Malicious
Malicious

PE Executable
MD5: 14b9313395043e7add3fd065539a8056
Size: 644.61 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 14b9313395043e7add3fd065539a8056
Sha1 1adccaced647a717b1e64ccae9c3df63697622fc
Sha256 767974490348bf90c69d4c0d98ced96890b7262bcd9d7045b1cb78550b5cd423
Sha384 2fb43dec072dd5b3f65c0b449ac7d4b426c039ed488bfe44d22b630f2efec39145b4cfeca6ece35a3befb72b880e205b
Sha512 74f32071a626c0d1b2617bdd1eb37a222812b73cd32f0f83302b78bede0bb3e1ebe91c0dfe5bc56b026d7e06bf74309fde9c651c0fc3557935c7e8cd7fab4ebf
SSDeep 12288:i4LzTvkrAp4IcQF6pCI08JWoYr8muZx/InxCqgR:dLzjkrK4IL6pCIGrEqE7R
TLSH 10D48D6B76168E20D1885333D6CB890063F0A596BA7BE70F748813E615473BADE1B3D7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
14b9313395043e7add3fd065539a8056
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
JvqWIaie54MsBI66iE.FjTtN0BJjBxKOuI6Ck
fOngpAfesgGSqkPjpM.35PnUcXoalnpHwGXMR
bn2Ewuqy37G2NxUdH8.oyq8ULORAQp42SHsOG
Wkcwlkfg.g.resources
Xesmva.Properties.Resources.resources
Chrmcrs
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Wkcwlkfg.exe
Full Name
Wkcwlkfg.exe
EntryPoint
System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::gwIJAYLd9()
Scope Name
Wkcwlkfg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Wkcwlkfg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::gwIJAYLd9()
Main IL Instruction Count
113
Main IL 
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0009: ldloc V_3
br IL_002D: nop
nop <null>
nop <null>
ldsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/<>O::js0oTGaO3
dup <null>
brfalse IL_003F: pop
br IL_00F5: call System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::RFgPnkEXm(System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p>)
pop <null>
ldc.i4 2
br IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
br IL_0058: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 10
beq IL_008E: ldc.i4.0
ldloc V_0
ldc.i4 990
beq IL_0058: ldloc V_0
br IL_00B3: ldsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::YRNn3X5P8
ldc.i4.0 <null>
stsfld System.Int32 SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::TrBsy4hcF
ldc.i4 0
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_08b4a252b3594006b689eb863cdb482e
brtrue IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
pop <null>
ldc.i4 7
br IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
ldsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::YRNn3X5P8
ldnull <null>
ldc.i4.0 <null>
newobj System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p::.ctor(System.Int32)
callvirt System.Void System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p>::Invoke(System.Object,SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p)
ldc.i4 5
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_23dc8e1a563a4276a10fe68a78f6ef91
brtrue IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
pop <null>
ldc.i4 1
br IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
ldnull <null>
ldftn System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::ARP2sS9sR(System.Object,System.Object)
newobj System.Void System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/<>O::js0oTGaO3
call System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::RFgPnkEXm(System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p>)
ldc.i4 10
br IL_0054: stloc V_0
leave IL_01F8: ret
pop <null>
ldc.i4 0
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_820ad8466890482e85d1aecdf6c4cecc
brtrue IL_013B: switch(IL_0157)
pop <null>
ldc.i4 0
br IL_013B: switch(IL_0157)
br IL_0137: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0137: ldloc V_1
br IL_0157: leave IL_01F8
leave IL_01F8: ret
ldnull <null>
stsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::YRNn3X5P8
ldc.i4 3
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_c95c08cb586a4d5eb27c206bf12b56ec
brtrue IL_0193: switch(IL_01D8,IL_01B3)
pop <null>
ldc.i4 1
br IL_0193: switch(IL_01D8,IL_01B3)
br IL_018F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_018F: ldloc V_2
br IL_01B3: ldnull
ldnull <null>
stsfld System.Object SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::ID1x91vUk
ldc.i4 1
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_afc74bb430f44296be009358c56d4f22
brtrue IL_0193: switch(IL_01D8,IL_01B3)
pop <null>
ldc.i4 0
br IL_0193: switch(IL_01D8,IL_01B3)
endfinally <null>
ldc.i4 6
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_e85310c53cc54930a9d4e700f4bac2b1
brtrue IL_000D: switch(IL_01F8,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_01F8,IL_002D)
ret <null>
Module Name
Wkcwlkfg.exe
Full Name
Wkcwlkfg.exe
EntryPoint
System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::gwIJAYLd9()
Scope Name
Wkcwlkfg.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Wkcwlkfg
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::gwIJAYLd9()
Main IL Instruction Count
113
Main IL 
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0009: ldloc V_3
br IL_002D: nop
nop <null>
nop <null>
ldsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/<>O::js0oTGaO3
dup <null>
brfalse IL_003F: pop
br IL_00F5: call System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::RFgPnkEXm(System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p>)
pop <null>
ldc.i4 2
br IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
br IL_0058: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 10
beq IL_008E: ldc.i4.0
ldloc V_0
ldc.i4 990
beq IL_0058: ldloc V_0
br IL_00B3: ldsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::YRNn3X5P8
ldc.i4.0 <null>
stsfld System.Int32 SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::TrBsy4hcF
ldc.i4 0
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_08b4a252b3594006b689eb863cdb482e
brtrue IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
pop <null>
ldc.i4 7
br IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
ldsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::YRNn3X5P8
ldnull <null>
ldc.i4.0 <null>
newobj System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p::.ctor(System.Int32)
callvirt System.Void System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p>::Invoke(System.Object,SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p)
ldc.i4 5
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_23dc8e1a563a4276a10fe68a78f6ef91
brtrue IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
pop <null>
ldc.i4 1
br IL_005C: switch(IL_00B3,IL_0104,IL_00E3)
ldnull <null>
ldftn System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::ARP2sS9sR(System.Object,System.Object)
newobj System.Void System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/<>O::js0oTGaO3
call System.Void SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::RFgPnkEXm(System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p>)
ldc.i4 10
br IL_0054: stloc V_0
leave IL_01F8: ret
pop <null>
ldc.i4 0
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_820ad8466890482e85d1aecdf6c4cecc
brtrue IL_013B: switch(IL_0157)
pop <null>
ldc.i4 0
br IL_013B: switch(IL_0157)
br IL_0137: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_0137: ldloc V_1
br IL_0157: leave IL_01F8
leave IL_01F8: ret
ldnull <null>
stsfld System.EventHandler`1<SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1/v44KSTVO1qhw4w0i6p> SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::YRNn3X5P8
ldc.i4 3
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_c95c08cb586a4d5eb27c206bf12b56ec
brtrue IL_0193: switch(IL_01D8,IL_01B3)
pop <null>
ldc.i4 1
br IL_0193: switch(IL_01D8,IL_01B3)
br IL_018F: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_018F: ldloc V_2
br IL_01B3: ldnull
ldnull <null>
stsfld System.Object SBfeSaRACl0EYuS7CR.Fo1pyZgKEhqauxM5B1::ID1x91vUk
ldc.i4 1
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_afc74bb430f44296be009358c56d4f22
brtrue IL_0193: switch(IL_01D8,IL_01B3)
pop <null>
ldc.i4 0
br IL_0193: switch(IL_01D8,IL_01B3)
endfinally <null>
ldc.i4 6
ldsfld <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17} <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_701540a1a07d4943a0a9173d08fd33db
ldfld System.Int32 <Module>{63f6a74f-234c-4e40-874f-4fa610f52d17}::m_e85310c53cc54930a9d4e700f4bac2b1
brtrue IL_000D: switch(IL_01F8,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_01F8,IL_002D)
ret <null>
14b9313395043e7add3fd065539a8056
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
JvqWIaie54MsBI66iE.FjTtN0BJjBxKOuI6Ck
fOngpAfesgGSqkPjpM.35PnUcXoalnpHwGXMR
bn2Ewuqy37G2NxUdH8.oyq8ULORAQp42SHsOG
Wkcwlkfg.g.resources
Xesmva.Properties.Resources.resources
Chrmcrs
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙