Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
HQR data fileMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Symbol obfuscation
Low
1 malicious · 5 files
EXE12bfbe5fe642a549541282b4c6e06f8e
Structure
Name Value
Module Name
October Payment1.exe
Full Name
October Payment1.exe
EntryPoint
System.Void OctoberPayment1.Specifications.AlphabeticSpec::JoinSpec()
Scope Name
October Payment1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
October Payment1
Assembly Version
1.0.8128.9236
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1210
Main Method
System.Void OctoberPayment1.Specifications.AlphabeticSpec::JoinSpec()
Main IL Instruction Count
117
Main IL 
ldc.i4 1
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_004F: nop
ret <null>
newobj System.Void OctoberPayment1.Execution.GenericCommand::.ctor()
stloc.s V_2
ldc.i4 0
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_71c2287911d34e0b8a62955434da8071
brfalse IL_0012: switch(IL_004F,IL_0029,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_004F,IL_0029,IL_0028)
nop <null>
ldloc.s V_2
callvirt System.String OctoberPayment1.Execution.GenericCommand::ExecuteConcreteCommand()
brtrue IL_0124: ldloc.s V_2
ldc.i4 1
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_ea54539215374a919cb2c8b1ebc3ffdc
brfalse IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
pop <null>
ldc.i4 1
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_00F8: ldloc.s V_1
br IL_0173: leave IL_0028
ldc.i4 3
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_c573c5d3c00c45f5958e0e8da49316ff
brtrue IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
pop <null>
ldc.i4 5
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
ldloc.s V_1
call System.Type System.Linq.Enumerable::First<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldstr Pka4EBUtN
ldc.i4 256
ldnull <null>
ldnull <null>
ldnull <null>
callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[])
pop <null>
ldc.i4 2
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
br IL_0173: leave IL_0028
ldc.i4 4
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
ldloc.s V_1
call System.Int32 System.Linq.Enumerable::Count<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldc.i4.0 <null>
bgt IL_00C5: ldloc.s V_1
ldc.i4 3
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_872111cf2348483da0581ef501fa0169
brtrue IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
pop <null>
ldc.i4 3
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
ldloc.s V_2
callvirt System.Type[] OctoberPayment1.Execution.GenericCommand::FilterCommand()
ldsfld System.Func`2<System.Type,System.Boolean> OctoberPayment1.Specifications.AlphabeticSpec/<>c::_ProjectProvider
dup <null>
brtrue IL_014D: call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
pop <null>
ldsfld OctoberPayment1.Specifications.AlphabeticSpec/<>c OctoberPayment1.Specifications.AlphabeticSpec/<>c::_ExternalContext
ldftn System.Boolean OctoberPayment1.Specifications.AlphabeticSpec/<>c::OpenExternalLogger(System.Type)
newobj System.Void System.Func`2<System.Type,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Type,System.Boolean> OctoberPayment1.Specifications.AlphabeticSpec/<>c::_ProjectProvider
call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_f090d6c46c6a4c8e9cc008b9e6b6d39b
brtrue IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
pop <null>
ldc.i4 0
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
leave IL_0028: ret
ldloc.s V_2
brtrue IL_01CB: ldloc.s V_2
ldc.i4 2
stloc V_0
br IL_018D: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_01F1: endfinally
br IL_01F1: endfinally
ldc.i4 1
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_36e5c5d5339a4650a4af326f06241536
brtrue IL_0191: switch(IL_01F1,IL_01CB,IL_01A7)
pop <null>
ldc.i4 0
br IL_0191: switch(IL_01F1,IL_01CB,IL_01A7)
ldloc.s V_2
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_f669b77d9b0a4b51acd25f6921c81da8
brtrue IL_0191: switch(IL_01F1,IL_01CB,IL_01A7)
pop <null>
ldc.i4 0
br IL_0191: switch(IL_01F1,IL_01CB,IL_01A7)
endfinally <null>
ldc.i4 2
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_946a6b1ef5b24c4c8ab7f0d225afbd2d
brtrue IL_0012: switch(IL_004F,IL_0029,IL_0028)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_004F,IL_0029,IL_0028)
Module Name
October Payment1.exe
Full Name
October Payment1.exe
EntryPoint
System.Void OctoberPayment1.Specifications.AlphabeticSpec::JoinSpec()
Scope Name
October Payment1.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
October Payment1
Assembly Version
1.0.8128.9236
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
1210
Main Method
System.Void OctoberPayment1.Specifications.AlphabeticSpec::JoinSpec()
Main IL Instruction Count
117
Main IL 
ldc.i4 1
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_004F: nop
ret <null>
newobj System.Void OctoberPayment1.Execution.GenericCommand::.ctor()
stloc.s V_2
ldc.i4 0
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_71c2287911d34e0b8a62955434da8071
brfalse IL_0012: switch(IL_004F,IL_0029,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_004F,IL_0029,IL_0028)
nop <null>
ldloc.s V_2
callvirt System.String OctoberPayment1.Execution.GenericCommand::ExecuteConcreteCommand()
brtrue IL_0124: ldloc.s V_2
ldc.i4 1
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_ea54539215374a919cb2c8b1ebc3ffdc
brfalse IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
pop <null>
ldc.i4 1
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_00F8: ldloc.s V_1
br IL_0173: leave IL_0028
ldc.i4 3
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_c573c5d3c00c45f5958e0e8da49316ff
brtrue IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
pop <null>
ldc.i4 5
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
ldloc.s V_1
call System.Type System.Linq.Enumerable::First<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldstr Pka4EBUtN
ldc.i4 256
ldnull <null>
ldnull <null>
ldnull <null>
callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[])
pop <null>
ldc.i4 2
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
br IL_0173: leave IL_0028
ldc.i4 4
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
ldloc.s V_1
call System.Int32 System.Linq.Enumerable::Count<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldc.i4.0 <null>
bgt IL_00C5: ldloc.s V_1
ldc.i4 3
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_872111cf2348483da0581ef501fa0169
brtrue IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
pop <null>
ldc.i4 3
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
ldloc.s V_2
callvirt System.Type[] OctoberPayment1.Execution.GenericCommand::FilterCommand()
ldsfld System.Func`2<System.Type,System.Boolean> OctoberPayment1.Specifications.AlphabeticSpec/<>c::_ProjectProvider
dup <null>
brtrue IL_014D: call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
pop <null>
ldsfld OctoberPayment1.Specifications.AlphabeticSpec/<>c OctoberPayment1.Specifications.AlphabeticSpec/<>c::_ExternalContext
ldftn System.Boolean OctoberPayment1.Specifications.AlphabeticSpec/<>c::OpenExternalLogger(System.Type)
newobj System.Void System.Func`2<System.Type,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Type,System.Boolean> OctoberPayment1.Specifications.AlphabeticSpec/<>c::_ProjectProvider
call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
stloc.s V_1
ldc.i4 0
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_f090d6c46c6a4c8e9cc008b9e6b6d39b
brtrue IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
pop <null>
ldc.i4 0
br IL_007F: switch(IL_00F8,IL_00A1,IL_0173,IL_00E9,IL_00C5,IL_0124)
leave IL_0028: ret
ldloc.s V_2
brtrue IL_01CB: ldloc.s V_2
ldc.i4 2
stloc V_0
br IL_018D: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_01F1: endfinally
br IL_01F1: endfinally
ldc.i4 1
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_36e5c5d5339a4650a4af326f06241536
brtrue IL_0191: switch(IL_01F1,IL_01CB,IL_01A7)
pop <null>
ldc.i4 0
br IL_0191: switch(IL_01F1,IL_01CB,IL_01A7)
ldloc.s V_2
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_f669b77d9b0a4b51acd25f6921c81da8
brtrue IL_0191: switch(IL_01F1,IL_01CB,IL_01A7)
pop <null>
ldc.i4 0
br IL_0191: switch(IL_01F1,IL_01CB,IL_01A7)
endfinally <null>
ldc.i4 2
ldsfld <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111} <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_bda315b6f96947dda0f80ef3b28a8119
ldfld System.Int32 <Module>{417ce429-a6b0-48b5-a735-2114ab2ba111}::m_946a6b1ef5b24c4c8ab7f0d225afbd2d
brtrue IL_0012: switch(IL_004F,IL_0029,IL_0028)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_004F,IL_0029,IL_0028)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙