Deep Malware Analysis of 17afe5f7aada2875c7f719faae2e1a2d | md5: 17afe5f7aada2875c7f719faae2e1a2d | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.85

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	17afe5f7aada2875c7f719faae2e1a2d
Sha1	de726a13d0692b1cdb60e640c5f70a58918ab2f2
Sha256	d38fa4b7893995e5fc7e6d45024ffe0202b92769a4955cec29dc3bdb35d3c8ba
Sha384	4cec83ecc42f4681b0b9bcde5a117c67d5219a18871df808fce39ee479e099c928fc6365beabdf224e32d251e5f09dc4
Sha512	ef4ed2f55bfb5023a17fca6b64fa77517a5d0422d72e20c5b9f7c1362cee1245094de6d9c1067c8c3cdf9a3358c6780cb5f7f7226159438a09163dcf84abcb7f
SSDeep	12288:KeeZoL367f+BPfPG/1RR4dd0f3o5KpT/bG3K6zJtYSYLNSE/Je:KvZoLKDePKFx45yT/bG3K6XYLNSE
TLSH	8D157CF13AD9122DE5BFBB384C71092C5BFBEC5BC621C65E2C43309A5C21F899915B86

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	2Aprs9
Full Name	2Aprs9
EntryPoint	System.Void 2Aprs9.2r_Fw::3Cjwt()
Scope Name	2Aprs9
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	2Aprs9
Assembly Version	21.22.15.63
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1600
Main Method	System.Void 2Aprs9.2r_Fw::3Cjwt()
Main IL Instruction Count	131
Main IL	nop <null> newobj System.Void System.Random::.ctor() stloc.0 <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.2 <null> nop <null> ldloc.0 <null> ldc.i4.s -10 ldc.i4.s 10 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) stloc.3 <null> ldloc.3 <null> ldc.i4.0 <null> cgt <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0050: nop ldstr System.AppDomain call System.Type System.Type::GetType(System.String) stloc.s V_5 ldloc.s V_5 ldstr CurrentDomain ldc.i4.s 24 callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String,System.Reflection.BindingFlags) stloc.s V_6 ldloc.s V_6 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.1 <null> br.s IL_006E: nop nop <null> ldstr System.Object call System.Type System.Type::GetType(System.String) stloc.s V_7 ldloc.s V_7 call System.Object System.Activator::CreateInstance(System.Type) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.1 <null> nop <null> nop <null> br.s IL_000D: nop nop <null> ldloc.1 <null> ldnull <null> ldstr Load ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> call System.Byte[] 2Aprs9.0DwzmdT2b5::tHw96fnNa7K() call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Reverse<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 brfalse.s IL_009B: ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6 ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 br.s IL_00B1: call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>) ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6 ldftn System.Byte 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::yKz1Xx(System.Byte,System.Int32) newobj System.Void System.Func`3<System.Byte,System.Int32,System.Byte>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldnull <null> ldstr GetTypes ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.s 24 box System.Int32 stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldnull <null> ldstr GetMethods ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) castclass System.Collections.IEnumerable callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator() stloc.s V_8 br.s IL_013B: ldloc.s V_8 ldloc.s V_8 callvirt System.Object System.Collections.IEnumerator::get_Current() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_9 nop <null> ldloc.s V_9 castclass System.Reflection.MethodInfo ldnull <null> ldc.i4.0 <null> newarr System.Object callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0139: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0139: nop nop <null> nop <null> ldloc.s V_8 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() stloc.s V_11 ldloc.s V_11 brtrue.s IL_0104: ldloc.s V_8 leave.s IL_0161: ret ldloc.s V_8 isinst System.IDisposable brfalse.s IL_0160: endfinally ldloc.s V_8 isinst System.IDisposable callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>
Module Name	2Aprs9
Full Name	2Aprs9
EntryPoint	System.Void 2Aprs9.2r_Fw::3Cjwt()
Scope Name	2Aprs9
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	2Aprs9
Assembly Version	21.22.15.63
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	1600
Main Method	System.Void 2Aprs9.2r_Fw::3Cjwt()
Main IL Instruction Count	131
Main IL	nop <null> newobj System.Void System.Random::.ctor() stloc.0 <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.2 <null> nop <null> ldloc.0 <null> ldc.i4.s -10 ldc.i4.s 10 callvirt System.Int32 System.Random::Next(System.Int32,System.Int32) stloc.3 <null> ldloc.3 <null> ldc.i4.0 <null> cgt <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0050: nop ldstr System.AppDomain call System.Type System.Type::GetType(System.String) stloc.s V_5 ldloc.s V_5 ldstr CurrentDomain ldc.i4.s 24 callvirt System.Reflection.PropertyInfo System.Type::GetProperty(System.String,System.Reflection.BindingFlags) stloc.s V_6 ldloc.s V_6 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.PropertyInfo::GetValue(System.Object,System.Object[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.1 <null> br.s IL_006E: nop nop <null> ldstr System.Object call System.Type System.Type::GetType(System.String) stloc.s V_7 ldloc.s V_7 call System.Object System.Activator::CreateInstance(System.Type) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.1 <null> nop <null> nop <null> br.s IL_000D: nop nop <null> ldloc.1 <null> ldnull <null> ldstr Load ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> call System.Byte[] 2Aprs9.0DwzmdT2b5::tHw96fnNa7K() call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Reverse<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 brfalse.s IL_009B: ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6 ldsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 br.s IL_00B1: call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>) ldsfld 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::De3crxJ6 ldftn System.Byte 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::yKz1Xx(System.Byte,System.Int32) newobj System.Void System.Func`3<System.Byte,System.Int32,System.Byte>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`3<System.Byte,System.Int32,System.Byte> 2Aprs9.2r_Fw/yg7P1Zmg.oEz79jFtfB6k::Gim8e3zPnxZ1 call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Select<System.Byte,System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>,System.Func`3<System.Byte,System.Int32,System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldnull <null> ldstr GetTypes ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.s 24 box System.Int32 stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldnull <null> ldstr GetMethods ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) castclass System.Collections.IEnumerable callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator() stloc.s V_8 br.s IL_013B: ldloc.s V_8 ldloc.s V_8 callvirt System.Object System.Collections.IEnumerator::get_Current() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_9 nop <null> ldloc.s V_9 castclass System.Reflection.MethodInfo ldnull <null> ldc.i4.0 <null> newarr System.Object callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0139: nop dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0139: nop nop <null> nop <null> ldloc.s V_8 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() stloc.s V_11 ldloc.s V_11 brtrue.s IL_0104: ldloc.s V_8 leave.s IL_0161: ret ldloc.s V_8 isinst System.IDisposable brfalse.s IL_0160: endfinally ldloc.s V_8 isinst System.IDisposable callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>