Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 9 files
EXE1cc9d4a4142f3a124d422751a57c1321
Structure
Name Value
Module Name
Vilvunrduu.exe
Full Name
Vilvunrduu.exe
EntryPoint
System.Void pdvEVpxZ8Wgfo6sOkb.Tm0RW0qmsAKkM8Dcng::PJZ6x1ZZj()
Scope Name
Vilvunrduu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vilvunrduu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void pdvEVpxZ8Wgfo6sOkb.Tm0RW0qmsAKkM8Dcng::PJZ6x1ZZj()
Main IL Instruction Count
110
Main IL 
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0009: ldloc V_2
br IL_002D: ret
ret <null>
nop <null>
newobj System.Void Ljmgvhy4ZCln0HGt7g.cnFeqITL7pE13lE7pQ::.ctor()
stloc.s V_0
ldc.i4 2
br IL_004A: stloc V_5
br IL_004E: ldloc V_5
ldc.i4 0
stloc V_5
ldloc V_5
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_5
ldc.i4 12
beq IL_00B2: br IL_0174
ldloc V_5
ldc.i4 992
beq IL_004E: ldloc V_5
br IL_00E7: newobj System.Void CmEvorIRZqyWf2lY54.RmNP6UU1txnXfdWTHN::.ctor()
newobj System.Void YCvgDZQJ4SLguXsEDR.DeSIDv7WP1TgIV7gL0::.ctor()
stloc.s V_3
ldc.i4 3
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_39cc5dfab83d49c1b33c34fa055c4a34
brtrue IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
pop <null>
ldc.i4 0
br IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
br IL_0174: leave IL_002D
ldc.i4 1
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_e60d7efb9d074fb08afb0456f5a1bc05
brfalse IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
pop <null>
ldc.i4 3
br IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
newobj System.Void s7dm1UWeMXDQnlqiea.uoYqZepIAM3u5EiqRy::.ctor()
stloc.s V_6
ldc.i4 4
br IL_004A: stloc V_5
newobj System.Void CmEvorIRZqyWf2lY54.RmNP6UU1txnXfdWTHN::.ctor()
dup <null>
dup <null>
ldsfld DF9n7B2c7IfZy7Qp1X7 DF9n7B2c7IfZy7Qp1X7::y0F2NqywAj
call System.Void DF9n7B2c7IfZy7Qp1X7::zGf260jFHl(System.Object,CmEvorIRZqyWf2lY54.RmNP6UU1txnXfdWTHN,DF9n7B2c7IfZy7Qp1X7)
dup <null>
ldloc.s V_3
ldsfld clb3wS2CecQ30BuC817 clb3wS2CecQ30BuC817::T3u2bBLyIJ
call System.Void clb3wS2CecQ30BuC817::zGf260jFHl(System.Object,YCvgDZQJ4SLguXsEDR.DeSIDv7WP1TgIV7gL0,clb3wS2CecQ30BuC817)
ldloc.s V_3
ldloc.s V_6
ldsfld EjKVUP2HU0MDtmkhMVb EjKVUP2HU0MDtmkhMVb::rIE2g0QGFM
call System.Void EjKVUP2HU0MDtmkhMVb::zGf260jFHl(System.Object,s7dm1UWeMXDQnlqiea.uoYqZepIAM3u5EiqRy,EjKVUP2HU0MDtmkhMVb)
ldloc.s V_6
ldloc.s V_4
ldsfld NsMRkx2GakBsqZmSE7l NsMRkx2GakBsqZmSE7l::YZw2MdIQFC
call System.Void NsMRkx2GakBsqZmSE7l::zGf260jFHl(System.Object,JxAsmdMc4R6tkA0etY.nBDU66GGR00HAg8uXb,NsMRkx2GakBsqZmSE7l)
ldloc.s V_4
ldloc.s V_0
ldsfld GGlW8M2Fp8BRPuEs82O GGlW8M2Fp8BRPuEs82O::gD22igDaKM
call System.Void GGlW8M2Fp8BRPuEs82O::zGf260jFHl(System.Object,Ljmgvhy4ZCln0HGt7g.cnFeqITL7pE13lE7pQ,GGlW8M2Fp8BRPuEs82O)
ldsfld OfaAH32deXIYixda3Vs OfaAH32deXIYixda3Vs::AAn2XnBrCR
call System.Boolean OfaAH32deXIYixda3Vs::zGf260jFHl(System.Object,OfaAH32deXIYixda3Vs)
brfalse IL_016E: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 12
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f4173088da7a4a33bee6553073a30b24
brtrue IL_004A: stloc V_5
pop <null>
ldc.i4 5
br IL_004A: stloc V_5
newobj System.Void JxAsmdMc4R6tkA0etY.nBDU66GGR00HAg8uXb::.ctor()
stloc.s V_4
ldc.i4 3
br IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_002D: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_e489e72958ce433882e77206300acd04
brtrue IL_01AB: switch(IL_01C7)
pop <null>
ldc.i4 0
br IL_01AB: switch(IL_01C7)
br IL_01A7: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_01A7: ldloc V_1
br IL_01C7: leave IL_002D
leave IL_002D: ret
ldc.i4 3
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_9f72bb63cbdf43e0ba45cf52db30bd9e
brfalse IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_002D,IL_002E)
Module Name
Vilvunrduu.exe
Full Name
Vilvunrduu.exe
EntryPoint
System.Void pdvEVpxZ8Wgfo6sOkb.Tm0RW0qmsAKkM8Dcng::PJZ6x1ZZj()
Scope Name
Vilvunrduu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vilvunrduu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void pdvEVpxZ8Wgfo6sOkb.Tm0RW0qmsAKkM8Dcng::PJZ6x1ZZj()
Main IL Instruction Count
110
Main IL 
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_0009: ldloc V_2
br IL_002D: ret
ret <null>
nop <null>
newobj System.Void Ljmgvhy4ZCln0HGt7g.cnFeqITL7pE13lE7pQ::.ctor()
stloc.s V_0
ldc.i4 2
br IL_004A: stloc V_5
br IL_004E: ldloc V_5
ldc.i4 0
stloc V_5
ldloc V_5
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_5
ldc.i4 12
beq IL_00B2: br IL_0174
ldloc V_5
ldc.i4 992
beq IL_004E: ldloc V_5
br IL_00E7: newobj System.Void CmEvorIRZqyWf2lY54.RmNP6UU1txnXfdWTHN::.ctor()
newobj System.Void YCvgDZQJ4SLguXsEDR.DeSIDv7WP1TgIV7gL0::.ctor()
stloc.s V_3
ldc.i4 3
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_39cc5dfab83d49c1b33c34fa055c4a34
brtrue IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
pop <null>
ldc.i4 0
br IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
br IL_0174: leave IL_002D
ldc.i4 1
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_e60d7efb9d074fb08afb0456f5a1bc05
brfalse IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
pop <null>
ldc.i4 3
br IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
newobj System.Void s7dm1UWeMXDQnlqiea.uoYqZepIAM3u5EiqRy::.ctor()
stloc.s V_6
ldc.i4 4
br IL_004A: stloc V_5
newobj System.Void CmEvorIRZqyWf2lY54.RmNP6UU1txnXfdWTHN::.ctor()
dup <null>
dup <null>
ldsfld DF9n7B2c7IfZy7Qp1X7 DF9n7B2c7IfZy7Qp1X7::y0F2NqywAj
call System.Void DF9n7B2c7IfZy7Qp1X7::zGf260jFHl(System.Object,CmEvorIRZqyWf2lY54.RmNP6UU1txnXfdWTHN,DF9n7B2c7IfZy7Qp1X7)
dup <null>
ldloc.s V_3
ldsfld clb3wS2CecQ30BuC817 clb3wS2CecQ30BuC817::T3u2bBLyIJ
call System.Void clb3wS2CecQ30BuC817::zGf260jFHl(System.Object,YCvgDZQJ4SLguXsEDR.DeSIDv7WP1TgIV7gL0,clb3wS2CecQ30BuC817)
ldloc.s V_3
ldloc.s V_6
ldsfld EjKVUP2HU0MDtmkhMVb EjKVUP2HU0MDtmkhMVb::rIE2g0QGFM
call System.Void EjKVUP2HU0MDtmkhMVb::zGf260jFHl(System.Object,s7dm1UWeMXDQnlqiea.uoYqZepIAM3u5EiqRy,EjKVUP2HU0MDtmkhMVb)
ldloc.s V_6
ldloc.s V_4
ldsfld NsMRkx2GakBsqZmSE7l NsMRkx2GakBsqZmSE7l::YZw2MdIQFC
call System.Void NsMRkx2GakBsqZmSE7l::zGf260jFHl(System.Object,JxAsmdMc4R6tkA0etY.nBDU66GGR00HAg8uXb,NsMRkx2GakBsqZmSE7l)
ldloc.s V_4
ldloc.s V_0
ldsfld GGlW8M2Fp8BRPuEs82O GGlW8M2Fp8BRPuEs82O::gD22igDaKM
call System.Void GGlW8M2Fp8BRPuEs82O::zGf260jFHl(System.Object,Ljmgvhy4ZCln0HGt7g.cnFeqITL7pE13lE7pQ,GGlW8M2Fp8BRPuEs82O)
ldsfld OfaAH32deXIYixda3Vs OfaAH32deXIYixda3Vs::AAn2XnBrCR
call System.Boolean OfaAH32deXIYixda3Vs::zGf260jFHl(System.Object,OfaAH32deXIYixda3Vs)
brfalse IL_016E: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 12
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f4173088da7a4a33bee6553073a30b24
brtrue IL_004A: stloc V_5
pop <null>
ldc.i4 5
br IL_004A: stloc V_5
newobj System.Void JxAsmdMc4R6tkA0etY.nBDU66GGR00HAg8uXb::.ctor()
stloc.s V_4
ldc.i4 3
br IL_0052: switch(IL_00E7,IL_016E,IL_015D,IL_00D6,IL_008C)
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_002D: ret
pop <null>
ldc.i4 0
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_e489e72958ce433882e77206300acd04
brtrue IL_01AB: switch(IL_01C7)
pop <null>
ldc.i4 0
br IL_01AB: switch(IL_01C7)
br IL_01A7: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_01A7: ldloc V_1
br IL_01C7: leave IL_002D
leave IL_002D: ret
ldc.i4 3
ldsfld <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955} <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_f2a20ae65c7645c8b0cc0a76c76aada9
ldfld System.Int32 <Module>{8494ce27-b5b8-4864-afd0-ffbd05cd0955}::m_9f72bb63cbdf43e0ba45cf52db30bd9e
brfalse IL_000D: switch(IL_002D,IL_002E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_002D,IL_002E)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙