Malicious
Malicious

178bcf620d15dc67aefa6f2952d35703

PE Executable
MD5: 178bcf620d15dc67aefa6f2952d35703
Size: 352.77 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
352.77 KB · 352,768 B
First seen
2026-07-09 06:32 · 3 months ago
Last seen
2026-07-09 06:32 · 3 months ago
Last analysis
2026-07-09 06:33 · 3 months ago
Hashes
MD5 178bcf620d15dc67aefa6f2952d35703 Sha1 fde0b3e263b781966265389f658ffee510e50837 Sha256 a3551ee95176fa92f07ee54a5f66d1f547765fc79e1fb9e98b75dad86b71a10e Sha384 bc7b88fff454c1c084108fcc2c6f3ad45bf3a428112aacd0d312e7b1010d62d7e53e88112dcc5b174316371beb353a71 Sha512 f5d47511f072d5fc5dd04a9306e041c5318e5f8a20ec338b32c5f88c58e57fd8fdee2fd466cacae4cdc007c3399da11009553d6b47cd89a3c5def2b6ac1186e9 SSDeep 6144:uXm40uOeBRu3QIUywZGbLVjCtndFuZTGHnG5YBpongBxQaTj4sMz18gRSHczx/rE:uXm40uOeBRu3QIUywZGbLVjCtndFuZT0 TLSH A774181B36568E21D2841233D2EB550187F165477A37E70EBA8123DB29033BBEE4B797
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE178bcf620d15dc67aefa6f2952d35703
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINWuQVSPJAEFf9q91U9F.lAA9IfwMA8n6Q1n9rm
BINZI4XJoqoTPv7KNu1E8.v1i9LsUeFyxxGMgoVS
BINfLuo8i0T1ZGaMgyhWv.nCM5rjsJt40DWDP3JB
BINjxsVjqH9WyRwrSYC4m.4NbuRcyIbU6e3EsH9K
Name Value
Module Name
Cclieueusrx.exe
Full Name
Cclieueusrx.exe
EntryPoint
System.Void aDgQgNpmngujXEGqRf.b2NG9b8rZDTj4jJU61::wrtO4Wxd3()
Scope Name
Cclieueusrx.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cclieueusrx
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void aDgQgNpmngujXEGqRf.b2NG9b8rZDTj4jJU61::wrtO4Wxd3()
Main IL Instruction Count
63
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0009: ldloc V_1
br IL_0031: ret
ret <null>
call System.Void S0mfY5yW6kQTLsuD7N9.XUQKOKyt9eXoJ3OvPhe::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 0
ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d
ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_394441267d824d4baf661a32b38007e6
brfalse IL_000D: switch(IL_0056,IL_0032,IL_0031)
pop <null>
ldc.i4 3
br IL_000D: switch(IL_0056,IL_0032,IL_0031)
nop <null>
newobj System.Void lWXxDA2WNEukAifU6O.gudTYruGZyqN5jARF3::.ctor()
call System.Byte[] Bqgkoimai.Properties.Voufhjut::get_Ivikdhbt()
callvirt System.Void lWXxDA2WNEukAifU6O.gudTYruGZyqN5jARF3::EQQv5lFxd(System.Byte[])
ldc.i4 0
ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d
ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d069f6b879ab43a2add8d2dd371a7759
brtrue IL_0097: switch(IL_00B3)
pop <null>
ldc.i4 1
br IL_0097: switch(IL_00B3)
br IL_0093: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0093: ldloc V_2
br IL_00B3: leave IL_0031
leave IL_0031: ret
pop <null>
ldc.i4 6
ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d
ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_53505539460341aaa6374800775b1824
brfalse IL_00EA: switch(IL_0106)
pop <null>
ldc.i4 0
br IL_00EA: switch(IL_0106)
br IL_00E6: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_00E6: ldloc V_0
br IL_0106: leave IL_0031
leave IL_0031: ret
ldc.i4 2
ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d
ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_efa1d0aee7a444f1957eac519b59f70d
brtrue IL_000D: switch(IL_0056,IL_0032,IL_0031)
pop <null>
ldc.i4 2
br IL_000D: switch(IL_0056,IL_0032,IL_0031)
Module Name
Cclieueusrx.exe
Full Name
Cclieueusrx.exe
EntryPoint
System.Void aDgQgNpmngujXEGqRf.b2NG9b8rZDTj4jJU61::wrtO4Wxd3()
Scope Name
Cclieueusrx.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cclieueusrx
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void aDgQgNpmngujXEGqRf.b2NG9b8rZDTj4jJU61::wrtO4Wxd3()
Main IL Instruction Count
63
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0009: ldloc V_1
br IL_0031: ret
ret <null>
call System.Void S0mfY5yW6kQTLsuD7N9.XUQKOKyt9eXoJ3OvPhe::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 0
ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d
ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_394441267d824d4baf661a32b38007e6
brfalse IL_000D: switch(IL_0056,IL_0032,IL_0031)
pop <null>
ldc.i4 3
br IL_000D: switch(IL_0056,IL_0032,IL_0031)
nop <null>
newobj System.Void lWXxDA2WNEukAifU6O.gudTYruGZyqN5jARF3::.ctor()
call System.Byte[] Bqgkoimai.Properties.Voufhjut::get_Ivikdhbt()
callvirt System.Void lWXxDA2WNEukAifU6O.gudTYruGZyqN5jARF3::EQQv5lFxd(System.Byte[])
ldc.i4 0
ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d
ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d069f6b879ab43a2add8d2dd371a7759
brtrue IL_0097: switch(IL_00B3)
pop <null>
ldc.i4 1
br IL_0097: switch(IL_00B3)
br IL_0093: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0093: ldloc V_2
br IL_00B3: leave IL_0031
leave IL_0031: ret
pop <null>
ldc.i4 6
ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d
ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_53505539460341aaa6374800775b1824
brfalse IL_00EA: switch(IL_0106)
pop <null>
ldc.i4 0
br IL_00EA: switch(IL_0106)
br IL_00E6: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_00E6: ldloc V_0
br IL_0106: leave IL_0031
leave IL_0031: ret
ldc.i4 2
ldsfld <Module>{9492550f-7304-4ffa-ac98-9463c80385dd} <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_d1960e4edd284f45af27a212721e263d
ldfld System.Int32 <Module>{9492550f-7304-4ffa-ac98-9463c80385dd}::m_efa1d0aee7a444f1957eac519b59f70d
brtrue IL_000D: switch(IL_0056,IL_0032,IL_0031)
pop <null>
ldc.i4 2
br IL_000D: switch(IL_0056,IL_0032,IL_0031)
1 malicious · 7 files
EXE178bcf620d15dc67aefa6f2952d35703
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙