Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
07cc0a73bc6f6bc2fcec29c4e4871a46
[Authenticode]_c3e86401.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x1C000 size 11896 bytes
Module Name
Booking_09_18_2025.exe
Full Name
Booking_09_18_2025.exe
EntryPoint
System.Void Uuube.Builders.ConnectedBuilder::ConstructOperationalBuilder()
Scope Name
Booking_09_18_2025.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Booking_09_18_2025
Assembly Version
5.5.3.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
5
Main Method
System.Void Uuube.Builders.ConnectedBuilder::ConstructOperationalBuilder()
Main IL Instruction Count
33
Main IL 
ldc.i4 1
stloc V_2
br IL_000E: ldloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_002C: newobj System.Void Booking_09_18_2025.Collectors.ReceiverAnalyzer::.ctor()
newobj System.Void Booking_09_18_2025.Collectors.ReceiverAnalyzer::.ctor()
ldloc.s V_0
call System.Byte[] Booking_09_18_2025.Collectors.ReceiverAnalyzer::AcceptConvertibleReceiver(System.Byte[])
stloc.s V_1
ldc.i4 3
br IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
newobj System.Void Uuube.Explorers.ClientProc::.ctor()
call System.Byte[] Uuube.Explorers.ClientProc::ControlExplorer()
stloc.s V_0
ldc.i4 0
ldsfld <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1} <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1}::m_289022b64cd0452c9a5ec47ee0157315
ldfld System.Int32 <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1}::m_5707318240e64fca842b40eb5f5f8df2
brfalse IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
newobj System.Void Uuube.Metadata.DefinitionInspector::.ctor()
ldloc.s V_1
call System.Void Uuube.Metadata.DefinitionInspector::SpecifyLogicalDefinition(System.Byte[])
ldc.i4 0
ldsfld <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1} <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1}::m_289022b64cd0452c9a5ec47ee0157315
ldfld System.Int32 <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1}::m_16ffa0b951ac41a7b9a4d74d6241566c
brfalse IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
ret <null>
Module Name
Booking_09_18_2025.exe
Full Name
Booking_09_18_2025.exe
EntryPoint
System.Void Uuube.Builders.ConnectedBuilder::ConstructOperationalBuilder()
Scope Name
Booking_09_18_2025.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Booking_09_18_2025
Assembly Version
5.5.3.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
5
Main Method
System.Void Uuube.Builders.ConnectedBuilder::ConstructOperationalBuilder()
Main IL Instruction Count
33
Main IL 
ldc.i4 1
stloc V_2
br IL_000E: ldloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_002C: newobj System.Void Booking_09_18_2025.Collectors.ReceiverAnalyzer::.ctor()
newobj System.Void Booking_09_18_2025.Collectors.ReceiverAnalyzer::.ctor()
ldloc.s V_0
call System.Byte[] Booking_09_18_2025.Collectors.ReceiverAnalyzer::AcceptConvertibleReceiver(System.Byte[])
stloc.s V_1
ldc.i4 3
br IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
newobj System.Void Uuube.Explorers.ClientProc::.ctor()
call System.Byte[] Uuube.Explorers.ClientProc::ControlExplorer()
stloc.s V_0
ldc.i4 0
ldsfld <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1} <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1}::m_289022b64cd0452c9a5ec47ee0157315
ldfld System.Int32 <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1}::m_5707318240e64fca842b40eb5f5f8df2
brfalse IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
newobj System.Void Uuube.Metadata.DefinitionInspector::.ctor()
ldloc.s V_1
call System.Void Uuube.Metadata.DefinitionInspector::SpecifyLogicalDefinition(System.Byte[])
ldc.i4 0
ldsfld <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1} <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1}::m_289022b64cd0452c9a5ec47ee0157315
ldfld System.Int32 <Module>{6853982d-e188-433c-b8d5-f6d3114c76f1}::m_16ffa0b951ac41a7b9a4d74d6241566c
brfalse IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_002C,IL_0044,IL_009A,IL_006F)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙