Deep Malware Analysis of 0116a60a83868d6d59c4c4c524f1acac | md5: 0116a60a83868d6d59c4c4c524f1acac | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.87

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Rjaxsckdob.exe
Full Name	Rjaxsckdob.exe
EntryPoint	System.Void Fuwsfniw.Cryptography.EncryptorDefinition::EncodeRandomEncryptor()
Scope Name	Rjaxsckdob.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Rjaxsckdob
Assembly Version	1.0.7434.14576
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	6
Main Method	System.Void Fuwsfniw.Cryptography.EncryptorDefinition::EncodeRandomEncryptor()
Main IL Instruction Count	33
Main IL	ldc.i4 1 stloc V_2 br IL_000E: ldloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] br IL_006E: newobj System.Void Fuwsfniw.Structures.ResponsiveRecord::.ctor() newobj System.Void Rjaxsckdob.Conversion.ConverterMember::.ctor() ldloc.s V_1 call System.Void Rjaxsckdob.Conversion.ConverterMember::SetConverter(System.Byte[]) ldc.i4 3 br IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D) newobj System.Void Fuwsfniw.IO.SelectorSynchronizer::.ctor() call System.Byte[] Fuwsfniw.IO.SelectorSynchronizer::LogPassiveWriter() stloc.s V_0 ldc.i4 0 ldsfld <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e} <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e}::m_2d408330e6964bb7a76f21b3d2966334 ldfld System.Int32 <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e}::m_849be85460314647a981eadd11079a8c brtrue IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D) pop <null> ldc.i4 0 br IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D) ret <null> newobj System.Void Fuwsfniw.Structures.ResponsiveRecord::.ctor() ldloc.s V_0 call System.Byte[] Fuwsfniw.Structures.ResponsiveRecord::RecordAutomatableRecord(System.Byte[]) stloc.s V_1 ldc.i4 2 ldsfld <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e} <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e}::m_2d408330e6964bb7a76f21b3d2966334 ldfld System.Int32 <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e}::m_447b184527f747ec9af3392543fc6c54 brfalse IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D) pop <null> ldc.i4 1 br IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D)
Module Name	Rjaxsckdob.exe
Full Name	Rjaxsckdob.exe
EntryPoint	System.Void Fuwsfniw.Cryptography.EncryptorDefinition::EncodeRandomEncryptor()
Scope Name	Rjaxsckdob.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Rjaxsckdob
Assembly Version	1.0.7434.14576
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	6
Main Method	System.Void Fuwsfniw.Cryptography.EncryptorDefinition::EncodeRandomEncryptor()
Main IL Instruction Count	33
Main IL	ldc.i4 1 stloc V_2 br IL_000E: ldloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] br IL_006E: newobj System.Void Fuwsfniw.Structures.ResponsiveRecord::.ctor() newobj System.Void Rjaxsckdob.Conversion.ConverterMember::.ctor() ldloc.s V_1 call System.Void Rjaxsckdob.Conversion.ConverterMember::SetConverter(System.Byte[]) ldc.i4 3 br IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D) newobj System.Void Fuwsfniw.IO.SelectorSynchronizer::.ctor() call System.Byte[] Fuwsfniw.IO.SelectorSynchronizer::LogPassiveWriter() stloc.s V_0 ldc.i4 0 ldsfld <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e} <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e}::m_2d408330e6964bb7a76f21b3d2966334 ldfld System.Int32 <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e}::m_849be85460314647a981eadd11079a8c brtrue IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D) pop <null> ldc.i4 0 br IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D) ret <null> newobj System.Void Fuwsfniw.Structures.ResponsiveRecord::.ctor() ldloc.s V_0 call System.Byte[] Fuwsfniw.Structures.ResponsiveRecord::RecordAutomatableRecord(System.Byte[]) stloc.s V_1 ldc.i4 2 ldsfld <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e} <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e}::m_2d408330e6964bb7a76f21b3d2966334 ldfld System.Int32 <Module>{7f6180a7-5ed9-4087-a0bb-677759e2d40e}::m_447b184527f747ec9af3392543fc6c54 brfalse IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D) pop <null> ldc.i4 1 br IL_0012: switch(IL_006E,IL_0042,IL_002C,IL_006D)