Malicious PE Executable analysis – 02315541b72d

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Symbol obfuscation

Low

1 malicious · 9 files

EXE02315541b72d4c2fd2373ef61c637ddd

Structure

P7B[Authenticode]_c3e86401.p7b

BINResources

BIN.Net Resources

Name	Value
Info	Authenticode present at 0x334C00 size 11896 bytes
Module Name	Ndrbuj.exe
Full Name	Ndrbuj.exe
EntryPoint	System.Void Ndrbuj.DataProcessing.DetachedFilter::SaveFilter()
Scope Name	Ndrbuj.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ndrbuj
Assembly Version	5.5.3.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void Ndrbuj.DataProcessing.DetachedFilter::SaveFilter()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0057: ret newobj System.Void Ndrbuj.DataStructures.MapSolver::.ctor() call System.Byte[] Ndrbuj.DataStructures.MapSolver::StoreMap() call System.Byte[] SteamKit2.Learning.PredictorProcessor::CountSimplePredictor(System.Object) call System.Void Ndrbuj.Structures.LiteralNode::LinkConcreteNode(System.Object) ldc.i4 0 ldsfld <Module>{c199d5d5-f30b-4786-a9e7-53a8140cf709} <Module>{c199d5d5-f30b-4786-a9e7-53a8140cf709}::m_86d5f669b0354305ba833fc95a2f15ad ldfld System.Int32 <Module>{c199d5d5-f30b-4786-a9e7-53a8140cf709}::m_c80d79fc9c4b43488d3171ec3c719590 brtrue IL_0012: switch(IL_0057,IL_0024) pop <null> ldc.i4 0 br IL_0012: switch(IL_0057,IL_0024) ret <null>
Module Name	Ndrbuj.exe
Full Name	Ndrbuj.exe
EntryPoint	System.Void Ndrbuj.DataProcessing.DetachedFilter::SaveFilter()
Scope Name	Ndrbuj.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ndrbuj
Assembly Version	5.5.3.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1291
Main Method	System.Void Ndrbuj.DataProcessing.DetachedFilter::SaveFilter()
Main IL Instruction Count	18
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0057: ret newobj System.Void Ndrbuj.DataStructures.MapSolver::.ctor() call System.Byte[] Ndrbuj.DataStructures.MapSolver::StoreMap() call System.Byte[] SteamKit2.Learning.PredictorProcessor::CountSimplePredictor(System.Object) call System.Void Ndrbuj.Structures.LiteralNode::LinkConcreteNode(System.Object) ldc.i4 0 ldsfld <Module>{c199d5d5-f30b-4786-a9e7-53a8140cf709} <Module>{c199d5d5-f30b-4786-a9e7-53a8140cf709}::m_86d5f669b0354305ba833fc95a2f15ad ldfld System.Int32 <Module>{c199d5d5-f30b-4786-a9e7-53a8140cf709}::m_c80d79fc9c4b43488d3171ec3c719590 brtrue IL_0012: switch(IL_0057,IL_0024) pop <null> ldc.i4 0 br IL_0012: switch(IL_0057,IL_0024) ret <null>