Sample details: d3eaa644b94b0d21a279d31fe37b1358 --

Hashes
MD5: d3eaa644b94b0d21a279d31fe37b1358
SHA1: 8a6b2e1fbeda6dd9a232e525438d713470d89f4c
SHA256: 8e4fdb316227eb55081b313b9942ea40318aa9048daa7b7ceeb42888b23351a3
SSDEEP: 12288:jszb21IYtOXnzoOy2KuxA2vYJ5Y+RKwOE8wGfbeqegi:ozDrUgYJK+B8wGfjeB
Details
File Type: PE32
Yara Hits
YRP/Microsoft_Visual_Studio_NET | YRP/Microsoft_Visual_C_v70_Basic_NET_additional | YRP/Microsoft_Visual_C_Basic_NET | YRP/Microsoft_Visual_Studio_NET_additional | YRP/Microsoft_Visual_C_v70_Basic_NET | YRP/NET_executable_ | YRP/NET_executable | YRP/IsPE32 | YRP/IsNET_EXE | YRP/IsWindowsGUI | YRP/IsBeyondImageSize | YRP/domain | YRP/IP | YRP/contentis_base64 |
Source
http://aboukangaz.com/cross/documente.exe
Strings
          	            !This program cannot be run in DOS mode.
`.rsrc
@.reloc
T30Z L
tZ)%&87
r"pZ s
lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
\System.String[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089PA<U!
V;h_)=
N`NfN2NINxN]NpN`NYN
NTN6N9N{N
N;N9NpNnNaN
N)N<N"NVN?NbNwN
N?N%NmN>N]N
NcN.ND<
NHN8NUN
NdNSN]N[N
NWN%NYNoNGN_N
N6NWN0NON
NDN`N_NuNoN
N^NxNnN
N\N.NKNyN^N8N2N=NZN$NoN9NWNqNcN!N8
N9NFN:N,NCN+N0N
N!NmN~NfNKNRN9NhN
N~NoNtNeN[N6NSN
N[NRN$NaNuNgN	NANON/N
NtN`N NrN
NKNgNjN
NmNZNFNRNGNpN
N!NrNWNDN
NqN2NyN]N
NeN1NLN,NeNHNCNBNaN%N=N]N1N
NZNtN3NcNjNZNeN.NAN
N_NLN*N
N.NuNfN
NKNbNPN+N
N5N0NhNFNGNnN.N+NmNoN?N0N
L0NVNdN~N9N
NiN_NbNBN
NvNTNsN
N	N<NiNON N9N
NMNANjN
B@N_N@NCN"N
N(N}N@NXN
NEN'NgN{N:N
N>NuNgN
N	N%NEN7NaN"N3N
N;NFNWN
N?NbN:NSN&N#N=NdN&N
N|NFN(NdNSN.NNNlN
NSNtNyN+NYN1NsN
N>N5N`N(N
NyN5NyNMN.N8N@NBNPNKN&NpN?NcNZNKN
NBNfN7
6KN_NPNPN3NfN
NTNlNVNvNWN
NVN	NJN
NxN'NGN@NuN~N
JONZNSNrN2N
N4NTNENPN
N4NJNYN@NNN-N7N
N:N,NVN
NUNfNLN7NZNqNBN\N"
,ONvN)N!N?N2N
N4N!N7N*N}NSNQN
NeNhNCNmNINWNwNG
N4N[N/N
NaNoN_N
NSNfN+N
N"NUN\
<[N6N-NuN;NTN
NkNoNsN|N*N8N/NCN(N$N8NQN
NtNhNkNY<
N_NmNyN
N|N2N~N7N
NgNLN:NwNgN
N8NRNrN.NTN
<eNtNsN
N1N-N"NdNvN	NeNQN.NXN;N,NJNeN~N
NQNONd
N&N'NlNBN
NbN)N)N
N`N\N_NVNoNqN9N8NNNNN
>qNONiN?N/N|NeN0N:NaN.N9N
N$NgNrN
N~NTN7N
FsNHNBN
NFNAN1NrNyN[NRNqN8NrNzN
N;N@N4N
NDN\N(N5NSNINzN'N
N)N;N=NPN1N9N|N}N_N
N&N]NZNNN!N}N<N@NQN#N-N#N
2hE*CS.P
'lG	q>
	v=wx9#u
&H,%d$
	uB\ry5
;t~Y}K
~3c>SG
oi2:8/
,pnfSa
MY#f(H
x7bd&y!
~5d|uJ
WmNrW9
UZF74X
Q+I'&,n
:ie|-+
smAtg5".
7C{i9'
"+/Vu{
-n`3[;
EY}JQw
#4LVRvI
	/Xux]`]
R#L8;h
.wj(jD`a
#%u;9;,J
Qupwhe
rCPC]!){
rn/!$8+
UC0r"&
*0X]o;
)@soc IN
eSng:B
*1cIBv
dl_Rh8
|N8?gf
sE%Gi,
QCp2yQ
Jy{/CY
|u?ESNLM
]e72+2
JV)WDB*
*Goa=I
Z1EZwW
ivaXL;
cv.UG+
"=\<; 
t]^PTi
zZ/a@]
nGM5+Z|
'XZ]MZ
>qa9CW
`4fKeD
#m<^tF{8
oObZRg
~T*f$-
rY	~<2-"]
Qdn(T=3
M.<iUw8
(Q}PVl
Z!VnXt
gMlYS	
+GO?0L=K
\d|.;D
[Q=_OL
?}}?we
{0(#U$.
	TM>[w
$2xtJ[78
#h<Y<MH
 y:2$}
yMrkJ,
:kV_a7
J=$g)!
Cb"=?[
B]~QYa
"nNaq?
?O3H08
W S(@rF
&e?lb6.|D
ZApO_Y\
jWa+\~X
0xpMUt1
Uqg?k!@
n+yct@
/66'$U
4#44;xk?Z
T2 [Fv2
+IX8Rm
(ZJC3@
tlwzM$u\>y
t9S;LQN
N+_m"01
nwZ*pN
+_ SPs~
|&A!);,A5
,u?'J.T
~/ X6(
BUK?^S
t|7_6yF~-W
%;='U;
.j8"Yb
4tEzhq
z1	:DI
%@7C-!
GQDofn32&
cY_ozn
5)yRi{*
uQ@lSi
69l2A6
`d[{ah
A(Uu5#
h#YB6.
3Os"fj
sCX2 $G
Z<0Cef:z\
M	mvZA
V]1#o-
6xB"]1d
	Rk[#Z
w*q<=tH
:"bPXf
{:z[WKpe
BS/z1S
~qdUq.
%]~vXV
:2ZL|sJ
SHPa~K=P
g@IkdH
c` 1CHT
KOqZ(N
a!M] Ll
Ag53M?Cco
e@yoI8
 b@Q7O
"A6JDe@
/LN =Q
n98G\s
*/p1>A
NgT:  +
^AL`A+
fLwKZs%8v#
aYDn ;
2o01.8
2kr vF
!Kn^Zj
[GG&ES
s;7hLD
:w_[D4
`&:rhcAn(
mewt	./
y*JNn(
RZjW?k =Ox
M$>bE:
L>=T<Da
Y\{|se
>,9hUK-
B#`AQ4CG
a2X}RC=,7R
#G>}^:UXW
s 5CAx
{E%z]$
s -]jh
2:.;Z7
45j2O+"bl
HAY^y%ab
tbpxBb
#'hU9D
k2G;J-6
z5GflRS
B.=bA`
iwW^',
/D:4vo
.'KN`Z
?9L`*M
*a0at)V
9' V`P
.bA"[1
'M6Hix
A%(17YP
zivJV&
8`v^Vj=
}aqTUle
daA6%~
mj)89lit
t1SG)+
AcFP>Gu
cdun>V#U=
^&%NJ'
,:ev -
/HQ]"[[
j;j.\C
9.E^_j
|gbHM'
B f~wv4@/I
<qU6KtAw
$aF?H/E
/jA&az
OdvQ({
XMUdSq4
td$4JesR
TwO ~) 
3U~~),
V,lb&e
@XYi :
$DVz<"
))0.?N
a=+~?0A
U>TtjY
)&QiVl
B_~b?m
5'}	v8
?LcAq#M
"U7O)w
At;!pN(
]V/Dmq
8p1'}$
Oe;c)O
JbeIi,
qy	#Jjbc
wsQla|
&[Ae]1
I$_ ?N
p6V.;f
V%BI|HJ
]a0t}=
$-Ndy|
P[(4Xh
"i^x5j
J'QbU~
A$`OW?
i;	o:t
LU;Ic9
{ORVX5
z%|]cu
3MpSbmr
Lw2_%C
LwR= ?N3>
M/ntk1fuaR
FnS#JVu
Wnm%]u
rnFgP}
u}6ts\
rO9G"Ov
,3M:`w>5E
V6[>@KO
rEJg,s\Y
W3%roCY-$
FOFZP8
z;j@Edt*
(3C~kj
3bEmi3Pre
}&U%ne
LEYDEX+
U<+s/f:u
xo\%R?Tj
ZO:"#9@
|}I8U<]
-b1KYe
]"]n#Y
;Fs1}=
" h&Ht
vOh4Ar
JFP2XB
|f~[-.
}Ve#H'x@!
*GSw=|,g
-0 %=i
M#Kg[~
#*U$t@&
8d2yH"
m1Xq_\.
iEZ2@?
o/IDC>
$rH!$bQ
dSAEMY%
YWHA"R@]
HdjV%/&
;qv!	&
6Bs;!h
yYjf&Z
PD+V'F
d(SzSZ
WlOUnr
C/'(z0
@d+ZY]
USC@a9
R@bA}9
|&S~|M%
h*jk0|O
j(?C?c
m]xbG&
B1H}kH
OQkyeJ
*jG2%i
iZO|/8
)0SPJa
xM:S"0
]X0r+P
,7^JJ?;
!r^!MZR
	;PE!|2
S0w7oq
6HC/Mz#
Xi\9l?
M1;Z^g
ac2.nmygt
j9!=u(
GVp9S(~_b
t$X?FrZ
 rZS%C 
W,%)*i.:
);$FPU_
>Ic[MV
m4C809
-Q58l0
f,83$6
 M<O%=
8$"0~UPO
*hDwa5
{Bb>vA
v7p"ge
8W/$5I
w?mR,>GL
aw!t0*Y+
,kWVr663
%,IdIum
.9B'.O
o[ITaw
'n&.,7l
,(;NpQ
^`Sv)c:
$fjCsA
a	j!^Q
H	LcVTd
!{(X~+
>Z}Y|0
-\99Dw
C^=r%/
[t r$w
QM,	Hk
6	ee)/!6
HO?*#[
t136VuSH
|!~YsOI
d4:'7:q1{
.z\TyO
-P5u4na
b]S#*5E2E
rEMiH]D
"ugii|l6
fvig.S
k;n 'f
{6lzU>y
P6w)<A
I:)aGbL`
'u?jQ{
9s6~i3
t?1:":
q~&$iF
,A/*+F
BUhsuU
CFV\g;
b1wLxeV
`Gd?0{|9T,
q9!8HHR
e9(:=3
VzoeF;
98~1su9
q1lih^O
7flKPD
E,.hC&
RhI[(D
c;3&vj
LHD{b0zX
jRGeyN
O*5`pe 
kc	6/'M
2d~F B
_[)hx5
n9/87|
tG|!>YiA
&KGXHEp
3t3G9H
DH<m59l
m3'k% 
w??g  
^e>|jhp
d{cr?kd
t"ULr`
=}yuZuL
M|pVR	
?"FN6=
#)KRbn=
^1)rD#
3gCvh~X
ai2<y?
|XbgX,
T ~k ^
19oP2L
ix-w1&K6G
&iY=^Te
'/Dni7
.Y )X;
-Sa<.m
?g8(R"
y0#=%3
g6Lj^t
hm*N(=f"
hD9As4t
x`FB3(
%iE0wf
Z)nRE@
.Z=x:@
oVP5ka
&do$_O
Eo7<H]
[6-i|Y
Dm^kz~
2eCN7+"1q
Dt)P1x
^	IcM.P{
1TeeIT
=aqG=6
v4MD@6o
Ao+II6
knu$;Q7
m?!S.aI~
uF8+j#
2snlt;"
H%cVr.
KoJzc5
]V\~[Y
SJzcq@
EC3^]2
w9-8Hq 
gz_<a(
8bO37;o
DRc#6wa
VxgJVr!
k/:][(q
 	Id(j
#5!L[I
x] 3_ J
*}X5c{
`{"wa=
}E~3S<
uno{9x
cwEJ{z
z?7I.e
h-'>D!!
<f4A@3
R>x4CG] 
cVL$\3
`$FnU[
XD/[EK
%:G:CfUr
z%C}\j
jz7nC8E
Q>Zh+Q
JZ0=RS
}6"-;Q 
=T^[YL
/~Y4>to
OUxw;mB
x}X4,R-_M
~u6[.9
_M_czAX
)1-bJD
xm=EBV
!AiV&L
4Tf#W;WZ
 90K=d
,{"p1^	
a'O4jD
NHKg1@
1L#K'4
5QvmZ,
l<"NG|
Ph2Bd#$
PaWy_	
WLmm,"
!XFPtrH
{IYcOJ
j-p.!u
|\snl"
m4W>6P
?HNzXBI#
@*BVUwD
6OVSo!
8K(X*I
&]zu+m-Z
0wIj$4
0yU.ie7I3(
A;S><g*
ANc7>lH
C&R(`u^
&ObBZ-
DBDF5_
zS:9 o
!F3eA.
d:9cki
Z`+Z ~uw
65_qN2
iByWbr
|W3x~B>
7m	8yh
'gN~y)
~DH`L2
4%~2a{-
d-^]^E
(E[{?_n
M>\2cWi
Y^wC`x
-r~+\h
yO[k"'9
.q0t|=
xg:"`H?
)TD+:|K
E#,7s}
7UjM	8
_0`4=0C
RV;'_Ke
;c$y&|J
5G	jcc
<OM6r$
mn98Yb
&5u=F6
3q-S_;
Aa[#rV*
$po[MMbW
`O>qlS?,
VE/:tRC
QL>g*#
y%Yd_/
cI,iYH
DZyjMg
?"d8nk
Yj(e*$
(>sMT3
Tu&b27
9UZy5P
Za fsx
R4wskd~:
1.;!6w
m#N%,U4
W|UP"$|
o/{Xp~
[dMfp@
E+~px,	
v4.0.30319
#Strings
BShYAJVYAKRufDZnUlV
documente
mscorlib
System.Windows.Forms
.resources
WnQWH8Iw4rKLCfij
FpPrZ9W1aOcvRbpfsiA
.cctor
GoBxbvhLfsIWWso7B
No7bx97zxONICurltB
Object
System
msBtDoCMUqXc9Z
J1a8kreaYWVq
E2PX8CKz4AZHOOM
8cLISCEbyz08JIcd
MethodInfo
System.Reflection
N7U7gt8ryHV
azlrga0GuMg30Rr6l8
byezNeFYkYTluJTp9
OxevpKYi0uKlCTDQP
HWbu1c2iwPHGg3Pv37
UmffkR8Sd47
L7VNPcERKTeHp
p9Z0eDo4vqLkez
ConstructorInfo
SymmetricAlgorithm
System.Security.Cryptography
OjlNU7r7Ie0TPTe0
pMmNS1WfMgi6k
TDN1tMBTMpLnYphk
MAEpgwgwDfwUMA
Assembly
MnRsbjTSZH9hzdo
7OCkvNRjAPMES
8qOaPxJt3sc87TgVp
kjHsudGkujoVYDYmZ
nraGY3Z7OIVK51JMP
YEzAt4KejY91a
PropertyInfo
2Y3GPFUCHoFiZmcku
rvHeGN9h6JFV8KvwNs7
0TYjwdOSrW
ResourceManager
System.Resources
ICryptoTransform
AppDomain
Exception
K3T3x40156Q9SEghO
KFXTsaxsZ99bz
GetType
GetMethods
MemberInfo
get_Name
String
op_Equality
MethodBase
Invoke
GetConstructor
GetProperties
Thread
System.Threading
GetTypeFromHandle
RuntimeTypeHandle
get_Assembly
GetObject
set_Key
set_IV
CreateDecryptor
get_CurrentDomain
get_Message
MessageBox
DialogResult
5SLBU3KJ9x1x3CI
gOoNgxBeMuTB3xUt9s4
HzLzHrZEt5TPYZE
3UxSBJ8mm3BHNVcL1
goMrosNc74S5rb1MsR0
X9ilJVhMGkAVL
kx2MboVWYrNRMQN9S
1OfgqUbv58KHxMfluI
czLUlhtTd7MwHJL5aIe
cEwfBXrY9jUyk
hVpw486wsm
7e9S3rCrfS3
TLOdxZ5QZX
Q5CoDtvyjSu0Ktoz
XjrQvLGyvVDU
8AfmOHo4p90k
En21idQKHgJdrfiM
kXBqFUDkZE6y
kdoXhjQZGQzOycIf
Wqz2KuTSN2hPDYR
r7Rry71nXDxKE
aztqq6fLPuGoQ
a5eJDphnrasRp
otVVoTKaTSYIsxbb
aIRfNAFzytCw4N
BUAZy1q6JqWQ6z8
wHCw6HRyRoKMm6oABfY
Y2rIpABfbaJqxaYv
VPiekwapsUY
0FYcyapSf1v2j5yWKT
dVWqFSSE03b8
rcII7Gw9AX
5fhVvKLEJjItmDuYLLl
02kN4bVTrRhSeUtQv
zpa5lBUko415ykkwte
Q285gmfw5e2IHv2DpO5
RlFh1Fia7xwEeT5
if6UtVShhvsOQHoEpWE
gLrAkrrAqQZ
W5Z6DmZKKnq
EPYldOlAeBLnpc
wLqgM19uTpsM
6XW0LPoKyCnEi4pFf
VkaT9JpaFEE
oqLOGlc1HAfI
7SVK60RjemOPWXXJI
HgrDnYOj1lvWdrDCezb
JS99zSp9dISaiF
lGxfeoJ9a3SdZ7H
GytjrgtUVPPryJsxO
yiK2xx9DNzTnGeU
61ebTrANQRPDHRLkF9
OqV8XjWQ9wn5IITX
kswhI3E1Cv6xb
CGn7Mp3lurFA
eIwzsYbqE8bwuxu93
zDNDjoPHAW8t8D
iQyYkCS9flHw6YMVyfO
87mk3ZZo6wnqCt8
BjDLRDSxSuD6XGH0mr
aweMChErs4Hj1X69rS0
vvzHV2Pnkc
SKuN2XQ0EwPmm50
sNHDhO8SB5vr2JtC0
rOX6rhDXntV7H
6inPSYkeYTq6bb7V6
Pe2kqhXQ9Ta4M0jDu
kTpuzwMh5i1hBDi9b
1GupMsYV2NHpJXjd
EFE60WXyFPXKOV
EDXEGoH8vlpqPVQu8A
Hv5KwdvMsD9
ye0Jt9NOcV
zFKWaUdECiQiEI4Y
lyRcbfM8Yzvu
eV2KMtyCsl9
f834npphOje
lLm2EWW0cStGg
K0QTuqTsah5tc6d0S
YPniGQlY1oNS3hHFW
MtpeNiIp6nuTF
9y4HcAs9sbocbO
JnKT4wISKCkPT
3FvZxDPxqk0uM2
4EX9Bj9nqYREKd4rw
ZkXC0e6VcnQGBsGM
lIPKf4gvC0a2ozfMm
SeoDKrq4A8c6k
1mSUW9lbZntdV4fyd
b1rBGJ0UKlyhqMPvqL
KnQwfUXIZkzKkV
PmXtX5J5lqtjbgD
4TMTQ700j4ocgS
wRRjpD58OwEiqpj
l21sfEkiSP3N0
xJJmeB48RB8UjR7MM
qIMRvmbOsvGALiiV
VQAuRExntfKdNpVY
Bl61ykeTDIy2
0nTVanhAIz
tkdHvvd21ZxNMMR
ID14wUqbyLw
bTFjfWBwtbohcQwPUPG
KgK7JaRIkMvFxgTb1rA
wWtaTSPAZQ0Yr
joVHAr7hYh
T4i5FKE8k6
aURtS2e08DAj
vAdRImCKNpqKEG1YbXV
q8jdZEzf3kb
RuntimeCompatibilityAttribute
System.Runtime.CompilerServices
CompilationRelaxationsAttribute
UnverifiableCodeAttribute
System.Security
-TNLNAN
NeN>NsN
N7NkNtNVN
N_NmNyN
N|N2N~N7N
NgNLN:NwNgN
N8NRNrN.NTN
KONZNSNrN2N
N4NTNENPN
N4NJNYN@NNN-N7N
N:N,NVN
NUNfNLN7NZNqNBN\N
-ONvN)N!N?N2N
N4N!N7N*N}NSNQN
NeNhNCNmNINWNwN
WrapNonExceptionThrows
System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
SkipVerification
_CorExeMain
mscoree.dll
PWWG0==
!MhiiA]]
	*--L~
Fuu5*++
Hmm-6m
lze#jkkS
Ccc#Z[[
M")wDdz
O'2J >
v'Lz]R
}	'Ziii
cV=X6!
%V__O{k
B!DwR;
H,yj g
c$c|/Jd0
VGR!.r
!|ZOj"M
7MMMhmmE
o>OYWSSC
bEQ	{8
[ZZ0{v
$eq_;^
mP='rr@ph
@ @II	
MS32> 
nGAAAF%
IM?U,R"
\V8\FX
AQ Dmm
^\?s.^
~(ihh@
/w_uu5
Sd<.QWWG\h?>
7`HKMMM
R[[K477
 MJmm-
7 -J$k
i(++CYY
;[hiiASS
B.rHo0
(++CYYY
~}}uuvn	3
~}|uuyyt
U98>owyz{s
7y{{{q
2hklh3
\]ZYED,
]ZYPNMH
0FOSS{J*
'~LT20,.yl
'taeg[d\w'
}^hiWx|
"&+jph|
)$,?	Y
9[zmWk@&
TUeVl&l
u/[-_N
=H"aQ{
66P]]Eyy
477g]s&ttt0}
n=aTE"
RW[AME
PVYIIi	
N5e+[\
VRRQEIE
SVUGYU
LdLJ	`
y|x<>4
x<Noo/
BQP5m0
WREBz	
hhB q2
+osquuu^
x|x|~4_
~ncY?2
==(B!:
S`II	MMM
TUTECS44M
P4m0 (
4YRJL]
P(tD;~:
l4B(h^
pyvV@`6
[,XPX&]
#100@ww7
555tttLx_
:6Gqq1
IJJj6k
[;?@HH
NII!77
trSwS^^
PXXH||<K
;w(//g
iG g6n
Ciu\JEE
h4RYYIyy9
ILL$##
:Dttt##
"..Nq}
*jkkEmmm
3GDFF*~
]YYIAA
Fpp0!!!t
.$<<\iu
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>