Purchase order.exe
Obfuscated .NET dropper with C2
Business document lure with a .NET payload decoding or loading chain.NET reflective resource loader with scrambled identity (crypter stub)
SHA-25608edc0df73427e600402e4f2529d5284b17ccb16f4c24594869ca7e6ddc33936
Evidence
0x8033483675a84d298f8f0626cc3d7cb265b91.gZ.....bl...&[.
0x80344abd9fa80c59cbddc332281ffa0525477........3"...RTw
0x80354bb61525377c13d686e8bb16512292d2b.aRSw.=hn..e.)-+
0x80364b4000000cecaefbe0100000091000000................
0x803746c53797374656d2e5265736f75726365lSystem.Resource
0x80384732e5265736f75726365526561646572s.ResourceReader
0x803942c206d73636f726c69622c2056657273, mscorlib, Vers
0x803a4696f6e3d342e302e302e302c2043756cion=4.0.0.0, Cul
0x803b4747572653d6e65757472616c2c205075ture=neutral, Pu
0x803c4626c69634b6579546f6b656e3d623737blicKeyToken=b77
0x803d461356335363139333465303839235379a5c561934e089#Sy
0x803e47374656d2e5265736f75726365732e52stem.Resources.R
0x803f4756e74696d655265736f757263655365untimeResourceSe
0x8040474020000000000000000000000504144t............PAD
0x8041450414450b4000000c8b50600cecaefbePADP............
0x8042401000000910000006c53797374656d2e........lSystem.
0x804345265736f75726365732e5265736f7572Resources.Resour
0x8044463655265616465722c206d73636f726cceReader, mscorl
0x8045469622c2056657273696f6e3d342e302eib, Version=4.0.
0x80464302e302c2043756c747572653d6e65750.0, Culture=neu
0xeb9689057550ba39d8d4cccce97a8abc7e6b8.WU....L........
0xeb978ba1fd9087395e5ab533686a44613df84....s...S6..F...
0xeb9885db24ab82e43972ebb2db4bba5a9366b].J..C...-....6k
0xeb99841bdf9eeded501939e22fb46478f8d3fA........".FG..?
0xeb9a8c50e5a83202a0e12e023e68e1c0d7cf8..Z. *...#....|.
0xeb9b858986e2f65ec556e250c899702f8c377X.n/e.Un%......w
0xeb9c887e03ddb42567571cc3289832444cb4d..=.BVuq.2..$D.M
0xeb9d87da58d3cacafa829c1156fcf4d45b70b}..<...)..o.ME..
0xeb9e842534a4201000100000000000c000000BSJB............
0xeb9f876342e302e3330333139000000000500v4.0.30319......
0xeba086c00000008830000237e000074830000l.......#~..t...
0xeba18386d000023537472696e6773000000008m..#Strings....
0xeba28acf00000848d000023555300307e0100........#US.0~..
0xeba38100000002347554944000000407e0100....#GUID...@~..
0xeba483435000023426c6f620000000000000045..#Blob.......
0xeba5802000001579fa22b091f000000fa2533....W..+......%3
0xeba680016000001000000c10000006a000000............j...
0xeba78f90100000a0300000802000001000000................
0xeba881e03000067000000ac02000001000000....g...........
0xeba98fe0000001a0000008b00000008010000................
0xebaa801000000930000000100000001000000................
0xebab80700000003000000550000000b000000........U.......
0xebac83a000000020000000000aa4b01000000:..........K....
0xebad80000060092614a4b0600b1024a4b0a00.....aJK....JK..
0xebae8b739e75b .9.[
0xf71c7726d617474696e67456e61626c656400rmattingEnabled.
0xf71d76765745f4973446973706f7365640053get_IsDisposed.S
0xf71e7796e6368726f6e697a6564004d676b36ynchronized.Mgk6
0xf71f737664b724139666400397369414737677fKrA9fd.9siAG7g
0xf72076764004e65774775696400646135507agd.NewGuid.da5Pz
0xf721739437a4b6f316d6a64006f5163364b349CzKo1mjd.oQc6K4
0xf722762796d6400486573397852356e640052bymd.Hes9xR5nd.R
0xf72376e6400417070656e6400526f756e6400nd.Append.Round.
0xf72474765744d6574686f6400536772396154GetMethod.Sgr9aT
0xf725733774c34706400526b396e706f4635453wL4pd.Rk9npoF5E
0xf72673473640071526931466d3869364373644sd.qRi1Fm8i6Csd
0xf7277003567714879533678396b5274640057.5gqHyS6x9kRtd.W
0xf7287717233364c737964005972356d79426bqr36Lsyd.Yr5myBk
0xf72973146367a640066506f3653306500436b1F6zd.fPo6S0e.Ck
0xf72a73577375173704e7063306500387970505w7QspNpc0e.8ypP
0xf72b7446730650036456f7a46746730650035Dg0e.6EozFtg0e.5
0xf72c7427077596d30650030467a7471733447BpwYm0e.0Fztqs4G
0xf72d73165005a6674347054316500546772381e.Zft4pT1e.Tgr8
0xf72e77045375f3265006179394a6638466a41pE7_2e.ay9Jf8FjA
0xf72f764793265004b7a64356500354665786fdy2e.Kzd5e.5Fexo
0xf73076454314c3665003774794b776446336edT1L6e.7tyKwdF3n
0xf73175339650037616a5053653965006d5767S9e.7ajPSe9e.mWg
0xf7327396500367071534c6b396500666734439e.6pqSLk9e.fg4C
0xf73376500734d613270613950643844650048e.sMa2pa9Pd8De.H
0xf7347636d316e385f446500 cm1n8_De.
0xf87e44d6d006f61384c6e355a71536d006562Mm.oa8Ln5ZqSm.eb
0xf87f4384835506377536d0034667a536d00348H5PcwSm.4fzSm.4
0xf880474665367546d00796f3853597a733064tfSgTm.yo8SYzs0d
0xf8814395a6d0061703258317348656d5a6d009Zm.ap2X1sHemZm.
0xf88244765744d616e69666573745265736f75GetManifestResou
0xf883472636553747265616d006765745f456erceStream.get_En
0xf8844644f6653747265616d004d656d6f7279dOfStream.Memory
0xf885453747265616d0030467965616d004c71Stream.0Fyeam.Lq
0xf8864396e616d0036577969526a306a32636d9nam.6WyiRj0j2cm
0xf8874006765745f4974656d007365745f4974.get_Item.set_It
0xf8884656d006765745f53656c656374656449em.get_SelectedI
0xf889474656d00546f6f6c5374726970497465tem.ToolStripIte
0xf88a46d0053797374656d007a6e3054374d66m.System.zn0T7Mf
0xf88b46d005069345f3552786158666d003843m.Pi4_5RxaXfm.8C
0xf88c46a666d00356a744a596f377a32676d00jfm.5jtJYo7z2gm.
0xf88d453796d6d6574726963416c676f726974SymmetricAlgorit
0xf88e4686d005472696d00526a396977344a79hm.Trim.Rj9iw4Jy
0xf88f436446b6d00326a734d6e6b593834456b6Dkm.2jsMnkY84Ek
0xf89046d006f4d6a32346d6d006a506437356em.oMj24mm.jPd75n
0xf89146d004a777a3572365878344873656e6dm.Jwz5r6Xx4Hsenm
0xf892400466f726d004943727970746f547261.Form.ICryptoTra
0xf89346e73666f726d00456e756d00346f7152nsform.Enum.4oqR
0xf894467456239776d004466325f783342794cgEb9wm.Df2_x3ByL
0xf8954776d00364577776d006769334a4b3561wm.6Ewwm.gi3JK5a
0xf89646d786d00314e70796d0062643346346fmxm.1Npym.bd3F4o
0xf89745970796d004266316333505f6766306eYpym.Bf1c3P_gf0n
0xf89840031695f466a6a543279306e006e7335.1i_FjjT2y0n.ns5
0xf8994484333787a72576932316e00536b7735HC3xzrWi21n.Skw5
0xf89a46936506d447278326e006f546534336ei6PmDrx2n.oTe43n
0xf89b4007344733234 .sDs24
0xf96266f72007365745f55736556697375616cor.set_UseVisual
0xf96365374796c654261636b436f6c6f720046StyleBackColor.F
0xf96466c6f6f7200436c65617250726f6a6563loor.ClearProjec
0xf9656744572726f720053657450726f6a6563tError.SetProjec
0xf9666744572726f720049456e756d65726174tError.IEnumerat
0xf96766f7200476574456e756d657261746f72or.GetEnumerator
0xf968600416374697661746f72002e63746f72.Activator..ctor
0xf9696002e6363746f72004d6f6e69746f7200..cctor.Monitor.
0xf96a6437265617465446563727970746f7200CreateDecryptor.
0xf96b6437265617465456e63727970746f7200CreateEncryptor.
0xf96c63773634a503572707200386f5f4264577scJP5rpr.8o_BdW
0xf96d6316a33727200337064477450387372001j3rr.3pdGtP8sr.
0xf96e6525f73336f3166414679377472006765R_s3o1fAFy7tr.ge
0xf96f6745f486f75720062526a30317772007at_Hour.bRj01wr.z
0xf97064a643177720058733474713350635477Jd1wr.Xs4tq3PcTw
0xf97167200477a326230537872006b78375039r.Gz2b0Sxr.kx7P9
0xf97264e6279720037635f5177596a30317300Nbyr.7c_QwYj01s.
0xf973669733552543173006d5f355063325465is5RT1s.m_5Pc2Te
0xf9746317300346e665a526b31730031646d521s.4nfZRk1s.1dmR
0xf97564d32730037747250706d4d327300794cM2s.7trPpmM2s.yL
0xf97667439583366773273007277314869477at9X3fw2s.rw1HiGz
0xf9776343373004c717139676a34465833730043s.Lqq9gj4FX3s.
0xf97867a63324c317841726a4a653373003046zc2L1xArjJe3s.0F
0xf9796796942786e33730031617a4462644b34yiBxn3s.1azDbdK4
0xf97a67300777a3352364a66664879693473 s.wz3R6JffHyi4s