Suspicious
Suspect

17afe5f7aada2875c7f719faae2e1a2d

PE Executable
MD5: 17afe5f7aada2875c7f719faae2e1a2d
Size: 939.01 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 17afe5f7aada2875c7f719faae2e1a2d
Sha1 de726a13d0692b1cdb60e640c5f70a58918ab2f2
Sha256 d38fa4b7893995e5fc7e6d45024ffe0202b92769a4955cec29dc3bdb35d3c8ba
Sha384 4cec83ecc42f4681b0b9bcde5a117c67d5219a18871df808fce39ee479e099c928fc6365beabdf224e32d251e5f09dc4
Sha512 ef4ed2f55bfb5023a17fca6b64fa77517a5d0422d72e20c5b9f7c1362cee1245094de6d9c1067c8c3cdf9a3358c6780cb5f7f7226159438a09163dcf84abcb7f
SSDeep 12288:KeeZoL367f+BPfPG/1RR4dd0f3o5KpT/bG3K6zJtYSYLNSE/Je:KvZoLKDePKFx45yT/bG3K6XYLNSE
TLSH 8D157CF13AD9122DE5BFBB384C71092C5BFBEC5BC621C65E2C43309A5C21F899915B86
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
17afe5f7aada2875c7f719faae2e1a2d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
2Aprs9.Resources.resources
d0e5184099d727.Resources.resources
c7ee8fe40
[NBF]root.Data
c7ee8fe41
[NBF]root.Data
c7ee8fe410
[NBF]root.Data
c7ee8fe411
[NBF]root.Data
c7ee8fe412
[NBF]root.Data
c7ee8fe413
[NBF]root.Data
c7ee8fe414
[NBF]root.Data
c7ee8fe415
[NBF]root.Data
c7ee8fe416
[NBF]root.Data
c7ee8fe417
[NBF]root.Data
c7ee8fe418
[NBF]root.Data
c7ee8fe419
[NBF]root.Data
c7ee8fe42
[NBF]root.Data
c7ee8fe420
[NBF]root.Data
c7ee8fe421
[NBF]root.Data
c7ee8fe43
[NBF]root.Data
c7ee8fe44
[NBF]root.Data
c7ee8fe45
[NBF]root.Data
c7ee8fe46
[NBF]root.Data
c7ee8fe47
[NBF]root.Data
c7ee8fe48
[NBF]root.Data
c7ee8fe49
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
2Aprs9
Full Name
2Aprs9
EntryPoint
System.Void 2Aprs9.2r_Fw::3Cjwt()
Scope Name
2Aprs9
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
2Aprs9
Assembly Version
21.22.15.63
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1600
Main Method
System.Void 2Aprs9.2r_Fw::3Cjwt()
Main IL Instruction Count
131
Main IL 
nop <null>
newobj System.Void System.Random::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.2 <null>
nop <null>
ldloc.0 <null>
ldc.i4.s -10
ldc.i4.s 10
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0050: nop
ldstr System.AppDomain
call System.Type System.Type::GetType(System.String)
stloc.s V_5
ldloc.s V_5
ldstr CurrentDomain
ldc.i4.s 24
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String,System.Reflection.BindingFlags)
stloc.s V_6
ldloc.s V_6
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.1 <null>
br.s IL_006E: nop
nop <null>
ldstr System.Object
call System.Type System.Type::GetType(System.String)
stloc.s V_7
ldloc.s V_7
call System.Object System.Activator::CreateInstance(System.Type)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.1 <null>
nop <null>
nop <null>
br.s IL_000D: nop
nop <null>
ldloc.1 <null>
ldnull <null>
ldstr Load
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
call System.Byte[] 2Aprs9.0DwzmdT2b5::tHw96fnNa7K()
call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Reverse<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>)
call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>)
ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1
brfalse.s IL_009B: ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6
ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1
br.s IL_00B1: call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>)
ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6
ldftn System.Byte 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::yKz1Xx(System.Byte,System.Int32)
newobj System.Void System.Func`3<System.Byte,System.Int32,System.Byte>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1
call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>)
call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>)
stelem.ref <null>
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldnull <null>
ldstr GetTypes
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.s 24
box System.Int32
stelem.ref <null>
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldnull <null>
ldstr GetMethods
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.Collections.IEnumerable
callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator()
stloc.s V_8
br.s IL_013B: ldloc.s V_8
ldloc.s V_8
callvirt System.Object System.Collections.IEnumerator::get_Current()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_9
nop <null>
ldloc.s V_9
castclass System.Reflection.MethodInfo
ldnull <null>
ldc.i4.0 <null>
newarr System.Object
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0139: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0139: nop
nop <null>
nop <null>
ldloc.s V_8
callvirt System.Boolean System.Collections.IEnumerator::MoveNext()
stloc.s V_11
ldloc.s V_11
brtrue.s IL_0104: ldloc.s V_8
leave.s IL_0161: ret
ldloc.s V_8
isinst System.IDisposable
brfalse.s IL_0160: endfinally
ldloc.s V_8
isinst System.IDisposable
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
Module Name
2Aprs9
Full Name
2Aprs9
EntryPoint
System.Void 2Aprs9.2r_Fw::3Cjwt()
Scope Name
2Aprs9
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
2Aprs9
Assembly Version
21.22.15.63
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1600
Main Method
System.Void 2Aprs9.2r_Fw::3Cjwt()
Main IL Instruction Count
131
Main IL 
nop <null>
newobj System.Void System.Random::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.2 <null>
nop <null>
ldloc.0 <null>
ldc.i4.s -10
ldc.i4.s 10
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0050: nop
ldstr System.AppDomain
call System.Type System.Type::GetType(System.String)
stloc.s V_5
ldloc.s V_5
ldstr CurrentDomain
ldc.i4.s 24
callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String,System.Reflection.BindingFlags)
stloc.s V_6
ldloc.s V_6
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.1 <null>
br.s IL_006E: nop
nop <null>
ldstr System.Object
call System.Type System.Type::GetType(System.String)
stloc.s V_7
ldloc.s V_7
call System.Object System.Activator::CreateInstance(System.Type)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.1 <null>
nop <null>
nop <null>
br.s IL_000D: nop
nop <null>
ldloc.1 <null>
ldnull <null>
ldstr Load
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
call System.Byte[] 2Aprs9.0DwzmdT2b5::tHw96fnNa7K()
call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Reverse<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>)
call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>)
ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1
brfalse.s IL_009B: ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6
ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1
br.s IL_00B1: call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>)
ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6
ldftn System.Byte 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::yKz1Xx(System.Byte,System.Int32)
newobj System.Void System.Func`3<System.Byte,System.Int32,System.Byte>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1
call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>)
call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>)
stelem.ref <null>
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldnull <null>
ldstr GetTypes
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldc.i4.s 24
box System.Int32
stelem.ref <null>
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldnull <null>
ldstr GetMethods
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.Collections.IEnumerable
callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator()
stloc.s V_8
br.s IL_013B: ldloc.s V_8
ldloc.s V_8
callvirt System.Object System.Collections.IEnumerator::get_Current()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_9
nop <null>
ldloc.s V_9
castclass System.Reflection.MethodInfo
ldnull <null>
ldc.i4.0 <null>
newarr System.Object
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0139: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0139: nop
nop <null>
nop <null>
ldloc.s V_8
callvirt System.Boolean System.Collections.IEnumerator::MoveNext()
stloc.s V_11
ldloc.s V_11
brtrue.s IL_0104: ldloc.s V_8
leave.s IL_0161: ret
ldloc.s V_8
isinst System.IDisposable
brfalse.s IL_0160: endfinally
ldloc.s V_8
isinst System.IDisposable
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
ret <null>
17afe5f7aada2875c7f719faae2e1a2d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
2Aprs9.Resources.resources
d0e5184099d727.Resources.resources
c7ee8fe40
[NBF]root.Data
c7ee8fe41
[NBF]root.Data
c7ee8fe410
[NBF]root.Data
c7ee8fe411
[NBF]root.Data
c7ee8fe412
[NBF]root.Data
c7ee8fe413
[NBF]root.Data
c7ee8fe414
[NBF]root.Data
c7ee8fe415
[NBF]root.Data
c7ee8fe416
[NBF]root.Data
c7ee8fe417
[NBF]root.Data
c7ee8fe418
[NBF]root.Data
c7ee8fe419
[NBF]root.Data
c7ee8fe42
[NBF]root.Data
c7ee8fe420
[NBF]root.Data
c7ee8fe421
[NBF]root.Data
c7ee8fe43
[NBF]root.Data
c7ee8fe44
[NBF]root.Data
c7ee8fe45
[NBF]root.Data
c7ee8fe46
[NBF]root.Data
c7ee8fe47
[NBF]root.Data
c7ee8fe48
[NBF]root.Data
c7ee8fe49
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙