Malicious
Malicious

0ee65b4c77438df8fe4f75cec1ce3e82

PE Executable
|
MD5: 0ee65b4c77438df8fe4f75cec1ce3e82
|
Size: 637.44 KB
|
application/x-dosexec

Print
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Obfuscation Score

Very high

Hash
 Hash Value
MD5
0ee65b4c77438df8fe4f75cec1ce3e82
Sha1
9fc45e90e57d92841496f2f1b72df9efe9f9e673
Sha256
e2b11cbdaac1a38075e9a53405ce8c62d81ecae18492a7f79fcab0485586f7b3
Sha384
cbb1a9b397dca7e3b33094074560e327e5eec1f43203498f932b3f44cf8606b798d27ce4a77102a1ed9c90e92d14299c
Sha512
a0740b8469b8a478e1eae1500f0ae538d76fdeb5e5ac71e6357e20432d47a543ea6de7c59daee01068524a85f37a835ef088663ccef8e2368e4efedb70fe364e
SSDeep
12288:a4uaRgM32mJ35b0YpJc91O+YDWwqq40PnnJrFaIQpwgm2dew:1fPG15cWwqCRT6X
TLSH
7FD49E7736524E21C3A64333C1C78940D7B4A686B9A7F70E7196239724123EFDE4A3A7

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
0ee65b4c77438df8fe4f75cec1ce3e82
Malicious
Overlay_d71af3ea.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
UaFaeC3OClcdoiihms.AudwJjgeSEm6DuhQvI
Rvubltxb.g.resources
Rp9i5FNCgMp7eFpg6y.0qtSS9RaqhYJxl6fv9
sR1HS7bC1ln8xbPy1M.suyAbepj8AtUkRe8pL
Ttqobcaxn.Properties.Resources.resources
Uxgajihni
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Info

Overlay extracted: Overlay_d71af3ea.bin (30720 bytes)
Module Name

Rvubltxb.exe
Full Name

Rvubltxb.exe
EntryPoint

System.Void Mj3OKsPMsuCyn2icDP.uExPoqcHL6mNcZRlPh::qHJrFoj6A()
Scope Name

Rvubltxb.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Rvubltxb
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

43
Main Method

System.Void Mj3OKsPMsuCyn2icDP.uExPoqcHL6mNcZRlPh::qHJrFoj6A()
Main IL Instruction Count

115
Main IL

ldc.i4 1 stloc V_6 ldloc V_6 switch dnlib.DotNet.Emit.Instruction[] ldloc V_6 ldc.i4 989 beq IL_0009: ldloc V_6 br IL_002D: ret ret <null> nop <null> newobj System.Void Ok7rDvWjYeQU9M5u72.gO9QjbA1OTqnl6E57a::.ctor() stloc.s V_4 ldc.i4 3 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_5a528ab05e444329bfd1e537e7e45964 brtrue IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) pop <null> ldc.i4 1 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) br IL_0063: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 12 beq IL_0128: br IL_0189 ldloc V_1 ldc.i4 992 beq IL_0063: ldloc V_1 br IL_014C: newobj System.Void n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e::.ctor() newobj System.Void xwoB266ZxvUNqnWAMV.d8IOYX7B4UMe1NK690::.ctor() dup <null> dup <null> ldsfld T1iIwtpe1V5Aptp5eJ5 T1iIwtpe1V5Aptp5eJ5::f6Mp5kgMW2 call System.Void T1iIwtpe1V5Aptp5eJ5::C2lprleCvo(System.Object,xwoB266ZxvUNqnWAMV.d8IOYX7B4UMe1NK690,T1iIwtpe1V5Aptp5eJ5) dup <null> ldloc.s V_3 ldsfld RlaobVpvBkxkWXhELGr RlaobVpvBkxkWXhELGr::ClopQcCOux call System.Void RlaobVpvBkxkWXhELGr::C2lprleCvo(System.Object,ujyK0bOchtLig3roWt.C55bR4F96a2RGHGxo3,RlaobVpvBkxkWXhELGr) ldloc.s V_3 ldloc.s V_2 ldsfld R2PTChpoOrvee5wIMy0 R2PTChpoOrvee5wIMy0::N13pxrn0Ot call System.Void R2PTChpoOrvee5wIMy0::C2lprleCvo(System.Object,SvWV3AXXdqCstidCO5.vAEgcllpBQ325CxkNy,R2PTChpoOrvee5wIMy0) ldloc.s V_2 ldloc.s V_5 ldsfld r2q2Thpi42JOgo72xVt r2q2Thpi42JOgo72xVt::BY3pS7o5PT call System.Void r2q2Thpi42JOgo72xVt::C2lprleCvo(System.Object,n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e,r2q2Thpi42JOgo72xVt) ldloc.s V_5 ldloc.s V_4 ldsfld ax2TRRphZ2iI3YW8Vcx ax2TRRphZ2iI3YW8Vcx::PX4pkSqv23 call System.Void ax2TRRphZ2iI3YW8Vcx::C2lprleCvo(System.Object,Ok7rDvWjYeQU9M5u72.gO9QjbA1OTqnl6E57a,ax2TRRphZ2iI3YW8Vcx) ldsfld zF7Q1spK6AIY664rq4H zF7Q1spK6AIY664rq4H::AKMpEBN99x call System.Boolean zF7Q1spK6AIY664rq4H::C2lprleCvo(System.Object,zF7Q1spK6AIY664rq4H) brfalse IL_0183: newobj System.Void System.InvalidOperationException::.ctor() ldc.i4 12 br IL_005F: stloc V_1 newobj System.Void SvWV3AXXdqCstidCO5.vAEgcllpBQ325CxkNy::.ctor() stloc.s V_2 ldc.i4 3 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_1cada29d1a014525b23dfaaf2fe67c0f brfalse IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) pop <null> ldc.i4 2 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) br IL_0189: leave IL_002D ldc.i4 11 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_122bb212342d4acb9655a3f2454f3a8d brfalse IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) pop <null> ldc.i4 0 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) newobj System.Void n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e::.ctor() stloc.s V_5 ldc.i4 2 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_ef98640fc9024d86a847b9a63129fbeb brtrue IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) pop <null> ldc.i4 8 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) newobj System.Void ujyK0bOchtLig3roWt.C55bR4F96a2RGHGxo3::.ctor() stloc.s V_3 ldc.i4 4 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 3 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c4a2f8bb74284ce7b28b15671af34c01 brtrue IL_01C0: switch(IL_01DC) pop <null> ldc.i4 0 br IL_01C0: switch(IL_01DC) br IL_01BC: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_01BC: ldloc V_0 br IL_01DC: leave IL_002D leave IL_002D: ret ldc.i4 0 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_77da541c638240fe980f0effd80e6faf brfalse IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 4 br IL_000D: switch(IL_002D,IL_002E)
Module Name

Rvubltxb.exe
Full Name

Rvubltxb.exe
EntryPoint

System.Void Mj3OKsPMsuCyn2icDP.uExPoqcHL6mNcZRlPh::qHJrFoj6A()
Scope Name

Rvubltxb.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

Rvubltxb
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.0
Total Strings

43
Main Method

System.Void Mj3OKsPMsuCyn2icDP.uExPoqcHL6mNcZRlPh::qHJrFoj6A()
Main IL Instruction Count

115
Main IL

ldc.i4 1 stloc V_6 ldloc V_6 switch dnlib.DotNet.Emit.Instruction[] ldloc V_6 ldc.i4 989 beq IL_0009: ldloc V_6 br IL_002D: ret ret <null> nop <null> newobj System.Void Ok7rDvWjYeQU9M5u72.gO9QjbA1OTqnl6E57a::.ctor() stloc.s V_4 ldc.i4 3 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_5a528ab05e444329bfd1e537e7e45964 brtrue IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) pop <null> ldc.i4 1 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) br IL_0063: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 12 beq IL_0128: br IL_0189 ldloc V_1 ldc.i4 992 beq IL_0063: ldloc V_1 br IL_014C: newobj System.Void n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e::.ctor() newobj System.Void xwoB266ZxvUNqnWAMV.d8IOYX7B4UMe1NK690::.ctor() dup <null> dup <null> ldsfld T1iIwtpe1V5Aptp5eJ5 T1iIwtpe1V5Aptp5eJ5::f6Mp5kgMW2 call System.Void T1iIwtpe1V5Aptp5eJ5::C2lprleCvo(System.Object,xwoB266ZxvUNqnWAMV.d8IOYX7B4UMe1NK690,T1iIwtpe1V5Aptp5eJ5) dup <null> ldloc.s V_3 ldsfld RlaobVpvBkxkWXhELGr RlaobVpvBkxkWXhELGr::ClopQcCOux call System.Void RlaobVpvBkxkWXhELGr::C2lprleCvo(System.Object,ujyK0bOchtLig3roWt.C55bR4F96a2RGHGxo3,RlaobVpvBkxkWXhELGr) ldloc.s V_3 ldloc.s V_2 ldsfld R2PTChpoOrvee5wIMy0 R2PTChpoOrvee5wIMy0::N13pxrn0Ot call System.Void R2PTChpoOrvee5wIMy0::C2lprleCvo(System.Object,SvWV3AXXdqCstidCO5.vAEgcllpBQ325CxkNy,R2PTChpoOrvee5wIMy0) ldloc.s V_2 ldloc.s V_5 ldsfld r2q2Thpi42JOgo72xVt r2q2Thpi42JOgo72xVt::BY3pS7o5PT call System.Void r2q2Thpi42JOgo72xVt::C2lprleCvo(System.Object,n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e,r2q2Thpi42JOgo72xVt) ldloc.s V_5 ldloc.s V_4 ldsfld ax2TRRphZ2iI3YW8Vcx ax2TRRphZ2iI3YW8Vcx::PX4pkSqv23 call System.Void ax2TRRphZ2iI3YW8Vcx::C2lprleCvo(System.Object,Ok7rDvWjYeQU9M5u72.gO9QjbA1OTqnl6E57a,ax2TRRphZ2iI3YW8Vcx) ldsfld zF7Q1spK6AIY664rq4H zF7Q1spK6AIY664rq4H::AKMpEBN99x call System.Boolean zF7Q1spK6AIY664rq4H::C2lprleCvo(System.Object,zF7Q1spK6AIY664rq4H) brfalse IL_0183: newobj System.Void System.InvalidOperationException::.ctor() ldc.i4 12 br IL_005F: stloc V_1 newobj System.Void SvWV3AXXdqCstidCO5.vAEgcllpBQ325CxkNy::.ctor() stloc.s V_2 ldc.i4 3 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_1cada29d1a014525b23dfaaf2fe67c0f brfalse IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) pop <null> ldc.i4 2 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) br IL_0189: leave IL_002D ldc.i4 11 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_122bb212342d4acb9655a3f2454f3a8d brfalse IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) pop <null> ldc.i4 0 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) newobj System.Void n7atVCS6KkQ4WAv2pS.HqGqYxikNQm1h3vS2e::.ctor() stloc.s V_5 ldc.i4 2 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_ef98640fc9024d86a847b9a63129fbeb brtrue IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) pop <null> ldc.i4 8 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) newobj System.Void ujyK0bOchtLig3roWt.C55bR4F96a2RGHGxo3::.ctor() stloc.s V_3 ldc.i4 4 br IL_0067: switch(IL_0183,IL_014C,IL_0102,IL_0172,IL_00A1) newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 3 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c4a2f8bb74284ce7b28b15671af34c01 brtrue IL_01C0: switch(IL_01DC) pop <null> ldc.i4 0 br IL_01C0: switch(IL_01DC) br IL_01BC: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_01BC: ldloc V_0 br IL_01DC: leave IL_002D leave IL_002D: ret ldc.i4 0 ldsfld <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903} <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_c996f55bff814abdb2bf379dcaa61798 ldfld System.Int32 <Module>{ed0a17fb-bb74-43f3-acd3-f8f45d5cc903}::m_77da541c638240fe980f0effd80e6faf brfalse IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 4 br IL_000D: switch(IL_002D,IL_002E)
0ee65b4c77438df8fe4f75cec1ce3e82 (637.44 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙