Malicious PE Executable analysis – 00e56c2a8643

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXE00e56c2a8643f9e9468ff8089754be80

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Ouuano.exe
Full Name	Ouuano.exe
EntryPoint	System.Void rqMjbXGwTlsmnDKxQa.NGUWZApqQI1COw0qQD::jwB6nGASH()
Scope Name	Ouuano.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ouuano
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void rqMjbXGwTlsmnDKxQa.NGUWZApqQI1COw0qQD::jwB6nGASH()
Main IL Instruction Count	66
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_002E: nop ret <null> nop <null> newobj System.Void ldws4VxxpARWFJU1d0.u4qP9BkalD7jBal8ss::.ctor() ldsfld aHu3xJ26p0SFZXbmOC0 aHu3xJ26p0SFZXbmOC0::lYx2LKNyZ7 call System.Boolean aHu3xJ26p0SFZXbmOC0::ijS22r3Rax(System.Object,aHu3xJ26p0SFZXbmOC0) brfalse IL_00B8: newobj System.Void System.InvalidOperationException::.ctor() ldc.i4 0 ldsfld <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8} <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_1f868924a5834a259ce236808acac5d8 ldfld System.Int32 <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_729dd264080c41049f653a87696a4777 brtrue IL_0074: switch(IL_0094,IL_00B8) pop <null> ldc.i4 0 br IL_0074: switch(IL_0094,IL_00B8) br IL_0070: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 989 beq IL_0070: ldloc V_0 br IL_00B8: newobj System.Void System.InvalidOperationException::.ctor() br IL_00BE: leave IL_002D ldc.i4 4 ldsfld <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8} <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_1f868924a5834a259ce236808acac5d8 ldfld System.Int32 <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_665aaed4b09144b58d311c739873ecd6 brfalse IL_0074: switch(IL_0094,IL_00B8) pop <null> ldc.i4 1 br IL_0074: switch(IL_0094,IL_00B8) newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 5 ldsfld <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8} <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_1f868924a5834a259ce236808acac5d8 ldfld System.Int32 <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_a7a546cdd032441cad5703a7b18a8183 brfalse IL_00F5: switch(IL_0111) pop <null> ldc.i4 0 br IL_00F5: switch(IL_0111) br IL_00F1: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00F1: ldloc V_2 br IL_0111: leave IL_002D leave IL_002D: ret ldc.i4 0 ldsfld <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8} <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_1f868924a5834a259ce236808acac5d8 ldfld System.Int32 <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_d1b57f49f68f4fd982cd7d77b95dee8b brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)
Module Name	Ouuano.exe
Full Name	Ouuano.exe
EntryPoint	System.Void rqMjbXGwTlsmnDKxQa.NGUWZApqQI1COw0qQD::jwB6nGASH()
Scope Name	Ouuano.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ouuano
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void rqMjbXGwTlsmnDKxQa.NGUWZApqQI1COw0qQD::jwB6nGASH()
Main IL Instruction Count	66
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_002E: nop ret <null> nop <null> newobj System.Void ldws4VxxpARWFJU1d0.u4qP9BkalD7jBal8ss::.ctor() ldsfld aHu3xJ26p0SFZXbmOC0 aHu3xJ26p0SFZXbmOC0::lYx2LKNyZ7 call System.Boolean aHu3xJ26p0SFZXbmOC0::ijS22r3Rax(System.Object,aHu3xJ26p0SFZXbmOC0) brfalse IL_00B8: newobj System.Void System.InvalidOperationException::.ctor() ldc.i4 0 ldsfld <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8} <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_1f868924a5834a259ce236808acac5d8 ldfld System.Int32 <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_729dd264080c41049f653a87696a4777 brtrue IL_0074: switch(IL_0094,IL_00B8) pop <null> ldc.i4 0 br IL_0074: switch(IL_0094,IL_00B8) br IL_0070: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 989 beq IL_0070: ldloc V_0 br IL_00B8: newobj System.Void System.InvalidOperationException::.ctor() br IL_00BE: leave IL_002D ldc.i4 4 ldsfld <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8} <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_1f868924a5834a259ce236808acac5d8 ldfld System.Int32 <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_665aaed4b09144b58d311c739873ecd6 brfalse IL_0074: switch(IL_0094,IL_00B8) pop <null> ldc.i4 1 br IL_0074: switch(IL_0094,IL_00B8) newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 5 ldsfld <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8} <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_1f868924a5834a259ce236808acac5d8 ldfld System.Int32 <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_a7a546cdd032441cad5703a7b18a8183 brfalse IL_00F5: switch(IL_0111) pop <null> ldc.i4 0 br IL_00F5: switch(IL_0111) br IL_00F1: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00F1: ldloc V_2 br IL_0111: leave IL_002D leave IL_002D: ret ldc.i4 0 ldsfld <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8} <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_1f868924a5834a259ce236808acac5d8 ldfld System.Int32 <Module>{ff4c99af-1cfb-47ac-8d06-ad05995982b8}::m_d1b57f49f68f4fd982cd7d77b95dee8b brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)