Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 8 files
EXE0fb20f80e047492f725c8fc8607b3715
Structure
Name Value
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void vJRmHf3QxbCBSMr54Hn.uO92SG3UBMRX7OMwlMt::Rmj3MhNhx9()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void vJRmHf3QxbCBSMr54Hn.uO92SG3UBMRX7OMwlMt::Rmj3MhNhx9()
Main IL Instruction Count
49
Main IL 
ldc.i4 4
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C3: ret
ldc.i4 2050687969
ldc.i4 634608930
xor <null>
ldc.i4 1448022369
xor <null>
ldsfld <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b} <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_175e94c905b94bd6afd3c90b507e36e2
ldfld System.Int32 <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_eaaf00d1fc794a27b8fb8554ed26ea63
xor <null>
call System.String Ed8x7NfrYAcP2RgO9JZ.HFyEd1fqPPjaxOSKRW7::NfIfEOnv1m(System.Int32)
newobj System.Void aUI7ZotWn4BDFsvRwGA.l6jYrwtpwgxvfEWMFh1::.ctor(System.String)
call System.Void aUI7ZotWn4BDFsvRwGA.l6jYrwtpwgxvfEWMFh1::jVPtACrdjq()
ldc.i4 0
ldsfld <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b} <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_175e94c905b94bd6afd3c90b507e36e2
ldfld System.Int32 <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_35657721040b4eb685b08b568fdeaf34
brtrue IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
newobj System.Void e0VFidapA435ebXZ52L.QF8jFva0FSDG5NqrS9t::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b} <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_175e94c905b94bd6afd3c90b507e36e2
ldfld System.Int32 <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_602de469dae8465ea25c4bc99212b274
brtrue IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
call System.Void MgJRoRw7bFGU8lXXtWh.uwjB7qwrlQVijvCUYJI::gH4oarCqgUv()
ldc.i4 3
ldsfld <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b} <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_175e94c905b94bd6afd3c90b507e36e2
ldfld System.Int32 <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_c2ffb68a0b5f43c685c04469ffecf38a
brfalse IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
ret <null>
ldnull <null>
ldnull <null>
newobj System.Void RrSaMWQxtlv1k7h312l.z6HY1lQSlLxwhIEhrUF::.ctor(System.String,System.String)
call System.Void EdTEOeoBFrVrdIR0cOr.lipYH2o3ASfp1L2Ka5M::LU3oGIikaB(RrSaMWQxtlv1k7h312l.z6HY1lQSlLxwhIEhrUF)
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
Module Name
pxqDsBPmp0nY
Full Name
pxqDsBPmp0nY
EntryPoint
System.Void vJRmHf3QxbCBSMr54Hn.uO92SG3UBMRX7OMwlMt::Rmj3MhNhx9()
Scope Name
pxqDsBPmp0nY
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
SGxDUr5uRrbW2X9YcTIdUkMi5E
Assembly Version
4.1.5.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void vJRmHf3QxbCBSMr54Hn.uO92SG3UBMRX7OMwlMt::Rmj3MhNhx9()
Main IL Instruction Count
49
Main IL 
ldc.i4 4
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C3: ret
ldc.i4 2050687969
ldc.i4 634608930
xor <null>
ldc.i4 1448022369
xor <null>
ldsfld <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b} <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_175e94c905b94bd6afd3c90b507e36e2
ldfld System.Int32 <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_eaaf00d1fc794a27b8fb8554ed26ea63
xor <null>
call System.String Ed8x7NfrYAcP2RgO9JZ.HFyEd1fqPPjaxOSKRW7::NfIfEOnv1m(System.Int32)
newobj System.Void aUI7ZotWn4BDFsvRwGA.l6jYrwtpwgxvfEWMFh1::.ctor(System.String)
call System.Void aUI7ZotWn4BDFsvRwGA.l6jYrwtpwgxvfEWMFh1::jVPtACrdjq()
ldc.i4 0
ldsfld <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b} <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_175e94c905b94bd6afd3c90b507e36e2
ldfld System.Int32 <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_35657721040b4eb685b08b568fdeaf34
brtrue IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
newobj System.Void e0VFidapA435ebXZ52L.QF8jFva0FSDG5NqrS9t::.ctor()
pop <null>
ldc.i4 0
ldsfld <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b} <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_175e94c905b94bd6afd3c90b507e36e2
ldfld System.Int32 <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_602de469dae8465ea25c4bc99212b274
brtrue IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
call System.Void MgJRoRw7bFGU8lXXtWh.uwjB7qwrlQVijvCUYJI::gH4oarCqgUv()
ldc.i4 3
ldsfld <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b} <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_175e94c905b94bd6afd3c90b507e36e2
ldfld System.Int32 <Module>{31b8ffcb-5be4-4a38-ad66-bc069ce1a17b}::m_c2ffb68a0b5f43c685c04469ffecf38a
brfalse IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_00C3,IL_00C4,IL_0030,IL_007A,IL_009F)
ret <null>
ldnull <null>
ldnull <null>
newobj System.Void RrSaMWQxtlv1k7h312l.z6HY1lQSlLxwhIEhrUF::.ctor(System.String,System.String)
call System.Void EdTEOeoBFrVrdIR0cOr.lipYH2o3ASfp1L2Ka5M::LU3oGIikaB(RrSaMWQxtlv1k7h312l.z6HY1lQSlLxwhIEhrUF)
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
An error has occurred. This application may no longer respond until reloaded. Reload 🗙