Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 8 files
EXE09b9860485fefddc9601022c85cbd03b
Structure
Name Value
Module Name
GwjTzdFweerUKfp3CRtAt4w2m2UA3U3T
Full Name
GwjTzdFweerUKfp3CRtAt4w2m2UA3U3T
EntryPoint
System.Void U7E7XJcZlB9IBOk2IeG.zDTQx1cEfhoK8ZMZcQw::aLxccIBELT(System.String[])
Scope Name
GwjTzdFweerUKfp3CRtAt4w2m2UA3U3T
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tX6VM
Assembly Version
5.5.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void U7E7XJcZlB9IBOk2IeG.zDTQx1cEfhoK8ZMZcQw::aLxccIBELT(System.String[])
Main IL Instruction Count
76
Main IL 
ldc.i4 6
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_005D: ldarg.0
ldarg.0 <null>
brfalse IL_00B1: ldnull
ldc.i4 0
ldsfld <Module>{64d01213-513d-403d-8576-7d7976066c47} <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_5953a6706b844d0fb3394388ecc69319
ldfld System.Int32 <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_3920486302df48eda0f032d1d9ca4b58
brtrue IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
ldarg.0 <null>
ldlen <null>
brtrue IL_00E0: ldarg.0
ldc.i4 2
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
nop <null>
ret <null>
nop <null>
newobj System.Void Ab7Yot4t1LDhNu9orxt.diRZTo4Fxw2x4WLQHsB::.ctor()
pop <null>
ldc.i4 3
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
nop <null>
ldc.i4 -996330864
ldc.i4 -349447624
xor <null>
ldsfld <Module>{64d01213-513d-403d-8576-7d7976066c47} <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_5953a6706b844d0fb3394388ecc69319
ldfld System.Int32 <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_6b34bb8c1baa478aaf64a2b6415e0eeb
xor <null>
call System.String IbRV3T86aXLCk5bGb6b.WM8Cto8C7AVRvadcxgF::HSr81dDLFg(System.Int32)
newobj System.Void MInWJjDLwIAITRYtPBa.FSFw20D5ZVFkiFjrgvS::.ctor(System.String)
call System.Void MInWJjDLwIAITRYtPBa.FSFw20D5ZVFkiFjrgvS::M1cDRVarnN()
ldc.i4 4
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
ldnull <null>
br IL_00E3: ldarg.0
br IL_00E0: ldarg.0
call System.Void hyrl8Z9fvB93J99LMxd.rxdIxf96SU8EaZye9dX::m7U4nHRycuM()
ldc.i4 2
ldsfld <Module>{64d01213-513d-403d-8576-7d7976066c47} <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_5953a6706b844d0fb3394388ecc69319
ldfld System.Int32 <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_ef58ea852019406ea7f2cf079d6b5882
brfalse IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
pop <null>
ldc.i4 5
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldarg.0 <null>
brtrue IL_00EE: ldarg.0
br IL_00FC: ldnull
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
ble IL_00FC: ldnull
br IL_0102: ldarg.0
ldnull <null>
br IL_0105: newobj System.Void AjnoOsleC9DBhrhvtdp.MkLeD9l7WrdZ61dvMrg::.ctor(System.String,System.String)
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
newobj System.Void AjnoOsleC9DBhrhvtdp.MkLeD9l7WrdZ61dvMrg::.ctor(System.String,System.String)
call System.Void ucwFxB4KMIPGFSpD3QK.WZhlPj4iQXjoCvXbmXy::AZL4Ckup2U(AjnoOsleC9DBhrhvtdp.MkLeD9l7WrdZ61dvMrg)
ldc.i4 0
ldsfld <Module>{64d01213-513d-403d-8576-7d7976066c47} <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_5953a6706b844d0fb3394388ecc69319
ldfld System.Int32 <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_04ab1e64a1f840848d4af74d9d5b99e5
brtrue IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
Module Name
GwjTzdFweerUKfp3CRtAt4w2m2UA3U3T
Full Name
GwjTzdFweerUKfp3CRtAt4w2m2UA3U3T
EntryPoint
System.Void U7E7XJcZlB9IBOk2IeG.zDTQx1cEfhoK8ZMZcQw::aLxccIBELT(System.String[])
Scope Name
GwjTzdFweerUKfp3CRtAt4w2m2UA3U3T
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tX6VM
Assembly Version
5.5.6.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void U7E7XJcZlB9IBOk2IeG.zDTQx1cEfhoK8ZMZcQw::aLxccIBELT(System.String[])
Main IL Instruction Count
76
Main IL 
ldc.i4 6
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_005D: ldarg.0
ldarg.0 <null>
brfalse IL_00B1: ldnull
ldc.i4 0
ldsfld <Module>{64d01213-513d-403d-8576-7d7976066c47} <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_5953a6706b844d0fb3394388ecc69319
ldfld System.Int32 <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_3920486302df48eda0f032d1d9ca4b58
brtrue IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
ldarg.0 <null>
ldlen <null>
brtrue IL_00E0: ldarg.0
ldc.i4 2
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
nop <null>
ret <null>
nop <null>
newobj System.Void Ab7Yot4t1LDhNu9orxt.diRZTo4Fxw2x4WLQHsB::.ctor()
pop <null>
ldc.i4 3
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
nop <null>
ldc.i4 -996330864
ldc.i4 -349447624
xor <null>
ldsfld <Module>{64d01213-513d-403d-8576-7d7976066c47} <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_5953a6706b844d0fb3394388ecc69319
ldfld System.Int32 <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_6b34bb8c1baa478aaf64a2b6415e0eeb
xor <null>
call System.String IbRV3T86aXLCk5bGb6b.WM8Cto8C7AVRvadcxgF::HSr81dDLFg(System.Int32)
newobj System.Void MInWJjDLwIAITRYtPBa.FSFw20D5ZVFkiFjrgvS::.ctor(System.String)
call System.Void MInWJjDLwIAITRYtPBa.FSFw20D5ZVFkiFjrgvS::M1cDRVarnN()
ldc.i4 4
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
ldnull <null>
br IL_00E3: ldarg.0
br IL_00E0: ldarg.0
call System.Void hyrl8Z9fvB93J99LMxd.rxdIxf96SU8EaZye9dX::m7U4nHRycuM()
ldc.i4 2
ldsfld <Module>{64d01213-513d-403d-8576-7d7976066c47} <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_5953a6706b844d0fb3394388ecc69319
ldfld System.Int32 <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_ef58ea852019406ea7f2cf079d6b5882
brfalse IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
pop <null>
ldc.i4 5
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldarg.0 <null>
brtrue IL_00EE: ldarg.0
br IL_00FC: ldnull
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
ble IL_00FC: ldnull
br IL_0102: ldarg.0
ldnull <null>
br IL_0105: newobj System.Void AjnoOsleC9DBhrhvtdp.MkLeD9l7WrdZ61dvMrg::.ctor(System.String,System.String)
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
newobj System.Void AjnoOsleC9DBhrhvtdp.MkLeD9l7WrdZ61dvMrg::.ctor(System.String,System.String)
call System.Void ucwFxB4KMIPGFSpD3QK.WZhlPj4iQXjoCvXbmXy::AZL4Ckup2U(AjnoOsleC9DBhrhvtdp.MkLeD9l7WrdZ61dvMrg)
ldc.i4 0
ldsfld <Module>{64d01213-513d-403d-8576-7d7976066c47} <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_5953a6706b844d0fb3394388ecc69319
ldfld System.Int32 <Module>{64d01213-513d-403d-8576-7d7976066c47}::m_04ab1e64a1f840848d4af74d9d5b99e5
brtrue IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_005D,IL_0081,IL_00B1,IL_0038,IL_006E,IL_0070,IL_00BC)
Embedded Resources UNKNWOWNsuspect
6huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙