Malicious PE Executable analysis – 1bfd2f3590fb

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

HQR data fileMicrosoft Visual C++ DLLMicrosoft Visual C++ v6.0Microsoft Visual C++ v6.0 DLLMicrosoft WAV Audio file

Symbol obfuscation

Very high

1 malicious · 29 files

EXE1bfd2f3590fb00301952cc3162c72370

Structure

BINResources

BIN.Net Resources

Name	Value
Info	PDB Path: Microsoft OneDrive.pdb
Module Name	Microsoft OneDrive.exe
Full Name	Microsoft OneDrive.exe
EntryPoint	System.Void seKA2ytaEYMmFylyos.JAT9ksnYhlqONqBY6S::mPB5qONIc(System.String[])
Scope Name	Microsoft OneDrive.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Microsoft OneDrive
Assembly Version	53.22.54.12
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	48
Main Method	System.Void seKA2ytaEYMmFylyos.JAT9ksnYhlqONqBY6S::mPB5qONIc(System.String[])
Main IL Instruction Count	90
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_0 br IL_0015: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_005E: nop ldc.i4 5000 ldsfld R8vqaS9A1kPlVi8V0qKV R8vqaS9A1kPlVi8V0qKV::mfP9AdKVWan call System.Void R8vqaS9A1kPlVi8V0qKV::A1K9WWnRVDE(System.Int32,R8vqaS9A1kPlVi8V0qKV) ldc.i4 0 ldsfld <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe} <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_a953983585bf48719b05a7a01556e86b ldfld System.Int32 <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_edf76f92ac7c43e1a97e50fb658370ab brfalse IL_0019: switch(IL_005E,IL_002F,IL_005D) pop <null> ldc.i4 0 br IL_0019: switch(IL_005E,IL_002F,IL_005D) ret <null> nop <null> ldsfld omT8709AQ9J3F9lAjuE8 omT8709AQ9J3F9lAjuE8::s3I9APVlmgb call System.Void omT8709AQ9J3F9lAjuE8::A1K9WWnRVDE(omT8709AQ9J3F9lAjuE8) ldc.i4 2 ldsfld <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe} <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_a953983585bf48719b05a7a01556e86b ldfld System.Int32 <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_515a7bcbd7d544e7b04ad49b9f9e3ace brtrue IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) pop <null> ldc.i4 1 br IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br IL_00EA: ldloc.s V_3 br IL_015A: leave IL_005D ldc.i4 0 ldsfld <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe} <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_a953983585bf48719b05a7a01556e86b ldfld System.Int32 <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_426c309bd88b481698c50290ce3e209c brtrue IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) pop <null> ldc.i4 0 br IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) ldsfld q9QWEX9ANXPVD8B0PZoc q9QWEX9ANXPVD8B0PZoc::nJV9A93VUbs call System.Void q9QWEX9ANXPVD8B0PZoc::A1K9WWnRVDE(q9QWEX9ANXPVD8B0PZoc) ldc.i4 6 br IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) ldloc.s V_3 ldsfld umRWoS9AYvLE6IOdNnux umRWoS9AYvLE6IOdNnux::VUl9AKQvwG0 call System.Object umRWoS9AYvLE6IOdNnux::A1K9WWnRVDE(System.Byte[],umRWoS9AYvLE6IOdNnux) pop <null> ldc.i4 1 ldsfld <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe} <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_a953983585bf48719b05a7a01556e86b ldfld System.Int32 <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_14b07d47cb1642b7850300ea67e8c989 brtrue IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) pop <null> ldc.i4 0 br IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) ldloc.s V_3 brtrue IL_00EA: ldloc.s V_3 ldc.i4 5 br IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) ldc.i4 1000 ldsfld R8vqaS9A1kPlVi8V0qKV R8vqaS9A1kPlVi8V0qKV::mfP9AdKVWan call System.Void R8vqaS9A1kPlVi8V0qKV::A1K9WWnRVDE(System.Int32,R8vqaS9A1kPlVi8V0qKV) ldc.i4 3 br IL_008C: switch(IL_00EA,IL_015A,IL_0127,IL_00D6,IL_0116,IL_00B2,IL_0140) ldsfld bqkLTq9AZbNdLtLMlqcs bqkLTq9AZbNdLtLMlqcs::jhj9AkDYsUo call System.Byte[] bqkLTq9AZbNdLtLMlqcs::A1K9WWnRVDE(bqkLTq9AZbNdLtLMlqcs) stloc.s V_3 ldc.i4 4 stloc V_1 br IL_0088: ldloc V_1 leave IL_005D: ret pop <null> ldc.i4 0 ldsfld <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe} <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_a953983585bf48719b05a7a01556e86b ldfld System.Int32 <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_adc6c867fa904f76888296fd6877c891 brtrue IL_0183: switch(IL_0191) pop <null> ldc.i4 0 br IL_0183: switch(IL_0191) ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] br IL_0191: leave IL_005D leave IL_005D: ret ldc.i4 1 ldsfld <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe} <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_a953983585bf48719b05a7a01556e86b ldfld System.Int32 <Module>{8f7bf35e-738f-4239-b831-954b1edf1dfe}::m_d5dae22da44b4da6a51bce835f0cc4c3 brfalse IL_0019: switch(IL_005E,IL_002F,IL_005D) pop <null> ldc.i4 2 br IL_0019: switch(IL_005E,IL_002F,IL_005D)