Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 5 files
EXE1f577597e007a534eafb2f8ca91218dc
Structure
Name Value
Module Name
Vcmdl.exe
Full Name
Vcmdl.exe
EntryPoint
System.Void Vcmdl.Notifications.NotifierAggregator::InformDynamicNotifier()
Scope Name
Vcmdl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vcmdl
Assembly Version
1.0.8019.25905
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1210
Main Method
System.Void Vcmdl.Notifications.NotifierAggregator::InformDynamicNotifier()
Main IL Instruction Count
102
Main IL 
ldc.i4 2
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_004E: ret
newobj System.Void Vcmdl.Reflection.MemberField::.ctor()
stloc.s V_4
ldc.i4 1
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_07ff488f80594a2292fa9d3876a40ea7
brtrue IL_0012: switch(IL_004E,IL_004F,IL_0028)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_004E,IL_004F,IL_0028)
ret <null>
nop <null>
ldloc.s V_4
callvirt System.String Vcmdl.Reflection.MemberField::GenerateSetStub()
brfalse IL_0138: leave IL_004E
ldc.i4 3
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_874d75a32db94f38b0a903ba8d6f4d15
brfalse IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
pop <null>
ldc.i4 1
br IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C5: ldloc.s V_2
ldloc.s V_2
call System.Int32 System.Linq.Enumerable::Count<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldc.i4.0 <null>
ble IL_0138: leave IL_004E
ldc.i4 0
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_1afc995026a3464f8ff23b425b3b10ab
brtrue IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
pop <null>
ldc.i4 0
br IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
ldloc.s V_2
call System.Type System.Linq.Enumerable::First<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldstr xMnOwlsPb
ldc.i4 256
ldnull <null>
ldnull <null>
ldnull <null>
callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[])
pop <null>
ldc.i4 1
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_ab8f60c4da404614b6b37b2ab32ac01d
brtrue IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
pop <null>
ldc.i4 1
br IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
ldloc.s V_4
callvirt System.Type[] Vcmdl.Reflection.MemberField::InvokeConvertibleMember()
ldsfld System.Func`2<System.Type,System.Boolean> Vcmdl.Notifications.NotifierAggregator/<>c::_InterruptibleNotifier
dup <null>
brtrue IL_0127: call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
pop <null>
ldsfld Vcmdl.Notifications.NotifierAggregator/<>c Vcmdl.Notifications.NotifierAggregator/<>c::_NotifierDistributor
ldftn System.Boolean Vcmdl.Notifications.NotifierAggregator/<>c::AlertIdentifiableProfile(System.Type)
newobj System.Void System.Func`2<System.Type,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Type,System.Boolean> Vcmdl.Notifications.NotifierAggregator/<>c::_InterruptibleNotifier
call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
stloc.s V_2
ldc.i4 2
br IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
leave IL_004E: ret
ldloc.s V_4
brfalse IL_019F: endfinally
ldc.i4 0
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_d802a4c3283f40799f4d17eda4192a42
brfalse IL_0167: switch(IL_0179,IL_019F)
pop <null>
ldc.i4 0
br IL_0167: switch(IL_0179,IL_019F)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0179: ldloc.s V_4
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 1
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_eec9d615e9264e5dac3aff099a1a5221
brtrue IL_0167: switch(IL_0179,IL_019F)
pop <null>
ldc.i4 1
br IL_0167: switch(IL_0179,IL_019F)
endfinally <null>
ldc.i4 0
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a402fcd982a34580aa7441644addee61
brtrue IL_0012: switch(IL_004E,IL_004F,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_004E,IL_004F,IL_0028)
Module Name
Vcmdl.exe
Full Name
Vcmdl.exe
EntryPoint
System.Void Vcmdl.Notifications.NotifierAggregator::InformDynamicNotifier()
Scope Name
Vcmdl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vcmdl
Assembly Version
1.0.8019.25905
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1210
Main Method
System.Void Vcmdl.Notifications.NotifierAggregator::InformDynamicNotifier()
Main IL Instruction Count
102
Main IL 
ldc.i4 2
stloc V_3
br IL_000E: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_004E: ret
newobj System.Void Vcmdl.Reflection.MemberField::.ctor()
stloc.s V_4
ldc.i4 1
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_07ff488f80594a2292fa9d3876a40ea7
brtrue IL_0012: switch(IL_004E,IL_004F,IL_0028)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_004E,IL_004F,IL_0028)
ret <null>
nop <null>
ldloc.s V_4
callvirt System.String Vcmdl.Reflection.MemberField::GenerateSetStub()
brfalse IL_0138: leave IL_004E
ldc.i4 3
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_874d75a32db94f38b0a903ba8d6f4d15
brfalse IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
pop <null>
ldc.i4 1
br IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_00C5: ldloc.s V_2
ldloc.s V_2
call System.Int32 System.Linq.Enumerable::Count<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldc.i4.0 <null>
ble IL_0138: leave IL_004E
ldc.i4 0
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_1afc995026a3464f8ff23b425b3b10ab
brtrue IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
pop <null>
ldc.i4 0
br IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
ldloc.s V_2
call System.Type System.Linq.Enumerable::First<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>)
ldstr xMnOwlsPb
ldc.i4 256
ldnull <null>
ldnull <null>
ldnull <null>
callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[])
pop <null>
ldc.i4 1
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_ab8f60c4da404614b6b37b2ab32ac01d
brtrue IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
pop <null>
ldc.i4 1
br IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
ldloc.s V_4
callvirt System.Type[] Vcmdl.Reflection.MemberField::InvokeConvertibleMember()
ldsfld System.Func`2<System.Type,System.Boolean> Vcmdl.Notifications.NotifierAggregator/<>c::_InterruptibleNotifier
dup <null>
brtrue IL_0127: call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
pop <null>
ldsfld Vcmdl.Notifications.NotifierAggregator/<>c Vcmdl.Notifications.NotifierAggregator/<>c::_NotifierDistributor
ldftn System.Boolean Vcmdl.Notifications.NotifierAggregator/<>c::AlertIdentifiableProfile(System.Type)
newobj System.Void System.Func`2<System.Type,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Type,System.Boolean> Vcmdl.Notifications.NotifierAggregator/<>c::_InterruptibleNotifier
call System.Collections.Generic.IEnumerable`1<System.Type> System.Linq.Enumerable::Where<System.Type>(System.Collections.Generic.IEnumerable`1<System.Type>,System.Func`2<System.Type,System.Boolean>)
stloc.s V_2
ldc.i4 2
br IL_007F: switch(IL_00C5,IL_0138,IL_0099,IL_00FE)
leave IL_004E: ret
ldloc.s V_4
brfalse IL_019F: endfinally
ldc.i4 0
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_d802a4c3283f40799f4d17eda4192a42
brfalse IL_0167: switch(IL_0179,IL_019F)
pop <null>
ldc.i4 0
br IL_0167: switch(IL_0179,IL_019F)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0179: ldloc.s V_4
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 1
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_eec9d615e9264e5dac3aff099a1a5221
brtrue IL_0167: switch(IL_0179,IL_019F)
pop <null>
ldc.i4 1
br IL_0167: switch(IL_0179,IL_019F)
endfinally <null>
ldc.i4 0
ldsfld <Module>{695c2f3c-414f-4429-9896-78411251fbc0} <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a292fe964143438b81c247f8101e4069
ldfld System.Int32 <Module>{695c2f3c-414f-4429-9896-78411251fbc0}::m_a402fcd982a34580aa7441644addee61
brtrue IL_0012: switch(IL_004E,IL_004F,IL_0028)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_004E,IL_004F,IL_0028)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙