Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
Symbol obfuscation
Low
1 malicious · 5 files
EXE1c05acd51e1c756305e4118484b6cc8b
Structure
Name Value
Module Name
Ezmatueqd.exe
Full Name
Ezmatueqd.exe
EntryPoint
System.Void Ezmatueqd.Parsing.EditableTokenizer::SplitVirtualTokenizer()
Scope Name
Ezmatueqd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ezmatueqd
Assembly Version
1.0.1446.26250
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1210
Main Method
System.Void Ezmatueqd.Parsing.EditableTokenizer::SplitVirtualTokenizer()
Main IL Instruction Count
99
Main IL 
ldc.i4 2
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_01B2: ret
newobj System.Void BitMiracle.API.Requester.SpecExecutor::.ctor()
stloc.s V_0
ldc.i4 1
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_6e059cfe493c4adeac196de409aeb483
brtrue IL_0012: switch(IL_01B2,IL_004E,IL_0028)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_01B2,IL_004E,IL_0028)
nop <null>
ldloc.s V_0
callvirt System.String BitMiracle.API.Requester.SpecExecutor::CheckOperationalController()
brfalse IL_012B: leave IL_01B2
ldc.i4 2
br IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_00AF: ldloc.s V_1
ldloc.s V_1
call System.Int32 System.Linq.Enumerable::Count<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldc.i4.0 <null>
ble IL_012B: leave IL_01B2
ldc.i4 0
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_39940b6e7d234fb2b8caca36354548e0
brfalse IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
pop <null>
ldc.i4 0
br IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
ldloc.s V_1
call System.Type System.Linq.Enumerable::First<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldstr umMgMQ57m
ldc.i4 256
ldnull <null>
ldnull <null>
ldnull <null>
callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[])
pop <null>
ldc.i4 1
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_7f4adf2fc8d24d6c93f6885b5003a0ef
brfalse IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
pop <null>
ldc.i4 1
br IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
ldloc.s V_0
callvirt System.Type[] BitMiracle.API.Requester.SpecExecutor::RequestPortableRequester()
ldsfld System.Func`2<System.Type,System.Boolean> Ezmatueqd.Parsing.EditableTokenizer/<>c::engineCalculator
dup <null>
brfalse IL_00FF: pop
br IL_0116: call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
pop <null>
ldsfld Ezmatueqd.Parsing.EditableTokenizer/<>c Ezmatueqd.Parsing.EditableTokenizer/<>c::m_StaticWorker
ldftn System.Boolean Ezmatueqd.Parsing.EditableTokenizer/<>c::RunSortedContext(System.Type)
newobj System.Void System.Func`2<System.Type,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Type,System.Boolean> Ezmatueqd.Parsing.EditableTokenizer/<>c::engineCalculator
call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
stloc.s V_1
ldc.i4 3
stloc V_4
br IL_0065: ldloc V_4
leave IL_01B2: ret
ldloc.s V_0
brfalse IL_0192: endfinally
ldc.i4 1
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_5542f5b129d04da48c54a377e63170d3
brtrue IL_015A: switch(IL_0192,IL_016C)
pop <null>
ldc.i4 1
br IL_015A: switch(IL_0192,IL_016C)
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_0192: endfinally
ldloc.s V_0
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_2391d8b59b634582be63d34dac828009
brfalse IL_015A: switch(IL_0192,IL_016C)
pop <null>
ldc.i4 0
br IL_015A: switch(IL_0192,IL_016C)
endfinally <null>
ldc.i4 0
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_e8d9d228a7f8486890fe2354def83b74
brtrue IL_0012: switch(IL_01B2,IL_004E,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01B2,IL_004E,IL_0028)
ret <null>
Module Name
Ezmatueqd.exe
Full Name
Ezmatueqd.exe
EntryPoint
System.Void Ezmatueqd.Parsing.EditableTokenizer::SplitVirtualTokenizer()
Scope Name
Ezmatueqd.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ezmatueqd
Assembly Version
1.0.1446.26250
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1210
Main Method
System.Void Ezmatueqd.Parsing.EditableTokenizer::SplitVirtualTokenizer()
Main IL Instruction Count
99
Main IL 
ldc.i4 2
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_01B2: ret
newobj System.Void BitMiracle.API.Requester.SpecExecutor::.ctor()
stloc.s V_0
ldc.i4 1
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_6e059cfe493c4adeac196de409aeb483
brtrue IL_0012: switch(IL_01B2,IL_004E,IL_0028)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_01B2,IL_004E,IL_0028)
nop <null>
ldloc.s V_0
callvirt System.String BitMiracle.API.Requester.SpecExecutor::CheckOperationalController()
brfalse IL_012B: leave IL_01B2
ldc.i4 2
br IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_00AF: ldloc.s V_1
ldloc.s V_1
call System.Int32 System.Linq.Enumerable::Count<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldc.i4.0 <null>
ble IL_012B: leave IL_01B2
ldc.i4 0
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_39940b6e7d234fb2b8caca36354548e0
brfalse IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
pop <null>
ldc.i4 0
br IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
ldloc.s V_1
call System.Type System.Linq.Enumerable::First<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldstr umMgMQ57m
ldc.i4 256
ldnull <null>
ldnull <null>
ldnull <null>
callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[])
pop <null>
ldc.i4 1
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_7f4adf2fc8d24d6c93f6885b5003a0ef
brfalse IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
pop <null>
ldc.i4 1
br IL_0069: switch(IL_00AF,IL_012B,IL_00E8,IL_0083)
ldloc.s V_0
callvirt System.Type[] BitMiracle.API.Requester.SpecExecutor::RequestPortableRequester()
ldsfld System.Func`2<System.Type,System.Boolean> Ezmatueqd.Parsing.EditableTokenizer/<>c::engineCalculator
dup <null>
brfalse IL_00FF: pop
br IL_0116: call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
pop <null>
ldsfld Ezmatueqd.Parsing.EditableTokenizer/<>c Ezmatueqd.Parsing.EditableTokenizer/<>c::m_StaticWorker
ldftn System.Boolean Ezmatueqd.Parsing.EditableTokenizer/<>c::RunSortedContext(System.Type)
newobj System.Void System.Func`2<System.Type,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Type,System.Boolean> Ezmatueqd.Parsing.EditableTokenizer/<>c::engineCalculator
call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
stloc.s V_1
ldc.i4 3
stloc V_4
br IL_0065: ldloc V_4
leave IL_01B2: ret
ldloc.s V_0
brfalse IL_0192: endfinally
ldc.i4 1
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_5542f5b129d04da48c54a377e63170d3
brtrue IL_015A: switch(IL_0192,IL_016C)
pop <null>
ldc.i4 1
br IL_015A: switch(IL_0192,IL_016C)
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_0192: endfinally
ldloc.s V_0
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_2391d8b59b634582be63d34dac828009
brfalse IL_015A: switch(IL_0192,IL_016C)
pop <null>
ldc.i4 0
br IL_015A: switch(IL_0192,IL_016C)
endfinally <null>
ldc.i4 0
ldsfld <Module>{033beb1a-ce1f-4036-bf4c-276424245db2} <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_b15122c5cd804c4b9c267889fa3c7629
ldfld System.Int32 <Module>{033beb1a-ce1f-4036-bf4c-276424245db2}::m_e8d9d228a7f8486890fe2354def83b74
brtrue IL_0012: switch(IL_01B2,IL_004E,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01B2,IL_004E,IL_0028)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙