Malicious PE Executable analysis – 08f2d33cf68f

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Very high

1 malicious · 13 files

EXE08f2d33cf68f26d03ed50611d5d8db7b

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Czpjtmmhz.exe
Full Name	Czpjtmmhz.exe
EntryPoint	System.Void Czpjtmmhz.Scluddsnm::Main()
Scope Name	Czpjtmmhz.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Czpjtmmhz
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void Czpjtmmhz.Scluddsnm::Main()
Main IL Instruction Count	99
Main IL	ldc.i4 2 stloc V_3 br IL_000E: ldloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_0092: nop br IL_0059: newobj System.Void Czpjtmmhz.Prfjffnsizp::.ctor() ldc.i4 0 ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_5a08d8e1d9fe4e73bc68d26889a82d70 brfalse IL_0012: switch(IL_0092,IL_0058,IL_0034,IL_01A7,IL_007F,IL_01AC) pop <null> ldc.i4 1 br IL_0012: switch(IL_0092,IL_0058,IL_0034,IL_01A7,IL_007F,IL_01AC) ret <null> newobj System.Void Czpjtmmhz.Prfjffnsizp::.ctor() stloc.s V_1 ldc.i4 4 ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_64ae6e9c13cb4e409fbae7ddeae8db8a brfalse IL_0012: switch(IL_0092,IL_0058,IL_0034,IL_01A7,IL_007F,IL_01AC) pop <null> ldc.i4 0 br IL_0012: switch(IL_0092,IL_0058,IL_0034,IL_01A7,IL_007F,IL_01AC) br IL_01AC: nop ldc.i4 5 stloc V_3 br IL_000E: ldloc V_3 nop <null> ldloc.s V_1 call System.Byte[] Czpjtmmhz.Properties.Dkpyel::get_Zwfry() ldsfld System.Object gVxfLlTaJrnWuSUjaf.JnImcUl2ACFxBYGmZ2::ApMDbeJDI ldsfld System.Object gVxfLlTaJrnWuSUjaf.JnImcUl2ACFxBYGmZ2::Lyt1iL8PQ ldc.i4 850302877 ldc.i4 990878238 xor <null> ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_e0f3589686c841b79e116fdaad1d6a8a xor <null> call System.String C4h8Imac4ni3UxAseCy.X0dHqraRYGRpMvIpgaP::REAap2Bdtn(System.Int32) ldc.i4 -619632829 ldc.i4 -1672129975 xor <null> ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_5143997b76b64c8ba40365b5db7aaf91 xor <null> call System.String C4h8Imac4ni3UxAseCy.X0dHqraRYGRpMvIpgaP::REAap2Bdtn(System.Int32) ldnull <null> callvirt System.Void Czpjtmmhz.Prfjffnsizp::Aenmblitkk(System.Byte[],System.Byte[],System.Byte[],System.String,System.String,System.Object[]) ldc.i4 1 ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_59a0445b2aa54e4db605205d2ef11815 brfalse IL_0103: switch(IL_0139,IL_0115) pop <null> ldc.i4 1 br IL_0103: switch(IL_0139,IL_0115) ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0139: leave IL_0058 br IL_0139: leave IL_0058 ldc.i4 0 ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_9893b72886674803ae8ed27054ba083c brtrue IL_0103: switch(IL_0139,IL_0115) pop <null> ldc.i4 0 br IL_0103: switch(IL_0139,IL_0115) leave IL_0058: ret pop <null> ldc.i4 1 ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_232e3d277a384342aa188a784cafa11b brtrue IL_0162: switch(IL_0198,IL_0174) pop <null> ldc.i4 1 br IL_0162: switch(IL_0198,IL_0174) ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] br IL_0198: leave IL_0058 br IL_0198: leave IL_0058 ldc.i4 0 ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_d72ca7518c454ba6b55e7a7b86a25b1b brtrue IL_0162: switch(IL_0198,IL_0174) pop <null> ldc.i4 0 br IL_0162: switch(IL_0198,IL_0174) leave IL_0058: ret ldc.i4 3 br IL_0012: switch(IL_0092,IL_0058,IL_0034,IL_01A7,IL_007F,IL_01AC) br IL_0058: ret nop <null> ldc.i4 0 ldsfld <Module>{70f79a5b-627e-4504-ba86-665622101a20} <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_0c590b57ec55453f835dc35168f9b5b9 ldfld System.Int32 <Module>{70f79a5b-627e-4504-ba86-665622101a20}::m_bef947b78b63458e84fa741650dc6cb8 brtrue IL_0012: switch(IL_0092,IL_0058,IL_0034,IL_01A7,IL_007F,IL_01AC) pop <null> ldc.i4 0 br IL_0012: switch(IL_0092,IL_0058,IL_0034,IL_01A7,IL_007F,IL_01AC)