Malicious PE Executable analysis – 0578c47faaf4

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXE0578c47faaf4ab97682b82e6ca40e9c3

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Mwnfxicoan.exe
Full Name	Mwnfxicoan.exe
EntryPoint	System.Void RIFN0xdbFXR9xVuEan.DIoYfkObjbeIKH0KpO::j7CQgD8PQ()
Scope Name	Mwnfxicoan.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Mwnfxicoan
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void RIFN0xdbFXR9xVuEan.DIoYfkObjbeIKH0KpO::j7CQgD8PQ()
Main IL Instruction Count	37
Main IL	nop <null> newobj System.Void bSs2QS194gQ4X7Yj44.etM5AAPfBZZXq6ljim::.ctor() ldsfld SpKe5QrQZnZC6QSRlKq SpKe5QrQZnZC6QSRlKq::y7nr2OgGdq call System.Boolean SpKe5QrQZnZC6QSRlKq::mM6rrSfmAX(System.Object,SpKe5QrQZnZC6QSRlKq) brtrue.s IL_0048: leave.s IL_007D ldc.i4 5 ldsfld <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337} <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337}::m_ca7b46e1f10a429295ef08670d1926ba ldfld System.Int32 <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337}::m_69ae1a49c45f44e19070f2ac67918af0 brfalse.s IL_0037: switch(IL_0042) pop <null> br.s IL_0042: newobj System.Void System.InvalidOperationException::.ctor() ldloc V_1 ldc.i4 988 beq.s IL_0033: ldloc V_1 br.s IL_0042: newobj System.Void System.InvalidOperationException::.ctor() ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0026: ldloc V_1 newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave.s IL_007D: ret pop <null> ldc.i4 4 ldsfld <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337} <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337}::m_ca7b46e1f10a429295ef08670d1926ba ldfld System.Int32 <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337}::m_4d48e6ad3a544446bd447f5954a9b57d brtrue.s IL_005F: switch(IL_007B) pop <null> br.s IL_007B: leave.s IL_007D switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq.s IL_0075: ldloc V_0 br.s IL_007B: leave.s IL_007D ldloc V_0 br.s IL_005F: switch(IL_007B) leave.s IL_007D: ret ret <null>
Module Name	Mwnfxicoan.exe
Full Name	Mwnfxicoan.exe
EntryPoint	System.Void RIFN0xdbFXR9xVuEan.DIoYfkObjbeIKH0KpO::j7CQgD8PQ()
Scope Name	Mwnfxicoan.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Mwnfxicoan
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void RIFN0xdbFXR9xVuEan.DIoYfkObjbeIKH0KpO::j7CQgD8PQ()
Main IL Instruction Count	37
Main IL	nop <null> newobj System.Void bSs2QS194gQ4X7Yj44.etM5AAPfBZZXq6ljim::.ctor() ldsfld SpKe5QrQZnZC6QSRlKq SpKe5QrQZnZC6QSRlKq::y7nr2OgGdq call System.Boolean SpKe5QrQZnZC6QSRlKq::mM6rrSfmAX(System.Object,SpKe5QrQZnZC6QSRlKq) brtrue.s IL_0048: leave.s IL_007D ldc.i4 5 ldsfld <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337} <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337}::m_ca7b46e1f10a429295ef08670d1926ba ldfld System.Int32 <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337}::m_69ae1a49c45f44e19070f2ac67918af0 brfalse.s IL_0037: switch(IL_0042) pop <null> br.s IL_0042: newobj System.Void System.InvalidOperationException::.ctor() ldloc V_1 ldc.i4 988 beq.s IL_0033: ldloc V_1 br.s IL_0042: newobj System.Void System.InvalidOperationException::.ctor() ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0026: ldloc V_1 newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave.s IL_007D: ret pop <null> ldc.i4 4 ldsfld <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337} <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337}::m_ca7b46e1f10a429295ef08670d1926ba ldfld System.Int32 <Module>{3d538491-4de0-464d-bf16-a5d75f3b7337}::m_4d48e6ad3a544446bd447f5954a9b57d brtrue.s IL_005F: switch(IL_007B) pop <null> br.s IL_007B: leave.s IL_007D switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq.s IL_0075: ldloc V_0 br.s IL_007B: leave.s IL_007D ldloc V_0 br.s IL_005F: switch(IL_007B) leave.s IL_007D: ret ret <null>