59472b6.p7b
[Authenticode]_14fc64e0.p7b
[Authenticode]_c7753709.p7b
[Authenticode]_7d0f0658.p7b
[Authenticode]_c03ee314.p7b
[Authenticode]_f5e121e0.p7b
[Authenticode]_f4cee50e.p7b
RT_VERSION
ID:0001
ID:1033
int3rc3ption
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.data
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
ILRepack.List
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
ClientStatic
Full Name
ClientStatic
EntryPoint
System.Void xClient.Program::Main(System.String[])
Scope Name
ClientStatic
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ClientStatic
Assembly Version
1.2.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1718
Main Method
System.Void xClient.Program::Main(System.String[])
Main IL Instruction Count
30
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void xClient.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean xClient.Config.Settings::Initialize()
brfalse.s IL_0069: call System.Void xClient.Program::Cleanup()
call System.Boolean xClient.Program::Initialize()
brfalse.s IL_0069: call System.Void xClient.Program::Cleanup()
ldsfld System.Threading.ThreadStart xClient.Program/<>c::<>9__2_0
dup <null>
brtrue.s IL_004E: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld xClient.Program/<>c xClient.Program/<>c::<>9
ldftn System.Void xClient.Program/<>c::<Main>b__2_0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart xClient.Program/<>c::<>9__2_0
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
call System.Boolean xClient.Core.Networking.QuasarClient::get_Exiting()
brtrue.s IL_0069: call System.Void xClient.Program::Cleanup()
ldsfld xClient.Core.Networking.QuasarClient xClient.Program::ConnectClient
callvirt System.Void xClient.Core.Networking.QuasarClient::Connect()
call System.Void xClient.Program::Cleanup()
call System.Void xClient.Program::Exit()
ret <null>
Module Name
ClientStatic
Full Name
ClientStatic
EntryPoint
System.Void xClient.Program::Main(System.String[])
Scope Name
ClientStatic
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ClientStatic
Assembly Version
1.2.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1718
Main Method
System.Void xClient.Program::Main(System.String[])
Main IL Instruction Count
30
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void xClient.Program::HandleUnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Boolean xClient.Config.Settings::Initialize()
brfalse.s IL_0069: call System.Void xClient.Program::Cleanup()
call System.Boolean xClient.Program::Initialize()
brfalse.s IL_0069: call System.Void xClient.Program::Cleanup()
ldsfld System.Threading.ThreadStart xClient.Program/<>c::<>9__2_0
dup <null>
brtrue.s IL_004E: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldsfld xClient.Program/<>c xClient.Program/<>c::<>9
ldftn System.Void xClient.Program/<>c::<Main>b__2_0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart xClient.Program/<>c::<>9__2_0
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
call System.Boolean xClient.Core.Networking.QuasarClient::get_Exiting()
brtrue.s IL_0069: call System.Void xClient.Program::Cleanup()
ldsfld xClient.Core.Networking.QuasarClient xClient.Program::ConnectClient
callvirt System.Void xClient.Core.Networking.QuasarClient::Connect()
call System.Void xClient.Program::Cleanup()
call System.Void xClient.Program::Exit()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙