Sample details: 187aa5bb5b1fcbd1c95bf07e8dd41a2d --

Hashes
MD5: 187aa5bb5b1fcbd1c95bf07e8dd41a2d
SHA1: 2daac5060582303143e6dac38993a23b0a2e91b0
SHA256: 9e0f8248c9939e00f9281ae5fd7e7be72c50896789f99a94d482d954dfd03e71
SSDEEP: 6144:nxq3UAEs8l7J2QYxfZdRSlGwtHKtQ92LQa29UjuJ5ngVdx4uO+m/F9ODgJP:x3Amd5wB3wRKe928a29dngbmPODgR
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Studio_NET | YRP/Microsoft_Visual_C_v70_Basic_NET_additional | YRP/Microsoft_Visual_C_Basic_NET | YRP/Microsoft_Visual_Studio_NET_additional | YRP/Microsoft_Visual_C_v70_Basic_NET | YRP/NET_executable_ | YRP/NET_executable | YRP/NETexecutableMicrosoft | YRP/IsPE32 | YRP/IsNET_EXE | YRP/IsWindowsGUI | YRP/IsPacked | YRP/IsBeyondImageSize | YRP/domain | YRP/IP | YRP/contentis_base64 |
Source
http://eastcoastrest.com/frep/fretuguuy.exe
http://eastcoastrest.com/frep/fretuguuy.exe
Strings
          	            !This program cannot be run in DOS mode.
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA&<=
qs3g!z/
NyNkNxN^N_N^NzN
NBNLNON
NwN-N)NRN0NBNMNhNXNCNJN!N
N^N=N0NwNLN=NXNMN>NNN
NJNnN,NFN
:5NaNRN,N`NpN"NMN
N NAN~NfN
N!NfNeNpN
NLN$NIN9N
N]N'Nj
8:NKNTNmNBNYN
N@N?N1NwNINHNBN.NbN8N$N$NpNnN]N
(<NeN>N:NFN
NBN^N(NhN0N
NNNRNmN
NcNiN)NUN
NnN>NLN
NWNpNrNHNxN N
N@NvNlN
4@NGN5NwN
NjNcN2N~N9N
N2NaN#N
NBN|NjN
NkNdNmN/NKN4NdNSN
NXNvNKNINdNxNsN
N]N6N}N9N9N#NoNKNbNaN@N
NqNRN9N*N6NvN
2ZN}NnNzN
NWN(NeN
N0N,N@N
NoNNN]NpNLN	N]NON>Nh
F\N;N}NsN
N,N0N\NDN%N
NzNONQNaNINmN{NaN	NdNaNBNpN
NpNzNkN
NRNSN/N7N!NlNYNcNSN
FhNANoN N
NRN|NyNJNiNDN
NFN:NpN#NJN
NJN\NvNiN
N;N.Na
FoN*N<NuN0NbN}NaNxNQNfN
N#N&NHN
NpN8N^N
NcN6N4N
NuNxN NaNqN_N#N-NSNFNJN}N
NwNhN)N4NWNeN|N
NyNrN\NeN#N\NxNlN,NFN(NvNpN~N
N;N,N"N>N)N!N-NFNSNPN N
NsN|N#NqN
NGNMN7N,N
N*NhNQN1NcN{N{NwN
NDN5NcN$NBN
NxN8NUN)N?N8N
NuNZNtN@NEN0NVN<NMN1N>N2N
N,N_NHNINrN
N`NiNRNUN0N
.hF)-G
:NF3y-
q'ZD.h
&=NYt:
@0'eUo
sz_{fv;
ANc4J;v
c)d#k&eL
'bELXU
LR1ll`
8pX3,p
NE$`[+1
D:&Vm'U=8
jS:NU_OsN6u|
|D_tC)
2:Rx%p;
71i;]X
34?(w])
CYFG6,i]
<g!,XH
/^m9NKs4
XOj*%P
C"&.$Tf
=l724b~j
z"D2m-
'B8~3c<_
8t gBd
4}>cI}
Mz*c&F
hn1t2T
lh}dg`
pHg>F@
M6uhKSB
W)CVYws
TzoX9Q
{SF 	OR
ZJD'HW
Jel&]Pf
j4e##D
hW_\?.
!#PzB\x
pG=$hY!^ O%
s7L[\O
]P`ywp
!j+eF}	h
 XpJF:o
pGW=kBVVw
u7;N='
*Y	M-l9
b;{b+1
)'f 3s
9=|BuF
V)$h;9
}^W02%.
w&-.@_
!JPfV4
`Q**h3
QL:p>D
 #CD8o9C
e/!)TE2
4RZ0<[
,f1[d6m
jz\p	}P
N?F5UV
L#W_LN
:A2 	O
B^9-W!1
#Up7..
OmSk>e
A-zB{I
su8(}V
y^l}YtN
LOhy/L!
YB\{}]C
s5-qO^
m_9x!J
UPcUR]
C=X>29
wlP[tD?
%paJ=`
KEaC4$X6
Y`G$8Q+
SEp{3A
4\.DoG
:dNf	B
B@t$2O
C9;A*Jn
#A`lKV
}Rw{!]w]
7{$"Wo-
pWqiM~
6u<"n\#
,q<QRT
*l[?l	
!?X(&K
n44md<?
`DuTXzB
z*cn'`7
`3y}PmL
La@$vr
G>1m*\	E/h
kk&rQX
9c3JJh
9%,C&6cUD2a
Y`e49D9e
Pe4JDH
cGQn*7
}N$j+Ep
BT7/v"
9bCrDh
uksYC+
"xE;i<
e/1"iW	
Ao,B*Q
:ht.(x
-1Dq=o
uaZv3:
j*.,~62
M@<VR|N
f06)sk:
zK ~ u>
k,}b.,n
R)-`=99A
	ZUrQFS;
0LJ#d.
.,4G:5Q
h>^RvK
aKM)gby
^:k*;O
rFl*5!
bM-$`j
^Bb4xM
^n{+r;_h
hK0x&\
B, "$R
T?47:nw`
]l|=tm6
oY6a>j
c?umd5M
4&ek Uo
05tl~E
;T6)(PN
I;}K.b4-
m=Qbu~
?uhDIO
5=d69W
dY%(v&Wr
Q<.tWHr?
lZMMyM
p>Wg4*
LmRL$|
AgIIY(D
X@TW6&
N0z	pY
,SoRK8f
n	|?iIq
{NA]8L
gz\Voc
(	Ej}@
CspTZ&
(VQ.8fi
nDZyJE
oC;<7 
,1@_/]
q7\}Ay
Ef6RSU
{g<Y,x
:SjhT7l
V)o)$ei8
59-o.vb|
 /";oQ
]H.iFJ
jG:buE
cR-lt]u
Gk!pJV:X
Qk8w`0H
4<+wl3(
od/AIml
YU|ktc
jpYd[P}
	#$ss=w
*,/:N<
roeN!+
E;=V3J
tq$rZH
@I3A.;3>
2?LpXn
qg'H_b
b_1l<Q
Xf6men
FU(}7:-&
6qj'@\
JV3fPXW
99*!!^#
9Mk2a9
)M.iI8,P
](%BQ*Y"
\c7100Q
NiLli2
6~[cjZ
a8wzi]
_=X)|C
jDcy?|
i$|*<P7
W&OpzT9x
5,tke@
D7m<	otb
J0z/O 
S1x5_#
t)3J2B
:"!d*r
92s9>5
w~,[>a
;@O$7p_
?i=KM9#
 +vs?h
]jGr;281G 
GOw*cv
4"0<Q34
VE"MV>
KmXGNJ
AviD7	
'->RKi
 X?N9]
]JeAqE
E="wNs
tLFT/GDE
R?oM*(
7f=<&naq`
z7(z m
_0+WYd
T]r3Zj
5[Th@}
SwOKvW&
VY'WMb
SC}?A8T
z-Lw&`
_"+3p^ 
OOJJ"%
_R ]S4b
QWE03]G
7Sd]Pb
az;>_y
__N"7k
2r|Y~@
dg{	f 
) {5[%^o
iWVVC3
Gq#MMF=
,8,DbD
vC	CW;
]2+r~)
3L3dy8;z
7	JC~Bq
3O2g}r([+j
&F8T	c
7O*0Rd
|T(s;~
S<\S_J	
]><KYn
)xx%IT5
Ys6o`MX
Q^b]18
wg(U7*
2lz<^F
X^B$K$
PkB>\/
i"J7	G
?d(U@y
NR>O>I
3K2~|FJ
0$Uns-
xsL,%*
9ja&h/_
$q.PI)7
{oiV4{
rs@Q7N
z{u3?b
*W7@;$
VJ>Kw`
gTgx|hw1
xkLbMB>
<~[C.5N
/{%;/>4:
Xs9k&V
F^nHIO
C!n{o=
6o/?gS
" >oHM
qg %9?Q
-a{+qx
Q@bfOb<
1MP`%z
5a}5iB
*.Wa_B
pC,s5v
!S.,;e
44Prg`
u4eG4s.
3X-'Nx@
G!u7bj
'\p'9of
:V5H~*
+}jXwcA
x#L og
6fE2%O
Vr4]kp
<`h#[A
cgGmt+U
/&,:N[
wkr$-n
FW-}&5
v76` R>js !PQ
;i\BB]
@{-XBv
kMMq-.
3D,q#x
n/3<} 
- Hrb's
2b6o )
yg;M1k
e	dwit
:ILuKU
0D?De*
nh#EVx"
^B`O%+
dB	X>2
=AD*cr
y5"s5uqsK
~T>Z?o
d($z/]
af&O9F
	aTJ]f
)cg,W'
dfWPBpjj
Qyf?hk
?cZX!3
]TL_.Ww
<LT4nL:
&"D,o6Z
Pq;O7+Kcn
+k`qs6
ghoim5
/?N/0x]
EE4>lC
a0?MHW
OLJ#~H
j"qGV]a
vGiAzo
]q;-uh
Rjb|A3
(cOf&E6@Y*k
dv3]:f`
v,#C!]CYN
FjF7(o
<7O-\v
=|!Czp
H7+tm]
hj)5bk
9*dO=s
c|4#4[
Zf&sr*
^4}\ke;f
sq36x'v
-T&n:	?
)$y>Kv
*GdI$ 
zb%31Z
VamMEa
_gf}.6
Zg3v&a
lBW#}W
+c@q2e
*o8<uj
s'U4oe%&
"kL*)	#.&
smNh>*R
uKw_#:
wqS$YX
OiMi&{
|FBGj!
]4xVv^
2A;\_3
,CZ TP^+
E8pDZ1
[7r(V{
z^v[pZ
Y='r$C
::g)Uw
;Z\*"d
VnHy]4'!
u[m{dj
cL}o	Q
n;|uc.
3LBwL#
Re24Y@
"gYX}dxr{
]l1>/|#
3@u|u@[
JqGujz
j}+/sG
J~	P	H9I3
p>K_T]
@58M,R
|S^]#A
9L"2+R
B*6~e|2J>
A4F'jw
KosTFb
? g}G*:|M
Z kZ$c]
xM-ZoG
	*AHcy-
04PY/{,}E
? zq\&
,0Ulj=
DG9q1d
IZ(fIK"
~o*opm#
Gh<b	P
*GM@7$
.GI+*l
+!,Gr9
775)gZ
pi\i+j
A[Tc"J>
2(ak~yN"
A*"~6aq
[^o`!rd
'eH[oN
?L6 <)
ZB#G7W
O>NdGv	m
)cd4g7
-rAF/e}
H`1(,4
l;[;NvX
L_}8RI
tRM~$}h
+AP,Xz
Y6K7O(
Dkz&cE
v2.0.50727
#Strings
#Strings
#Schema
NAIUHUs0yos2VScPF
mscorlib
UnverifiableCodeAttribute
System.Security
Eg2UmizHvBHA7AEv7M2
PNIdCy0vr4iOGfPR
.cctor
kGvyGjMl0S2FdBz3
0Sk71iOjoKYH5
Object
System
ksmQqpnaYaSmQFZKeJ
2P2olBMX5ebaTPRJGE
2Muz7EGINQexy4rp
6oz2CIUbCTPW
gevumdRstAWHDnr
A0F7eh11xYlpoUuLK4
RRTKgHw1OGfopRRa
UG9V7r0C2rFLQ4
u3qtATYW5VFXk
z7PD1HdUNvB3
T3y13AeuAt4NaKy4
sjlsTLShKG
qc1Lta0u6z6QHuT
GNJ83DYaUAm9sKSs5Z
hdsYq0f89gM
zqM7WqJFnDJsRX14
7tOqDGrIkbWekh
4jlouQvVJWmr
aUXRyZrTbQ8sAV0A
Fr6lMlusXqSk1PfAm
XF8LCdXU0y7UG
uGMF3CukwXpABibnb4
gg40kaztbCYyAdEr
yqsowNyNNT83SD4IS
VoNC8OB14CU
RuntimeTypeHandle
Microsoft.VisualBasic
CallType
Exception
System.Windows.Forms
DialogResult
PropertyInfo
System.Reflection
MemberInfo
MethodInfo
ConfusedByAttribute
Attribute
fretuguuy
CompilationRelaxationsAttribute
System.Runtime.CompilerServices
RuntimeCompatibilityAttribute
ParamArrayAttribute
.resources
String
GetTypeFromHandle
Interaction
CallByName
get_Message
MessageBox
GetType
GetProperties
get_Name
op_Equality
GetMethods
ToString
NZNWN*N$NRNaN>NzNUNHNLN
NSN4N	NJN
GoN*N<NuN0NbN}NaNxNQNfN
N#N&NHN
NpN8N^N
NcN6N4N
NcNiN)NUN
NnN>NLN
NWNpNrNHNxN N
N@NvNlN
NuNxN NaNqN_N#N-NSNFNJN}N
NwNhN)N4NWNeN|N
ConfuserEx v1.0.0
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
WrapNonExceptionThrows
_CorExeMain
mscoree.dll
xc'kAux,
J@PU(S
Mbld}\Y=
mQU%n\
u9A*vUM
*6I'GG
`^zbvm
cm"{8QiI.;h
D-4o#7
JA8-Cn
L0|W/$
H2u6M'
t1Qy<=X
CG>UXL-Rd}
2\Sb+N
Y-r#Ue
1z=^m!].
X]NYW%
v@JL u`A
GCw":)
@EUSd,
GBI$&n
(p-/0~p
'IBifm
=w8MuV1
#TeNilI
|Z0/MUTF+G
UJV77~
uUl:]NV
6i\EITDiT
9&&F=:B)
)I=cu9
	w:JiO
U13RMY
;Qb"bbv*>:(
&n>Ie2
rme|XtG
.Uj%W)G
`|??Y&Q0
J8FF.z
T-kBU+
8vcA6.
%n:OuV
>udc`"P
=X;?s!
mTWY,,}
 hd|J`
Yu&]u&YC
t]lg{t0
719Ufb
:##"3^D
'n>K|Q$
^mQA^&
wrDT7@
thl:0iwh
AIOBW A
OMSpU7
M	@ADg~
"K0	(M
waxq-DR
5Bl	&e
vQrKtQ
|Q&Z6F
W!"&R!fb/>Z
I{}M{C
B3\#38C
{~aZ^3
q!hg)\
$n6I|9
O1j)b2
TH:=pY
^iNN0|
!Y]QxGdM
Q6A~+n
;9dw22~:e
984PEv
|ZIw|pD
vRW58{
U#;G#R
9bjHQ*
 (GE1SWW
j|\Uz(|
/U8>~X
Rf&"Rk
I5</6D$`
[Q06QRY
a<i"H`:
Vf"hEB
BiJ@IP
4KJ/`k
C2JdTa
;wneeY
k[aPe6
UY&'I>|zu
G7!,H@
"}7MSx
UD;BCN	)eP
'c,vwwQ
g77:wgs
2+EDdD
pvz:zk~
8:06=;=;q5NhF)
qYbYG8
JaF)|e-6
<!H0Dd
:V%8dPH
"^#0;3
.Tcib*
 a#0	|
=:s~	W~
uLOOcm
;:FS+|^
R8>:&"
2vwwhc}
9t{]RZ
Kwoarr
u;xwf6^h4
>Z\NY$
&/A~O$
`IprrB
n%	8Rx
#N ND, 
xeq997;
1Q//4	E
LLElJ]
]95?7b7
s5W?jF
R*VN%J
@AXyos0
FZU6^<2
] KAZa
A5RbfP