Sample details: 86007c93bcdff4b47f74080e6b47b7a7 --

Hashes
MD5: 86007c93bcdff4b47f74080e6b47b7a7
SHA1: cb5f5f4de54a800c563de2f292f6bf9dcaa5d52a
SHA256: 0ee24ac4bc9fffd125d9b05db6d413fce000a1e2992f36cef0bd8ac4f10a5674
SSDEEP: 6144:AFjX9TQUfmyxqnjJrKIj2mE+pyKuXcanJm9Vw3WvNXsAk2MTwoCEdlAbjQTF13:AZ9TQUOyxMYIjFE+pyXBJyVwB/L8YTF
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Studio_NET | YRP/Microsoft_Visual_C_v70_Basic_NET_additional | YRP/Microsoft_Visual_C_Basic_NET | YRP/Microsoft_Visual_Studio_NET_additional | YRP/Microsoft_Visual_C_v70_Basic_NET | YRP/NET_executable_ | YRP/NET_executable | YRP/IsPE32 | YRP/IsNET_EXE | YRP/IsWindowsGUI | YRP/IsPacked | YRP/domain | YRP/IP | YRP/contentis_base64 |
Source
http://dugunmalzemeleri.org/wp-content/uploads/BankSlip.exe
http://dugunmalzemeleri.org/wp-content/uploads/BankSlip.exe
Strings
		!This program cannot be run in DOS mode.
`.rsrc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
hSystem.Drawing.Bitmap, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
$wIDAThC
B+L52#'
aU(@V3
l\$c5a
[}~jtj
A_'+YO
,Famm*
e3O'8>^kxS
vw~IAyI
]'sVmT
 9?\Opd
Bm@5~c~-4GS
$k3er4h
T%Upen
<VE!7"
Z DW%}K
(DCY.=
GO2dRe
LPVF/O
T$Z%j"H
kn{J|e
QSystem.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
System.Drawing.Bitmap
IDATx^
^V~FHA]
$7R?K~
1OI5Q!
m4X|jc
TalS;3n#
hgF6!w
/y/FN?
e	F\XH
1|<Wte
d. Js?x
>sQ%[x
M[&_AU
-"|e>q@2
lMxek"
,	{i# 
VV.R4f
HN/rd;m 
>=H5jf+3
q"F'1d
METpdB
3.{-XA;X~
mNtr6j
+m~#/U
"gh_f~m
?G>/q?
rn81Ma/
Z|xlg>}
:oGwQPq
n.n@2D
ns	V_{
ps[K#g
5by9b.]
ffBZNtA
CW&HkEg
]h; ,L
$uJW9p90
C%L8h{
l']$ZB
(4_0Rsx
U^~$Yx
.NqWAb`
p{4b^3?
\ 8tFD
SlDbC;
Ry41h@
o\z"px
xy'9c!
hA)wc.
^|[yM 
qo)tAvu
_V\PR@
yfLqN<L
o`Q)=9
FqdA:_
f-["e>o
iH$H[k
iPz4Rfsg
U96:Bj
r5^q<jF|
d_C)s6(t
MQ(j7?3
,m2<"%
b\@85dF
pU#0`?I#k
\^AN~C
j@)	!y
Dc\|{JrRg
H]g[F]
8=PgeB
5jW?.j
hi:q9%0
C;DtCM
iih*95`l
DcOCJW
y,15%8;
1co\Gk{
Z3\7_72
.SrB`u
u_z{\Ocm
bb6upq
9\9<5?6j
<5y2efj
|&4><1
x[Oky_E
Skh&Y5
jSmR}}
P1>7W;
`]]Eb 0
18Y1Z=
LzC[b{_
lkr\OG
\6tuuw
>dj3U,%
Skmk\m
@WzwJGj
SC]cu`J1
t\ske{B
CMqjOg\
jsS]Be{
bc(024;
tCOpf(0
4=ebex
;V;8?(
ArFkF[~
A"knkW
%87d[O
WgI)(tj
:';L#!
1B	_|Pg
,Zz%|6`
|)^%\*<~
Owoe1X
 W9,%k2(
N	C)7[
{=wx1I
@*%c0q
Bn+WU$
\	\=bM-
jZ<>F?
yr3K|V
e:pABX
yXHSrGT
mU3`	z]s
U6`9[Z
@t>x@l
a<47}V
,`> N,
S*l4|x
6`J: G
XUD7A]o
`@}toV
nkUkY,5#
I;bN=ek
!g(@r&yH
&!AR2|G
QUg>u*
#e0x(O
=sQFOK
BZDAo79M<
^~oXZia
>4{rs~{
|}	 #?
eZK::e
4zyY`7MV
UwKY$Y
yNp> '
udB{oB
CSfbNy
k./ 6g
6F,B>d
D|/Kr3
)h	}+_
D#L@ccD
r(;4%y
'Dv&uEG
*1{x9i
~<T4Uh
^o}:wRO
z|r!%\<
*,QE ]
;$~GRK
f8h{EY
[x. =L
@kJ..w{
,[z|!i
0U{c-?
P7"b)p4
zS}4))?
`Na00-
XZTy]om
n!wAtT
Hfw6av|YH
zgq]T%
s:t?}AR
\T'~_UF
T"zO>w
V-+r/\
v+b3CT
	}>fJb
+<xt<u
-6+	q)
MX>wQb
|xA>_P
>03	ar
dD;5i4
C6n%o{=
,!H#`x
acOrr$J
':Eq	gGv
2{jlwt.If.Nfy
?q>^W-
PE83b/v
1J%j?}!0
XtM	77
gPrhS	
gW5>h.
,=3J*gB
1X'CFcjm
{P~dFG
1=+	#_{
h;a]XT
gJj9_:54
O3g6T+
9D=."\
_w}YVo
g"rZ)^
_jjNMN
Vy	(/QU
^}5Y/	Lz
SwR>C;
+9>16'
f|6e3}/
X6pQ*J
P@DJ]P
/=1`=<P.
O[R|wqB@]
AM/F#nsn
Ke V+e
2QsLF!-
&|B e?
}]~`|~
].zY._Y5
UK8_~q
7o7^Xw
;rIv`@
X FU>|O
h.,MXL2
DejPPD
sogwK[
8xZ+2q:{<
n;1+Eb
Gjna8CB
h	Cgny~
T6>C/{
}>6\9V(t	
`C'58k
}(k(F1
}v97Tx
WJCC|L
:U12QDr
0DYhr8
T?i,9V
F!;Nq\i
?,5?d2
$nTFWU
{6NzJQ
`mVN@ 
QU=Z,|=
SGpwH-%SY
gnDr#Z
^}k_S+
J3j``@
IE)bbd
Em~N{88g
mQx7*$B
SCy-CC
e3Phuw
xnmUxIM
n8%H;p
pP_CDv
c=xtUHe=L^
|;~dEN
q;8XM8&u
h9(V7s
gw;2<$
r5m|(8?
C:I:=_
A$X=bY
|;~x!2
F-&Yn^
^5+e7EyD
C>g|,k
Uis#MT
6.{2xnaX
arg^Hp
qRP_h1
P$(w\}
s	*$aj
V@Nj"T
+kSPT8_S
0n+CI_}
;N|oiP
{gH.>/j
#`N|{hX
i"Nm/k
yQ;:M@
Yb`u=r
F[a?*k
)<RJ`Z
6]-S="
G.]WnP
ObU;-k&h
eh(R;0
6Z>~UB:
8s}P_/
p'O!FP
4FC6/u
:z|Z'}&
)Ii#nnv
7e=YZis
5dn(~	8:K
b@!w1r}
V/o7cK
4^zw"!f
3v)k}C85
d]t+%1
TEqhN^
^~-NO9
Lhxk|'
P%7,UK
L_C8u-
!;^<-)q
X#$U2B
%~ OM^
@I{W/~G[
anO"3q
;~v[S#
WzLdf1_
!P$$9B"U
?[qF`NA
{awz3*GV*E1
:(`mTn,
0M@OjW
?8HV1 
(y@c^\
k/ICyQ l
~=L.^m
`p!_q0
+aw%gJ
_s*<nW
9=;*&R
wgl\!u)
Ljx\!	'
v_'.cc
[eWRNi
q5UZ\ha
2|7G$]
_O?#L~
1vPu;l
L>t6xA
DN5A%.
I|8'i[
_ToGQ>6
~+|:qJ	
&lxk>	
)B4XAP
_nzxo4P|c
J6"luc
76oiy~+
|Hw7kw}
aq#.8v2
|,(jkh|
~tG*Bg5
s+>tF"J
_s2O7`
baoiI.A
;&JA>/>e|
'F_dkUZ
gl9?"@]@	<9
nLud5X
NY~3NV~
AMQRG+MT
b,)^99
,=`C#~
p	i>mr
>\PiNq
2xT$| 
vmQG1wE
;dt'9Em
v8r@ d
H0)&"a
.9!i;m
ob 7z^
#qyNp^u2
Z$EDDU
uh'?}o
sFyaL;
!7x=D^
="r?9N~
}Sf?p7
^.J`$D
`N*^e`
f4-$	~vVT7B98"
S(#[x8M
|?H?xq`o
>G	y=|
\/	N<S
!y>kHYg
LDekb#
[[_m%L]
8 4|xB
l1Rsi5
P^RHq?i
lwX-w/
^%j*y-
sS` ui
;:HG"p
wQ53)981
]wZ&D'
Zgs{|?
QX\L;0M
/GW@^h^ 4I
\?ty_)Wqs
$@Ip~F
^Sw	Y3
ce_/>!r
A?EH]r
N9e[.:
Ge4S>Fv
7c5:c+
eN|1."
 '-!_h
SEeoew
`J Szn
)'2, <
[C4^t,
!!D9,^
$alub^P
W	36y~
h:"6>[
P`Ri\'hX
Y3xf2S~rR
V?S*<^
D&gbGI#zq
ae"noT/
m+TzRMW:
b	}^\h
\<)4Bu
g7WsHI
!{o-jc
]g-XrE
'CL}e`}t
3V PC}`
\>B<F:
v87L)_"
~utRt{
-hvV	+*
c),-~#a
^%nsXxcph
Fkt	w*
',E34A s_
I,@ic!
nP)0V~y
'	-^T^5
_"iO#_
p$uha|
"VEA@*g
At%6?c
E"sY~xF
=Wjzmp@?
l1TG6(
~fp\M3[
IDATOA
mkt:q+
~;,h[<1
3+llf&1
.SKXOO
3]0J}}O
40"%J+
T>k$>I
k6VmQ?
M0n3~:
fL@d_mG
esN7Kg
W7{]o9]
MF[1l7V
x?Oj@w#J
`S@uRzV[
pcck;\
'L0uAG
iblyS8
U+W0ng
I}pA lao7@
11	jA=L
2kwv~s1
*<I.m,o
!&J?].
uX7yen[
z|2&pw
`bkmVX
73;5;q
	txiWsV
/LZZJ,
a}98-C
y@;,Zps
3'qwl ^
9%v+5##
XO}|kC
&K/Q%C:
/Kbi-.	i
Tr&zueZC}
BA VUI
lkvdk@
sCAPfg
HKxjgb
u3r`.DW
 J_0	(:
t{+Xd^l
jeL-Lg~
H%g5@X
Ul@5[\
G{7o`$}
?{%yt]5<
"zs%,j
_DZBGyL}
Kx>_^|
3)"Xvx
.v+Hy[]6
M69&c'
.9a^pch
b<c6PEJ
E6W,6'f
L{@1aI
(qIu;G
E#cCyi
x_cpQ7
Stq9Ss
Gp	%iG
1esF`D){
Uldz\$=JJ[
[CoGi=!
{[oDHhF
8@3U<@
G||#r~
+pzf`?D
i;R4\T
_:gpF{
R/J{qp-
;*-n{u
'`RVFx6t-
$WREr@
Q /eI+
*6r>^Z
}9_-Zo
	Ebe:cvs~K 
Fdr-T)V
OG3)LV
Yl]"d\i
s&An@(.
jO/#q,
Vi2AeD
0[!/V``
CQX_DK
*5.TS]
*i?Dr$
l6P	W|4}
$(V+gS
J5]IGjx
$KtjQ4
z6P.$3UV($j
`)kQAob!b	Z5]p
t$R)EB
xEk>XX"
E\4R,l>
1}=Z/@
B>(tXsT;
#?@05#
2e	+;H
|;PN9P/
c".64O$
l,5`Wohe
0&1m+j
Q*c$`y
@$0dG0
|v|[F'm
\+ZBT|
rxfFe`
A#WGma
|4}4`n
P`u#7Q-
|Wx90mA
U-x"dFgc/'{
D]<Pl?
>T"Iod
*rS/8@
(()r<O
/@&Rj_z
JE_[)6
,0u5wR-
g2"R<N
v;qc}]A
;\0"U03U+&De
Fh,(\B
*<Sijc
J:N`r]
%Ae_*jN
rKyeTl%
UNeBif
-gp3bg
fEybH2H
6y9}R`
y1J)St_
ojS^KC
RrfHi'aT
]r'oBh
EX')3>
g;b	*P
CtGj.-
(rKL7o|"-
WwZ!?>
	@4$8qK
:EWStU
':<-!%U
f7T!-f-&
 ?0:$Y
YP'QHIXL2
DT-3Ctl
4+QN6RE,
LVACt(
`r0x27~
?95xrqWS
#7O_?z
^'k`f&[
79hffL
eK/w5{
wMw~~O,
[Z(;5k
pijvjjz2
pvjvr!o
wryizj
xX[vubK
2X<x%2
~_pry>
XdeofzO4`|#
v2.0.50727
#Strings
<Module>
mscorlib
Microsoft.VisualBasic
MyApplication
MyComputer
MyProject
MyWebServices
ThreadSafeObjectProvider`1
Microsoft.VisualBasic.ApplicationServices
ApplicationBase
Microsoft.VisualBasic.Devices
Computer
System
Object
.cctor
get_Computer
m_ComputerObjectProvider
get_Application
m_AppObjectProvider
get_User
m_UserObjectProvider
get_WebServices
m_MyWebServicesObjectProvider
Application
WebServices
Equals
GetHashCode
GetType
ToString
Create__Instance__
instance
Dispose__Instance__
get_GetInstance
m_ThreadStaticValue
GetInstance
System.ComponentModel
EditorBrowsableAttribute
EditorBrowsableState
System.CodeDom.Compiler
GeneratedCodeAttribute
System.Diagnostics
DebuggerHiddenAttribute
Microsoft.VisualBasic.CompilerServices
StandardModuleAttribute
HideModuleNameAttribute
System.ComponentModel.Design
HelpKeywordAttribute
System.Runtime.CompilerServices
RuntimeHelpers
GetObjectValue
RuntimeTypeHandle
GetTypeFromHandle
Activator
CreateInstance
MyGroupCollectionAttribute
System.Runtime.InteropServices
ComVisibleAttribute
ThreadStaticAttribute
CompilerGeneratedAttribute
System.Text
Encoding
get_Default
GetString
NewLateBinding
LateGet
Operators
SubtractObject
Conversions
ToInteger
LateIndexGet
ModObject
ToByte
String
Concat
MultiplyObject
Boolean
ChangeType
LateIndexSet
System.IO
MemoryStream
System.IO.Compression
GZipStream
Stream
CompressionMode
LateSetComplex
ConditionalCompareObjectGreater
LateCall
STAThreadAttribute
CGUh.Resources.resources
CompilationRelaxationsAttribute
RuntimeCompatibilityAttribute
System.Reflection
AssemblyFileVersionAttribute
GuidAttribute
AssemblyCultureAttribute
AssemblyTrademarkAttribute
AssemblyCopyrightAttribute
AssemblyProductAttribute
AssemblyCompanyAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
AssemblyTitleAttribute
BankSlip
BankSlip.exe
MyTemplate
8.0.0.0
My.Application
My.Computer
My.User
My.WebServices
4System.Web.Services.Protocols.SoapHttpClientProtocol
Create__Instance__
Dispose__Instance__
WrapNonExceptionThrows
9.4.2.6
$dc6be9b1-22fd-4507-a7e4-c62ab6647540
	2017 KHSF
LOKIKAZ
KBXFULVFXHJFD
HARRYPOTTER
_CorExeMain
mscoree.dll