Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 10 files
EXE0ee65b4c77438df8fe4f75cec1ce3e82
Structure
BINOverlay_d71af3ea.bin
Name Value
Info
Overlay extracted: Overlay_d71af3ea.bin (30720 bytes)
Module Name
Rvubltxb.exe
Full Name
Rvubltxb.exe
EntryPoint
System.Void Mj3OKsPMsuCyn2icDP.uExPoqcHL6mNcZRlPh::qHJrFoj6A()
Scope Name
Rvubltxb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rvubltxb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void Mj3OKsPMsuCyn2icDP.uExPoqcHL6mNcZRlPh::qHJrFoj6A()
Main IL Instruction Count
115
Main IL 
ldc.i4 1
stloc V_6
ldloc V_6
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_6
ldc.i4 989
beq IL_0009: ldloc V_6
br IL_002D: ret
ret <null>
nop <null>
newobj System.Void Ok7rDvWjYeQU9M5u72.gO9QjbA1OTqnl6E57a::.ctor()
stloc.s V_4
ldc.i4 3
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_5a528ab05e444329bfd1e537e7e45964
brtrue IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
pop <null>
ldc.i4 1
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
br IL_0063: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 12
beq IL_0128: br IL_0189
ldloc V_1
ldc.i4 992
beq IL_0063: ldloc V_1
br IL_014C: newobj System.Void n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e::.ctor()
newobj System.Void xwoB266ZxvUNqnWAMV.d8IOYX7B4UMe1NK690::.ctor()
dup <null>
dup <null>
ldsfld T1iIwtpe1V5Aptp5eJ5 T1iIwtpe1V5Aptp5eJ5::f6Mp5kgMW2
call System.Void T1iIwtpe1V5Aptp5eJ5::C2lprleCvo(System.Object,xwoB266ZxvUNqnWAMV.d8IOYX7B4UMe1NK690,T1iIwtpe1V5Aptp5eJ5)
dup <null>
ldloc.s V_3
ldsfld RlaobVpvBkxkWXhELGr RlaobVpvBkxkWXhELGr::ClopQcCOux
call System.Void RlaobVpvBkxkWXhELGr::C2lprleCvo(System.Object,ujyK0bOchtLig3roWt.C55bR4F96a2RGHGxo3,RlaobVpvBkxkWXhELGr)
ldloc.s V_3
ldloc.s V_2
ldsfld R2PTChpoOrvee5wIMy0 R2PTChpoOrvee5wIMy0::N13pxrn0Ot
call System.Void R2PTChpoOrvee5wIMy0::C2lprleCvo(System.Object,SvWV3AXXdqCstidCO5.vAEgcllpBQ325CxkNy,R2PTChpoOrvee5wIMy0)
ldloc.s V_2
ldloc.s V_5
ldsfld r2q2Thpi42JOgo72xVt r2q2Thpi42JOgo72xVt::BY3pS7o5PT
call System.Void r2q2Thpi42JOgo72xVt::C2lprleCvo(System.Object,n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e,r2q2Thpi42JOgo72xVt)
ldloc.s V_5
ldloc.s V_4
ldsfld ax2TRRphZ2iI3YW8Vcx ax2TRRphZ2iI3YW8Vcx::PX4pkSqv23
call System.Void ax2TRRphZ2iI3YW8Vcx::C2lprleCvo(System.Object,Ok7rDvWjYeQU9M5u72.gO9QjbA1OTqnl6E57a,ax2TRRphZ2iI3YW8Vcx)
ldsfld zF7Q1spK6AIY664rq4H zF7Q1spK6AIY664rq4H::AKMpEBN99x
call System.Boolean zF7Q1spK6AIY664rq4H::C2lprleCvo(System.Object,zF7Q1spK6AIY664rq4H)
brfalse IL_0183: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 12
br IL_005F: stloc V_1
newobj System.Void SvWV3AXXdqCstidCO5.vAEgcllpBQ325CxkNy::.ctor()
stloc.s V_2
ldc.i4 3
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_1cada29d1a014525b23dfaaf2fe67c0f
brfalse IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
pop <null>
ldc.i4 2
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
br IL_0189: leave IL_002D
ldc.i4 11
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_122bb212342d4acb9655a3f2454f3a8d
brfalse IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
pop <null>
ldc.i4 0
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
newobj System.Void n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e::.ctor()
stloc.s V_5
ldc.i4 2
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_ef98640fc9024d86a847b9a63129fbeb
brtrue IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
pop <null>
ldc.i4 8
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
newobj System.Void ujyK0bOchtLig3roWt.C55bR4F96a2RGHGxo3::.ctor()
stloc.s V_3
ldc.i4 4
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_002D: ret
pop <null>
ldc.i4 3
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c4a2f8bb74284ce7b28b15671af34c01
brtrue IL_01C0: switch(IL_01DC)
pop <null>
ldc.i4 0
br IL_01C0: switch(IL_01DC)
br IL_01BC: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_01BC: ldloc V_0
br IL_01DC: leave IL_002D
leave IL_002D: ret
ldc.i4 0
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_77da541c638240fe980f0effd80e6faf
brfalse IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 4
br IL_000D: switch(IL_002D,IL_002E)
Module Name
Rvubltxb.exe
Full Name
Rvubltxb.exe
EntryPoint
System.Void Mj3OKsPMsuCyn2icDP.uExPoqcHL6mNcZRlPh::qHJrFoj6A()
Scope Name
Rvubltxb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rvubltxb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void Mj3OKsPMsuCyn2icDP.uExPoqcHL6mNcZRlPh::qHJrFoj6A()
Main IL Instruction Count
115
Main IL 
ldc.i4 1
stloc V_6
ldloc V_6
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_6
ldc.i4 989
beq IL_0009: ldloc V_6
br IL_002D: ret
ret <null>
nop <null>
newobj System.Void Ok7rDvWjYeQU9M5u72.gO9QjbA1OTqnl6E57a::.ctor()
stloc.s V_4
ldc.i4 3
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_5a528ab05e444329bfd1e537e7e45964
brtrue IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
pop <null>
ldc.i4 1
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
br IL_0063: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 12
beq IL_0128: br IL_0189
ldloc V_1
ldc.i4 992
beq IL_0063: ldloc V_1
br IL_014C: newobj System.Void n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e::.ctor()
newobj System.Void xwoB266ZxvUNqnWAMV.d8IOYX7B4UMe1NK690::.ctor()
dup <null>
dup <null>
ldsfld T1iIwtpe1V5Aptp5eJ5 T1iIwtpe1V5Aptp5eJ5::f6Mp5kgMW2
call System.Void T1iIwtpe1V5Aptp5eJ5::C2lprleCvo(System.Object,xwoB266ZxvUNqnWAMV.d8IOYX7B4UMe1NK690,T1iIwtpe1V5Aptp5eJ5)
dup <null>
ldloc.s V_3
ldsfld RlaobVpvBkxkWXhELGr RlaobVpvBkxkWXhELGr::ClopQcCOux
call System.Void RlaobVpvBkxkWXhELGr::C2lprleCvo(System.Object,ujyK0bOchtLig3roWt.C55bR4F96a2RGHGxo3,RlaobVpvBkxkWXhELGr)
ldloc.s V_3
ldloc.s V_2
ldsfld R2PTChpoOrvee5wIMy0 R2PTChpoOrvee5wIMy0::N13pxrn0Ot
call System.Void R2PTChpoOrvee5wIMy0::C2lprleCvo(System.Object,SvWV3AXXdqCstidCO5.vAEgcllpBQ325CxkNy,R2PTChpoOrvee5wIMy0)
ldloc.s V_2
ldloc.s V_5
ldsfld r2q2Thpi42JOgo72xVt r2q2Thpi42JOgo72xVt::BY3pS7o5PT
call System.Void r2q2Thpi42JOgo72xVt::C2lprleCvo(System.Object,n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e,r2q2Thpi42JOgo72xVt)
ldloc.s V_5
ldloc.s V_4
ldsfld ax2TRRphZ2iI3YW8Vcx ax2TRRphZ2iI3YW8Vcx::PX4pkSqv23
call System.Void ax2TRRphZ2iI3YW8Vcx::C2lprleCvo(System.Object,Ok7rDvWjYeQU9M5u72.gO9QjbA1OTqnl6E57a,ax2TRRphZ2iI3YW8Vcx)
ldsfld zF7Q1spK6AIY664rq4H zF7Q1spK6AIY664rq4H::AKMpEBN99x
call System.Boolean zF7Q1spK6AIY664rq4H::C2lprleCvo(System.Object,zF7Q1spK6AIY664rq4H)
brfalse IL_0183: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 12
br IL_005F: stloc V_1
newobj System.Void SvWV3AXXdqCstidCO5.vAEgcllpBQ325CxkNy::.ctor()
stloc.s V_2
ldc.i4 3
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_1cada29d1a014525b23dfaaf2fe67c0f
brfalse IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
pop <null>
ldc.i4 2
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
br IL_0189: leave IL_002D
ldc.i4 11
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_122bb212342d4acb9655a3f2454f3a8d
brfalse IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
pop <null>
ldc.i4 0
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
newobj System.Void n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e::.ctor()
stloc.s V_5
ldc.i4 2
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_ef98640fc9024d86a847b9a63129fbeb
brtrue IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
pop <null>
ldc.i4 8
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
newobj System.Void ujyK0bOchtLig3roWt.C55bR4F96a2RGHGxo3::.ctor()
stloc.s V_3
ldc.i4 4
br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1)
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_002D: ret
pop <null>
ldc.i4 3
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c4a2f8bb74284ce7b28b15671af34c01
brtrue IL_01C0: switch(IL_01DC)
pop <null>
ldc.i4 0
br IL_01C0: switch(IL_01DC)
br IL_01BC: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_01BC: ldloc V_0
br IL_01DC: leave IL_002D
leave IL_002D: ret
ldc.i4 0
ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798
ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_77da541c638240fe980f0effd80e6faf
brfalse IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 4
br IL_000D: switch(IL_002D,IL_002E)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙