Suspicious
Suspect

1625a91b94d740a69115e7427dada77f

PE Executable
MD5: 1625a91b94d740a69115e7427dada77f
Size: 1.11 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 1625a91b94d740a69115e7427dada77f
Sha1 803389a2df6e5b1e9c398f2b4c47a69c18563eeb
Sha256 d309fcbf1525b4e3c3cdc730ed52d6ce5abd554ac490204967e304e4d57ed27f
Sha384 25758e33f8f5ebedda08d6fb17c5851ad5434e7c87ed60470664184d90fa16c83df04ce8e555d1c9a2b298c80464eaa6
Sha512 589b1f019c42799f8c045832d085bc2d37f0515b3d5debdc58bd30b13186ba0d536a276d406aca4aca333229367396bfabaee2db2c9c6ff179ad7f0bd2588f10
SSDeep 12288:vA9KpXv1HL/A2Fm5LiV+P8JTvP7TJBp+xzOpVup2y5vep6zVsgkdNIaSN+ucvPK7:vNg0IaV6nVpLhEilwyYj
TLSH B5356A2878BB90595477FF913DECB9EADDDE2A636509642B1085030B8E12F80EF4793D
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
1625a91b94d740a69115e7427dada77f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
microsoft
Full Name
microsoft
EntryPoint
System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::DQk2ijqfkc6FQI7zXU3S()
Scope Name
microsoft
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VioletClientPlain
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
368
Main Method
System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::DQk2ijqfkc6FQI7zXU3S()
Main IL Instruction Count
109
Main IL 
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean WXRMLLJjSQWOIGhJXc.QAHWTGbSNnS::FshhfS4ow2wqo7bMqg1M()
brtrue IL_001A: ldsfld System.Boolean WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::WTs0Dmkk02czZQPhYVzc
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::WTs0Dmkk02czZQPhYVzc
brfalse IL_0146: ldnull
ldsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::b7wUwdqjCTMJRiDtMQBt
call System.Net.WebRequest System.Net.WebRequest::Create(System.String)
castclass System.Net.HttpWebRequest
stloc.1 <null>
ldloc.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr R0VU
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Void System.Net.HttpWebRequest::set_Method(System.String)
ldloc.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr TW96aWxsYS81LjA=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Void System.Net.HttpWebRequest::set_UserAgent(System.String)
ldloc.1 <null>
callvirt System.Net.WebResponse System.Net.HttpWebRequest::GetResponse()
castclass System.Net.HttpWebResponse
stloc.2 <null>
ldloc.2 <null>
callvirt System.IO.Stream System.Net.HttpWebResponse::GetResponseStream()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream)
stloc.3 <null>
ldloc.3 <null>
callvirt System.String System.IO.StreamReader::ReadLine()
stloc.s V_4
br IL_0104: ldloc.s V_4
ldloc.s V_4
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue IL_00FC: ldloc.3
ldloc.s V_4
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr Og==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Boolean System.String::Contains(System.String)
brfalse IL_00FC: ldloc.3
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
stloc.s V_7
ldloc.s V_7
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_7
ldc.i4.2 <null>
callvirt System.String[] System.String::Split(System.Char[],System.Int32)
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.ovf.i4 <null>
ldc.i4.2 <null>
bne.un IL_00FC: ldloc.3
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::jS6jTEcoN7eeAXFiMEfe
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::y7FNJ0ZVJHZUKcirUahR
ldloc.3 <null>
callvirt System.String System.IO.StreamReader::ReadLine()
stloc.s V_4
ldloc.s V_4
brtrue IL_008F: ldloc.s V_4
leave IL_011D: leave IL_012F
ldloc.3 <null>
brfalse IL_011C: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_012F: leave IL_0146
ldloc.2 <null>
brfalse IL_012E: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0146: ldnull
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0146: ldnull
ldnull <null>
ldftn System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::RSAneFYkdD74VRuqbyqp()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
microsoft
Full Name
microsoft
EntryPoint
System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::DQk2ijqfkc6FQI7zXU3S()
Scope Name
microsoft
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VioletClientPlain
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
368
Main Method
System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::DQk2ijqfkc6FQI7zXU3S()
Main IL Instruction Count
109
Main IL 
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean WXRMLLJjSQWOIGhJXc.QAHWTGbSNnS::FshhfS4ow2wqo7bMqg1M()
brtrue IL_001A: ldsfld System.Boolean WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::WTs0Dmkk02czZQPhYVzc
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::WTs0Dmkk02czZQPhYVzc
brfalse IL_0146: ldnull
ldsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::b7wUwdqjCTMJRiDtMQBt
call System.Net.WebRequest System.Net.WebRequest::Create(System.String)
castclass System.Net.HttpWebRequest
stloc.1 <null>
ldloc.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr R0VU
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Void System.Net.HttpWebRequest::set_Method(System.String)
ldloc.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr TW96aWxsYS81LjA=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Void System.Net.HttpWebRequest::set_UserAgent(System.String)
ldloc.1 <null>
callvirt System.Net.WebResponse System.Net.HttpWebRequest::GetResponse()
castclass System.Net.HttpWebResponse
stloc.2 <null>
ldloc.2 <null>
callvirt System.IO.Stream System.Net.HttpWebResponse::GetResponseStream()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream)
stloc.3 <null>
ldloc.3 <null>
callvirt System.String System.IO.StreamReader::ReadLine()
stloc.s V_4
br IL_0104: ldloc.s V_4
ldloc.s V_4
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue IL_00FC: ldloc.3
ldloc.s V_4
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr Og==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Boolean System.String::Contains(System.String)
brfalse IL_00FC: ldloc.3
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
stloc.s V_7
ldloc.s V_7
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_7
ldc.i4.2 <null>
callvirt System.String[] System.String::Split(System.Char[],System.Int32)
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.ovf.i4 <null>
ldc.i4.2 <null>
bne.un IL_00FC: ldloc.3
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::jS6jTEcoN7eeAXFiMEfe
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::y7FNJ0ZVJHZUKcirUahR
ldloc.3 <null>
callvirt System.String System.IO.StreamReader::ReadLine()
stloc.s V_4
ldloc.s V_4
brtrue IL_008F: ldloc.s V_4
leave IL_011D: leave IL_012F
ldloc.3 <null>
brfalse IL_011C: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_012F: leave IL_0146
ldloc.2 <null>
brfalse IL_012E: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0146: ldnull
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0146: ldnull
ldnull <null>
ldftn System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::RSAneFYkdD74VRuqbyqp()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Embedded Resources UNKNWOWN
0huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1625a91b94d740a69115e7427dada77f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
No malware configuration was found at this point.
Embedded Resources UNKNWOWN
0huhuhuhu
1625a91b94d740a69115e7427dada77f
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
1625a91b94d740a69115e7427dada77f
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙