Hostile ^92% datasets Download

CNET_245545.exe

Embedded base64 PE payload

Detects Base64 encoded Executable in ExecutableSteganography Dropper (Bitmap + AES + Download)

SHA-25619d7fc24e2fe0aa138e8084ff2a31e4e249263382bbe37924c7cc7631f90b4c3

MaleculeK₂(LiMc)O₂(C₂As₃)H₇(Cm₆Cr₅Db₁₀DsF₂Os₂Po₇)Md₆(Bi₂BkPaPtSi₃)Th

Evidence

.NET metadata root signature (BSJB) 0x185e00–0x185f80

⋯7 more rows
0x185e70c7e607d9738dc869da73afea1bbc805e....s..i.s.....^
0x185e8042534a4201000100000000000c000000BSJB............
0x185e9076322e302e3530373237000000000500v2.0.50727......
⋯15 more rows

.NET symmetric encryption API reference 0x1b3856–0x1b3b16

⋯17 more rows
0x1b39666d2e53656375726974792e4372797074m.Security.Crypt
0x1b39766f67726170687900437265617465456eography.CreateEn
0x1b398663727970746f72004943727970746f54cryptor.ICryptoT
0x1b399672616e73666f726d007365745f417061ransform.set_Apa
0x1b39a672746d656e7453746174650041706172rtmentState.Apar
⋯12 more rows
0x1b3a766765745f4d616368696e654e616d6500get_MachineName.
0x1b3a866765745f55736572446f6d61696e4e61get_UserDomainNa
0x1b3a966d65004f7065726174696e6753797374me.OperatingSyst
0x1b3aa6656d006765745f56657273696f6e0043em.get_Version.C
⋯7 more rows

.NET BitmapData locked-bitmap descriptor 0x1b426d–0x1b433d

0x1b426d65496e766f6b65006765745f50617265eInvoke.get_Pare
0x1b427d6e74006765745f496d61676500736574nt.get_Image.set
0x1b428d5f546f704d6f7374004269746d617000_TopMost.Bitmap.
0x1b429d4c6f636b42697473004269746d617044LockBits.BitmapD
0x1b42ad6174610053797374656d2e4472617769ata.System.Drawi
0x1b42bd6e672e496d6167696e6700496d616765ng.Imaging.Image
0x1b42cd4c6f636b4d6f646500506978656c466fLockMode.PixelFo
0x1b42dd726d6174006164645f4265666f726543rmat.add_BeforeC
0x1b42ed6f6c6c61707365005472656556696577ollapse.TreeView
⋯5 more rows

.NET symmetric decryptor creation 0x1b46b7–0x1b49a7

⋯5 more rows
0x1b47075f44726f70446f776e4d656e75004d65_DropDownMenu.Me
0x1b47176e75004765744d616e69666573745265nu.GetManifestRe
0x1b4727736f7572636553747265616d00546400sourceStream.Td.
0x1b4737576562436c69656e74006765745f5554WebClient.get_UT
0x1b47474638007365745f456e636f64696e6700F8.set_Encoding.
⋯5 more rows
0x1b47a7646174696f6e007365745f53656c6563dation.set_Selec
0x1b47b77465644e6f646500546b004874747057tedNode.Tk.HttpW
0x1b47c76562526571756573740053657456616cebRequest.SetVal
0x1b47d7756500417267756d656e744f75744f66ue.ArgumentOutOf
0x1b47e752616e6765457863657074696f6e0049RangeException.I
⋯9 more rows
0x1b488774696f6e004576656e74576169744861tion.EventWaitHa
0x1b48976e646c6500536574004765744d657468ndle.Set.GetMeth
0x1b48a76f640057656250726f7879004d616e75od.WebProxy.Manu
0x1b48b7616c52657365744576656e7400544c00alResetEvent.TL.
0x1b48c746726f6d44617973007365745f4c696eFromDays.set_Lin
0x1b48d76573006765745f466f6e7446616d696ces.get_FontFamil
0x1b48e77900466f6e7446616d696c7900537461y.FontFamily.Sta
0x1b48f77274006765745f53697a65007365745frt.get_Size.set_
0x1b490749636f6e0049636f6e00436865636b65Icon.Icon.Checke
⋯7 more rows
0x1b49876e417070656172616e6365007365745fnAppearance.set_
0x1b4997426f72646572436f6c6f720043726561BorderColor.Crea
0x1b49a77465446563727970746f720042696e61teDecryptor.Bina

Uses RijndaelManaged/AES in .NET 0x1b62d6–0x1b6506

⋯3 more rows
0x1b6306636573006765745f4973416c69766500ces.get_IsAlive.
0x1b6316586d6c53657269616c697a657200446eXmlSerializer.Dn
0x1b632673005265736f6c766500694d00736574s.Resolve.iM.set
0x1b63365f50726f78790048617368416c676f72_Proxy.HashAlgor
0x1b63466974686d00436f6d7075746548617368ithm.ComputeHash
0x1b63560044534143727970746f536572766963.DSACryptoServic
0x1b63666550726f766964657200697a004d4435eProvider.iz.MD5
0x1b637600546f426173653634537472696e6700.ToBase64String.
0x1b63866765745f446179006f705f4c65737354get_Day.op_LessT
⋯4 more rows
0x1b63d664656e7469616c73006765745f4d6f64dentials.get_Mod
0x1b63e6616c00434e0052696a6e6461656c4d61al.CN.RijndaelMa
0x1b63f66e616765640050616452696768740043naged.PadRight.C
0x1b6406727970746f53747265616d0043727970ryptoStream.Cryp
0x1b6416746f53747265616d4d6f646500466c75toStreamMode.Flu
⋯4 more rows
0x1b646643727970746f67726170687950726f76CryptographyProv
0x1b647669646572456e756d0052696a6e646165iderEnum.Rijndae
0x1b64866c0053697a6552616e67650066726f6dl.SizeRange.from
0x1b649600746f00756e697446726f6d00756e69.to.unitFrom.uni
⋯7 more rows