Suspicious
Suspect

PE Executable
MD5: 16802eeb2eff09b84fc7c6c491105f85
Size: 695.81 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 16802eeb2eff09b84fc7c6c491105f85
Sha1 4c7de2517bf37b7d88c08326813beba0f48d65dd
Sha256 73641a6dd5f95201524760fb4b5e951dba1fa239bce351d6e765021ab08de01f
Sha384 cb6f659cdbce67c9bfcdae8d5d1fcfa5fba5264062c0acdd6a9ffa6631f0d4ac812813fd0412bfdca67b22aec17f071b
Sha512 a4e35501e222285e341cb2e51475839fb47b6ff4e8e97aa4c19b81a55d15051b26daa61716fd3a0ef097a2549c639ef03f2d44933f3c0754a155ee29fe02ae90
SSDeep 12288:ItrXdFIjNF1rfQ9vpF2cCCDPsvGMgNwz+0fSBvLU:nF1rI9hNCAPsv6+ivo
TLSH F8E4BE002BAF4F58E5FAA7386D3852114BF0FC0EC736D68E6DD449DE2962BA08B51753
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
16802eeb2eff09b84fc7c6c491105f85
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Elaruneorlith.PolicyData.json
Rr1cm9WaEbi.g.resources
Rr1cm9WaEbi.Resources.resources
babyfondolaga
[NBF]root.IconData
c7f490f531d158.Resources.resources
05326dd10
[NBF]root.Data
05326dd11
[NBF]root.Data
05326dd12
[NBF]root.Data
05326dd13
[NBF]root.Data
05326dd14
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Rr1cm9WaEbi
Full Name
Rr1cm9WaEbi
EntryPoint
System.Void Rr1cm9WaEbi.3skPmS1xH2/Rrr4s5iH6Dexf0.0SwwAm3y::pe9Ag2FasCt56()
Scope Name
Rr1cm9WaEbi
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rr1cm9WaEbi
Assembly Version
3.29.19.88
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1138
Main Method
System.Void Rr1cm9WaEbi.3skPmS1xH2/Rrr4s5iH6Dexf0.0SwwAm3y::pe9Ag2FasCt56()
Main IL Instruction Count
107
Main IL 
nop <null>
nop <null>
ldstr System Configuration Manager
stloc.0 <null>
ldstr 1.2.0
stloc.1 <null>
call System.String System.Environment::get_UserName()
callvirt System.String System.String::ToLower()
ldstr admin
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_0033: ldc.i4.1
call System.String System.Environment::get_MachineName()
callvirt System.Int32 System.String::get_Length()
ldc.i4.3 <null>
cgt <null>
br.s IL_0034: stloc.3
ldc.i4.1 <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_003B: nop
nop <null>
br.s IL_0044: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_007E: nop
nop <null>
leave.s IL_007C: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_007C: nop
nop <null>
nop <null>
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr SysConfig
ldstr policy.dat
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
call System.Boolean System.IO.File::Exists(System.String)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00A3: nop
nop <null>
nop <null>
call System.Boolean Rr1cm9WaEbi.3skPmS1xH2/Rrr4s5iH6Dexf0.0SwwAm3y::0Xxdz5gA6()
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_00BA: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
ldc.i4.s 60
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
call System.Void Rr1cm9WaEbi.3skPmS1xH2::go4Am9Bt7n()
nop <null>
leave.s IL_00F2: leave.s IL_010D
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
ldstr Application failed to start: 
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void Rr1cm9WaEbi.3skPmS1xH2::Fd7m2ek(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00F2: leave.s IL_010D
leave.s IL_010D: nop
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
leave.s IL_010B: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_010B: nop
nop <null>
endfinally <null>
nop <null>
ret <null>
Module Name
Rr1cm9WaEbi
Full Name
Rr1cm9WaEbi
EntryPoint
System.Void Rr1cm9WaEbi.3skPmS1xH2/Rrr4s5iH6Dexf0.0SwwAm3y::pe9Ag2FasCt56()
Scope Name
Rr1cm9WaEbi
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Rr1cm9WaEbi
Assembly Version
3.29.19.88
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1138
Main Method
System.Void Rr1cm9WaEbi.3skPmS1xH2/Rrr4s5iH6Dexf0.0SwwAm3y::pe9Ag2FasCt56()
Main IL Instruction Count
107
Main IL 
nop <null>
nop <null>
ldstr System Configuration Manager
stloc.0 <null>
ldstr 1.2.0
stloc.1 <null>
call System.String System.Environment::get_UserName()
callvirt System.String System.String::ToLower()
ldstr admin
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_0033: ldc.i4.1
call System.String System.Environment::get_MachineName()
callvirt System.Int32 System.String::get_Length()
ldc.i4.3 <null>
cgt <null>
br.s IL_0034: stloc.3
ldc.i4.1 <null>
stloc.3 <null>
ldloc.3 <null>
brfalse.s IL_003B: nop
nop <null>
br.s IL_0044: call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.Int32 System.Version::get_Major()
ldc.i4.6 <null>
clt <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_007E: nop
nop <null>
leave.s IL_007C: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_007C: nop
nop <null>
nop <null>
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr SysConfig
ldstr policy.dat
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldloc.2 <null>
call System.Boolean System.IO.File::Exists(System.String)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00A3: nop
nop <null>
nop <null>
call System.Boolean Rr1cm9WaEbi.3skPmS1xH2/Rrr4s5iH6Dexf0.0SwwAm3y::0Xxdz5gA6()
ldc.i4.0 <null>
ceq <null>
stloc.s V_6
ldloc.s V_6
brfalse.s IL_00BA: nop
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
nop <null>
nop <null>
ldc.i4.s 60
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
call System.Void Rr1cm9WaEbi.3skPmS1xH2::go4Am9Bt7n()
nop <null>
leave.s IL_00F2: leave.s IL_010D
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
ldstr Application failed to start: 
ldloc.s V_7
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void Rr1cm9WaEbi.3skPmS1xH2::Fd7m2ek(System.String)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00F2: leave.s IL_010D
leave.s IL_010D: nop
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::Exit()
nop <null>
leave.s IL_010B: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_010B: nop
nop <null>
endfinally <null>
nop <null>
ret <null>
16802eeb2eff09b84fc7c6c491105f85
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Elaruneorlith.PolicyData.json
Rr1cm9WaEbi.g.resources
Rr1cm9WaEbi.Resources.resources
babyfondolaga
[NBF]root.IconData
c7f490f531d158.Resources.resources
05326dd10
[NBF]root.Data
05326dd11
[NBF]root.Data
05326dd12
[NBF]root.Data
05326dd13
[NBF]root.Data
05326dd14
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙