Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 2 files
EXE076d282edcbb5937b10e048873f58037
Structure
Name Value
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void GJ0kBpva77mWO1JUwfk.SdDMgCvcYY2qelTDuLi::zkivypoyhw()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void GJ0kBpva77mWO1JUwfk.SdDMgCvcYY2qelTDuLi::zkivypoyhw()
Main IL Instruction Count
53
Main IL 
ldc.i4 3
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C4: ldnull
newobj System.Void Bt7dr0XDrpsdvflvdj8.Aty3udXCDfHWBPMZWjh::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_57f77e3131ca43419a031b29a5f7e608
brfalse IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
call System.Void Y7OYyKHipSlVSFYMEKI.hX0kxQHIX6fRllZtN3V::u38FXyRluML()
ldc.i4 1
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_22121ede370649e49b547b9188529541
brfalse IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
ldc.i4 1342039946
ldc.i4 439194595
sub <null>
ldc.i4 1406467350
xor <null>
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_fa6b918183cc400795ea12db2bd9cd38
xor <null>
call System.String OqPZMNEI69FZ5KexJtg.tqvpCiEnkqmjym8MLPC::fMeEfajSXk(System.Int32)
newobj System.Void MhSHQvjed8HTNtqLR85.PLisJqjDAxQZPP1nem8::.ctor(System.String)
call System.Void MhSHQvjed8HTNtqLR85.PLisJqjDAxQZPP1nem8::RfWjJPqvlU()
ldc.i4 4
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_3b53ef53e5ca4f4ea8e118aeedc8a406
brtrue IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
ret <null>
ldnull <null>
ldnull <null>
newobj System.Void Y1pOlJaV4xK9cnjAXKl.vLhUlsa9SjNmp2W9kOW::.ctor(System.String,System.String)
call System.Void z5yZrLFrMjyKQh0tK83.waHBYpFvPspyr9Ecy1L::SyFFLjRjMf(Y1pOlJaV4xK9cnjAXKl.vLhUlsa9SjNmp2W9kOW)
ldc.i4 1
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_b0905976609e43668c9911ceaf5ea022
brtrue IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void GJ0kBpva77mWO1JUwfk.SdDMgCvcYY2qelTDuLi::zkivypoyhw()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void GJ0kBpva77mWO1JUwfk.SdDMgCvcYY2qelTDuLi::zkivypoyhw()
Main IL Instruction Count
53
Main IL 
ldc.i4 3
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C4: ldnull
newobj System.Void Bt7dr0XDrpsdvflvdj8.Aty3udXCDfHWBPMZWjh::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_57f77e3131ca43419a031b29a5f7e608
brfalse IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
call System.Void Y7OYyKHipSlVSFYMEKI.hX0kxQHIX6fRllZtN3V::u38FXyRluML()
ldc.i4 1
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_22121ede370649e49b547b9188529541
brfalse IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
ldc.i4 1342039946
ldc.i4 439194595
sub <null>
ldc.i4 1406467350
xor <null>
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_fa6b918183cc400795ea12db2bd9cd38
xor <null>
call System.String OqPZMNEI69FZ5KexJtg.tqvpCiEnkqmjym8MLPC::fMeEfajSXk(System.Int32)
newobj System.Void MhSHQvjed8HTNtqLR85.PLisJqjDAxQZPP1nem8::.ctor(System.String)
call System.Void MhSHQvjed8HTNtqLR85.PLisJqjDAxQZPP1nem8::RfWjJPqvlU()
ldc.i4 4
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_3b53ef53e5ca4f4ea8e118aeedc8a406
brtrue IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
ret <null>
ldnull <null>
ldnull <null>
newobj System.Void Y1pOlJaV4xK9cnjAXKl.vLhUlsa9SjNmp2W9kOW::.ctor(System.String,System.String)
call System.Void z5yZrLFrMjyKQh0tK83.waHBYpFvPspyr9Ecy1L::SyFFLjRjMf(Y1pOlJaV4xK9cnjAXKl.vLhUlsa9SjNmp2W9kOW)
ldc.i4 1
ldsfld <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3} <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_61ffaf1c54b5412286395a1cd38fd9e1
ldfld System.Int32 <Module>{9461ee97-7940-4431-8a26-c9c75b3dd7d3}::m_b0905976609e43668c9911ceaf5ea022
brtrue IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C4,IL_0079,IL_0030,IL_0055,IL_00C3)
Embedded Resources UNKNWOWNsuspect
6huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙