Suspicious
Suspect

PE Executable
MD5: 1614ca9b5d7dea54cc6655c4a577578b
Size: 972.8 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 1614ca9b5d7dea54cc6655c4a577578b
Sha1 b1c3fab561cfc05b88976b4227d267ad0f8dc16b
Sha256 b0ddeb6193714ee02ba7efdab8caeb6279984817348a230a1ffc7bb2f9fe1b0f
Sha384 8a045d99579e7cff3753fa72b9eb14b2ee657f19770242766fac78a1b4d685ae593f6b00b6a2c1f1db3852311d30c5f9
Sha512 dc0cba8cc8ee96de7e8fc56c0bd0203920904e428e38f884e9d1ea0a6e6711f05a261a5b0a03fefb89d6cda3ae14815683b66299d92b9c6eee09ff3344854405
SSDeep 24576:bJ/NZg5Jrmx+CaNiSzpYpHgU+VXhlJUX+oIzj9NPK5JBxW:/uDSgNJgIXhvUudJyE
TLSH 2A25335902E0B7F6C025F977ABA7FE5ACCA5F989581A3D6600C83077DE233299170CD6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1614ca9b5d7dea54cc6655c4a577578b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
liyrbziqfmld.Resources
noviibild.exe
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
RealtekAudioService.exe
Full Name
RealtekAudioService.exe
EntryPoint
System.Void Program::Main()
Scope Name
RealtekAudioService.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RealtekAudioService
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
10
Main Method
System.Void Program::Main()
Main IL Instruction Count
40
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brtrue.s IL_007A: ldnull
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0078: br.s IL_0081
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0022: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: br.s IL_0081
br.s IL_0081: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
Module Name
RealtekAudioService.exe
Full Name
RealtekAudioService.exe
EntryPoint
System.Void Program::Main()
Scope Name
RealtekAudioService.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RealtekAudioService
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
10
Main Method
System.Void Program::Main()
Main IL Instruction Count
40
Main IL 
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean Program::CreateMutex()
brtrue.s IL_001B: call System.Boolean Program::AdminCheck()
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
call System.Boolean Program::AdminCheck()
brtrue.s IL_007A: ldnull
nop <null>
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.0 <null>
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.0 <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.0 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
call System.Int32 System.Environment::get_ExitCode()
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0078: br.s IL_0081
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0022: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0078: br.s IL_0081
br.s IL_0081: ret
ldnull <null>
call System.Object Program::WorkF(System.Object)
pop <null>
ret <null>
1614ca9b5d7dea54cc6655c4a577578b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
liyrbziqfmld.Resources
noviibild.exe
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙