Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 8 files
EXE09d7b1584ffef9f398c3c7acaaf299b5
Structure
Name Value
Module Name
Vrpdwsxm.exe
Full Name
Vrpdwsxm.exe
EntryPoint
System.Void jXrtSMrUiFwmclHaG5.kuqyEXBNO7igYCYQla::xGTEG6cmr()
Scope Name
Vrpdwsxm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vrpdwsxm
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void jXrtSMrUiFwmclHaG5.kuqyEXBNO7igYCYQla::xGTEG6cmr()
Main IL Instruction Count
89
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0009: ldloc V_1
br IL_002D: nop
nop <null>
call System.Boolean VniB6yqRv8TxS9ZSfH.KON30V9tkH1hQY2Wjv::b4L7nFrBn()
brfalse IL_00AD: ldc.i4 -1755195917
ldc.i4 0
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_5245f043ec1b4e6a88c7ad3d2d0ca894
brfalse IL_0069: switch(IL_00AD,IL_0089)
pop <null>
ldc.i4 1
br IL_0069: switch(IL_00AD,IL_0089)
br IL_0065: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0065: ldloc V_3
br IL_0089: br IL_00CE
br IL_00CE: leave IL_0195
ldc.i4 0
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_0ca36250032748c7b553419650966485
brtrue IL_0069: switch(IL_00AD,IL_0089)
pop <null>
ldc.i4 1
br IL_0069: switch(IL_00AD,IL_0089)
ldc.i4 -1755195917
ldc.i4 -1634844491
xor <null>
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_c646fa82b2b542af82379d81f981f6ec
xor <null>
call System.String EdOjGII7EeF3jgZoYH.eVpuN3AKrkUZrJFLIJ::TYLv6qQYF1(System.Int32)
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
leave IL_0195: ret
stloc.s V_0
ldc.i4 2
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_d0f3d033ef8749bab4c8d321be609d11
brtrue IL_0106: switch(IL_0126,IL_0171)
pop <null>
ldc.i4 0
br IL_0106: switch(IL_0126,IL_0171)
br IL_0102: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0102: ldloc V_2
br IL_0126: ldc.i4 -197640705
ldc.i4 -197640705
ldc.i4 -1913094259
xor <null>
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_0ca36250032748c7b553419650966485
xor <null>
call System.String EdOjGII7EeF3jgZoYH.eVpuN3AKrkUZrJFLIJ::TYLv6qQYF1(System.Int32)
ldloc.s V_0
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4 4
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_f9dcf5ecf77e4d0f97231bd000a88fb8
brtrue IL_0106: switch(IL_0126,IL_0171)
pop <null>
ldc.i4 1
br IL_0106: switch(IL_0126,IL_0171)
leave IL_0195: ret
ldc.i4 0
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_ef921932c3c3422688d57ac288780986
brtrue IL_000D: switch(IL_0195,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0195,IL_002D)
ret <null>
Module Name
Vrpdwsxm.exe
Full Name
Vrpdwsxm.exe
EntryPoint
System.Void jXrtSMrUiFwmclHaG5.kuqyEXBNO7igYCYQla::xGTEG6cmr()
Scope Name
Vrpdwsxm.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vrpdwsxm
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void jXrtSMrUiFwmclHaG5.kuqyEXBNO7igYCYQla::xGTEG6cmr()
Main IL Instruction Count
89
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0009: ldloc V_1
br IL_002D: nop
nop <null>
call System.Boolean VniB6yqRv8TxS9ZSfH.KON30V9tkH1hQY2Wjv::b4L7nFrBn()
brfalse IL_00AD: ldc.i4 -1755195917
ldc.i4 0
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_5245f043ec1b4e6a88c7ad3d2d0ca894
brfalse IL_0069: switch(IL_00AD,IL_0089)
pop <null>
ldc.i4 1
br IL_0069: switch(IL_00AD,IL_0089)
br IL_0065: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0065: ldloc V_3
br IL_0089: br IL_00CE
br IL_00CE: leave IL_0195
ldc.i4 0
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_0ca36250032748c7b553419650966485
brtrue IL_0069: switch(IL_00AD,IL_0089)
pop <null>
ldc.i4 1
br IL_0069: switch(IL_00AD,IL_0089)
ldc.i4 -1755195917
ldc.i4 -1634844491
xor <null>
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_c646fa82b2b542af82379d81f981f6ec
xor <null>
call System.String EdOjGII7EeF3jgZoYH.eVpuN3AKrkUZrJFLIJ::TYLv6qQYF1(System.Int32)
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
leave IL_0195: ret
stloc.s V_0
ldc.i4 2
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_d0f3d033ef8749bab4c8d321be609d11
brtrue IL_0106: switch(IL_0126,IL_0171)
pop <null>
ldc.i4 0
br IL_0106: switch(IL_0126,IL_0171)
br IL_0102: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0102: ldloc V_2
br IL_0126: ldc.i4 -197640705
ldc.i4 -197640705
ldc.i4 -1913094259
xor <null>
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_0ca36250032748c7b553419650966485
xor <null>
call System.String EdOjGII7EeF3jgZoYH.eVpuN3AKrkUZrJFLIJ::TYLv6qQYF1(System.Int32)
ldloc.s V_0
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4 4
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_f9dcf5ecf77e4d0f97231bd000a88fb8
brtrue IL_0106: switch(IL_0126,IL_0171)
pop <null>
ldc.i4 1
br IL_0106: switch(IL_0126,IL_0171)
leave IL_0195: ret
ldc.i4 0
ldsfld <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc} <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_678a7a510ebb404685ff6c1c7e493b91
ldfld System.Int32 <Module>{1fffd0e7-5633-40aa-b492-8783c3bf20bc}::m_ef921932c3c3422688d57ac288780986
brtrue IL_000D: switch(IL_0195,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0195,IL_002D)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙