Suspicious
Suspect

fde50618d6360d50d99a6082a02a430a

Share on LinkedIn
Print
PE Executable
MD5: fde50618d6360d50d99a6082a02a430a
Size: 1.94 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 fde50618d6360d50d99a6082a02a430a
Sha1 f2b061539a697c0354e834cc1b16b05ba8816e0b
Sha256 c9f8cb4ffef8ca7512a2b2c53c5cbb1964acddc60f4dbac7fc527ab594fc0de7
Sha384 6d81e6f129ffa22b4ea625e7c3608f3d90589db64ca07a6182fbb6bdbb2a62a1c09ba3ce1e605867b2ef2779aedee74f
Sha512 2b38208b379c576fe1e125892e17d60f9424a2cdccabd1df6ec26fdfd94c3808a94b98f0b41e70b8f65cff4455b033d5c86eb9334699b381bc83e9fd150d9282
SSDeep 24576:6pApwPlgstVw7a/uqLq5EjhM+DRsOCuBmDZsk6IQly9amd:6pc+NW4q5KhMFLB
TLSH A4952A6127B86967F6BF4D35CCA0B124437F741F03F24CABB9A13AC32717682B944966
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
fde50618d6360d50d99a6082a02a430a
Overlay_1bc97aa5.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
turbojpeg.dll
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
.reloc
Resources
RT_MANIFEST
ID:0002
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

3 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 3
Name Value
Module Name
NetSession60.exe
Full Name
NetSession60.exe
EntryPoint
System.Void PooledNodeAccessor::Main()
Scope Name
NetSession60.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NetSession60
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Info
PE Detect: PeReader OK (file layout)
Info
Overlay extracted: Overlay_1bc97aa5.bin (512 bytes)
Total Strings
1114
Main Method
System.Void PooledNodeAccessor::Main()
Main IL Instruction Count
122
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldnull <null>
stloc.1 <null>
ldc.i4.1 <null>
ldstr b96b8702-3c58-4d3f-a9e0-e5b065fac0f9
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
leave.s IL_0023: ldloc.0
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01A4: ret
ldloc.0 <null>
brtrue.s IL_00A4: nop
ldc.i4.0 <null>
stloc.2 <null>
call System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
stloc.3 <null>
ldloc.3 <null>
newobj System.Void System.Security.Principal.WindowsPrincipal::.ctor(System.Security.Principal.WindowsIdentity)
ldc.i4 544
callvirt System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
stloc.2 <null>
leave.s IL_004D: ldloc.2
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_004D: ldloc.2
ldloc.2 <null>
brfalse.s IL_0088: ldloc.1
ldloc.1 <null>
ldc.i4 30000
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brtrue.s IL_0068: leave.s IL_0093
ldloc.1 <null>
callvirt System.Void System.Threading.WaitHandle::Dispose()
leave IL_01A4: ret
leave.s IL_0093: leave.s IL_00A4
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0093: leave.s IL_00A4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01A4: ret
ldloc.1 <null>
callvirt System.Void System.Threading.WaitHandle::Dispose()
leave IL_01A4: ret
leave.s IL_00A4: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01A4: ret
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
leave.s IL_00B9: ldsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00B9: ldsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
brfalse.s IL_00C7: ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
br.s IL_00DD: call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldftn System.Void PooledNodeAccessor/<_Closure$__>__Impl::_Lambda$__0-0(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_slotslot74>k__BackingField
brfalse.s IL_00F5: ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldsfld System.UnhandledExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_slotslot74>k__BackingField
br.s IL_010B: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldftn System.Void PooledNodeAccessor/<_Closure$__>__Impl::_Lambda$__0-1(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_slotslot74>k__BackingField
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> PooledNodeAccessor/<_Closure$__>__Impl::<_cachedbuffer39>k__BackingField
brfalse.s IL_011E: ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> PooledNodeAccessor/<_Closure$__>__Impl::<_cachedbuffer39>k__BackingField
br.s IL_0134: call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldftn System.Void PooledNodeAccessor/<_Closure$__>__Impl::_Lambda$__0-2(System.Object,System.Threading.Tasks.UnobservedTaskExceptionEventArgs)
newobj System.Void System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> PooledNodeAccessor/<_Closure$__>__Impl::<_cachedbuffer39>k__BackingField
call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
brfalse.s IL_0189: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldsfld System.Threading.ThreadStart PooledNodeAccessor/<_Closure$__>__Impl::<m_context95>k__BackingField
brfalse.s IL_0153: ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldsfld System.Threading.ThreadStart PooledNodeAccessor/<_Closure$__>__Impl::<m_context95>k__BackingField
br.s IL_0169: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldftn System.Void PooledNodeAccessor/<_Closure$__>__Impl::_Lambda$__0-3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart PooledNodeAccessor/<_Closure$__>__Impl::<m_context95>k__BackingField
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
dup <null>
callvirt System.Void System.Threading.Thread::Start()
callvirt System.Void System.Threading.Thread::Join()
br.s IL_019E: ldloc.1
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FormMain::.ctor()
call System.Void PooledNodeAccessor::LoadRawSlot(System.Windows.Forms.Form)
ldloc.1 <null>
call System.Void System.GC::KeepAlive(System.Object)
ret <null>
Module Name
NetSession60.exe
Full Name
NetSession60.exe
EntryPoint
System.Void PooledNodeAccessor::Main()
Scope Name
NetSession60.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
NetSession60
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
1114
Main Method
System.Void PooledNodeAccessor::Main()
Main IL Instruction Count
122
Main IL 
ldc.i4.0 <null>
stloc.0 <null>
ldnull <null>
stloc.1 <null>
ldc.i4.1 <null>
ldstr b96b8702-3c58-4d3f-a9e0-e5b065fac0f9
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
leave.s IL_0023: ldloc.0
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01A4: ret
ldloc.0 <null>
brtrue.s IL_00A4: nop
ldc.i4.0 <null>
stloc.2 <null>
call System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
stloc.3 <null>
ldloc.3 <null>
newobj System.Void System.Security.Principal.WindowsPrincipal::.ctor(System.Security.Principal.WindowsIdentity)
ldc.i4 544
callvirt System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
stloc.2 <null>
leave.s IL_004D: ldloc.2
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_004D: ldloc.2
ldloc.2 <null>
brfalse.s IL_0088: ldloc.1
ldloc.1 <null>
ldc.i4 30000
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brtrue.s IL_0068: leave.s IL_0093
ldloc.1 <null>
callvirt System.Void System.Threading.WaitHandle::Dispose()
leave IL_01A4: ret
leave.s IL_0093: leave.s IL_00A4
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0093: leave.s IL_00A4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01A4: ret
ldloc.1 <null>
callvirt System.Void System.Threading.WaitHandle::Dispose()
leave IL_01A4: ret
leave.s IL_00A4: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01A4: ret
nop <null>
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
leave.s IL_00B9: ldsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00B9: ldsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
brfalse.s IL_00C7: ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
br.s IL_00DD: call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldftn System.Void PooledNodeAccessor/<_Closure$__>__Impl::_Lambda$__0-0(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_defaultbuffer33>k__BackingField
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_slotslot74>k__BackingField
brfalse.s IL_00F5: ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldsfld System.UnhandledExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_slotslot74>k__BackingField
br.s IL_010B: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldftn System.Void PooledNodeAccessor/<_Closure$__>__Impl::_Lambda$__0-1(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler PooledNodeAccessor/<_Closure$__>__Impl::<_slotslot74>k__BackingField
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> PooledNodeAccessor/<_Closure$__>__Impl::<_cachedbuffer39>k__BackingField
brfalse.s IL_011E: ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> PooledNodeAccessor/<_Closure$__>__Impl::<_cachedbuffer39>k__BackingField
br.s IL_0134: call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldftn System.Void PooledNodeAccessor/<_Closure$__>__Impl::_Lambda$__0-2(System.Object,System.Threading.Tasks.UnobservedTaskExceptionEventArgs)
newobj System.Void System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> PooledNodeAccessor/<_Closure$__>__Impl::<_cachedbuffer39>k__BackingField
call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
brfalse.s IL_0189: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldsfld System.Threading.ThreadStart PooledNodeAccessor/<_Closure$__>__Impl::<m_context95>k__BackingField
brfalse.s IL_0153: ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldsfld System.Threading.ThreadStart PooledNodeAccessor/<_Closure$__>__Impl::<m_context95>k__BackingField
br.s IL_0169: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld PooledNodeAccessor/<_Closure$__>__Impl PooledNodeAccessor/<_Closure$__>__Impl::<_cachedcell43>k__BackingField
ldftn System.Void PooledNodeAccessor/<_Closure$__>__Impl::_Lambda$__0-3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart PooledNodeAccessor/<_Closure$__>__Impl::<m_context95>k__BackingField
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
dup <null>
callvirt System.Void System.Threading.Thread::Start()
callvirt System.Void System.Threading.Thread::Join()
br.s IL_019E: ldloc.1
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
newobj System.Void FormMain::.ctor()
call System.Void PooledNodeAccessor::LoadRawSlot(System.Windows.Forms.Form)
ldloc.1 <null>
call System.Void System.GC::KeepAlive(System.Object)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙