Deep Malware Analysis of 23ac423d9a6adec92d74a8c35cc153b3 | md5: 23ac423d9a6adec92d74a8c35cc153b3 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.90

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	23ac423d9a6adec92d74a8c35cc153b3
Sha1	791057f377abe9f522029fabb8eaf0837d75fe2c
Sha256	f17cb686d2371074b25d8a992014dbd75a454d06d436324001eac3f9f0ecef5a
Sha384	00df81ac4c152cb0410488b5affcb0c96bf596199ae8a00e77905e22310cded8d6a846b14cf11c24bc85b5f8c628223b
Sha512	915f377aac43a04687a705e6965982b6572984d937f0fedbaf869a314c13e106ce6adc8d92b9c2bb38f9a4199a0a4f54f2d2cb15aa1d3eebd8d6215538dbd6ec
SSDeep	12288:447whkcSTVJwoE0UnAxpVEx5iQ34eUv4iQXWkHDqFirZY:4IxJwoEFAxpu5iQobvPDkew
TLSH	E105AE6B73628E10C2850637C1EB045183F5AA877AA7F74F768423961C433FEDE466A7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Eiumskcaea.exe
Full Name	Eiumskcaea.exe
EntryPoint	System.Void PANaJXQ4drhLgvjhMv.TZ3T909Y6pxxUqW6mb::lMKYLWjo4()
Scope Name	Eiumskcaea.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Eiumskcaea
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void PANaJXQ4drhLgvjhMv.TZ3T909Y6pxxUqW6mb::lMKYLWjo4()
Main IL Instruction Count	68
Main IL	br.s IL_0007: ldc.i4 2 call <null> ldc.i4 2 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 990 beq IL_0010: ldloc V_0 br IL_0116: ldsfld X2yXJqTuk4BSq6uLvoX X2yXJqTuk4BSq6uLvoX::w1STiShM75 nop <null> newobj System.Void MI10RqtTWOane1TTcE.ymX8cqZM6LFnk04QoA::.ctor() ldsfld jKmBAIT2poT07VBKS1K jKmBAIT2poT07VBKS1K::ETUTVbfoXO call System.Byte[] jKmBAIT2poT07VBKS1K::tdWTb6DPVL(jKmBAIT2poT07VBKS1K) ldsfld M6xE9rTpA9D9DHVAtpU M6xE9rTpA9D9DHVAtpU::mqUTPyLJE4 call System.Void M6xE9rTpA9D9DHVAtpU::tdWTb6DPVL(System.Object,System.Byte[],M6xE9rTpA9D9DHVAtpU) ldc.i4 0 ldsfld <Module>{d462e290-bd60-4a86-addc-7e8219a604cf} <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_8542e8c8a7ba4ca7b897526775a8fd00 ldfld System.Int32 <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_f7358567debb48a4829c463162b26e0f brfalse IL_0083: switch(IL_009F) pop <null> ldc.i4 0 br IL_0083: switch(IL_009F) br IL_007F: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_007F: ldloc V_2 br IL_009F: leave IL_013F leave IL_013F: ret pop <null> ldc.i4 4 ldsfld <Module>{d462e290-bd60-4a86-addc-7e8219a604cf} <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_8542e8c8a7ba4ca7b897526775a8fd00 ldfld System.Int32 <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_a6c2f1c211c74e1c96bc935cdc1c62e0 brtrue IL_00D6: switch(IL_00F2) pop <null> ldc.i4 0 br IL_00D6: switch(IL_00F2) br IL_00D2: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_00D2: ldloc V_1 br IL_00F2: leave IL_013F leave IL_013F: ret ldc.i4 6 ldsfld <Module>{d462e290-bd60-4a86-addc-7e8219a604cf} <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_8542e8c8a7ba4ca7b897526775a8fd00 ldfld System.Int32 <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_e95717dcac9f47fe92daf5bf91a3c99d brtrue IL_0014: switch(IL_013F,IL_0038,IL_0116) pop <null> ldc.i4 0 br IL_0014: switch(IL_013F,IL_0038,IL_0116) ldsfld X2yXJqTuk4BSq6uLvoX X2yXJqTuk4BSq6uLvoX::w1STiShM75 call System.Void X2yXJqTuk4BSq6uLvoX::tdWTb6DPVL(X2yXJqTuk4BSq6uLvoX) ldc.i4 1 ldsfld <Module>{d462e290-bd60-4a86-addc-7e8219a604cf} <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_8542e8c8a7ba4ca7b897526775a8fd00 ldfld System.Int32 <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_ac438e664a5742d6a6749009a79cf2da brtrue IL_0014: switch(IL_013F,IL_0038,IL_0116) pop <null> ldc.i4 5 br IL_0014: switch(IL_013F,IL_0038,IL_0116) ret <null>
Module Name	Eiumskcaea.exe
Full Name	Eiumskcaea.exe
EntryPoint	System.Void PANaJXQ4drhLgvjhMv.TZ3T909Y6pxxUqW6mb::lMKYLWjo4()
Scope Name	Eiumskcaea.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Eiumskcaea
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void PANaJXQ4drhLgvjhMv.TZ3T909Y6pxxUqW6mb::lMKYLWjo4()
Main IL Instruction Count	68
Main IL	br.s IL_0007: ldc.i4 2 call <null> ldc.i4 2 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 990 beq IL_0010: ldloc V_0 br IL_0116: ldsfld X2yXJqTuk4BSq6uLvoX X2yXJqTuk4BSq6uLvoX::w1STiShM75 nop <null> newobj System.Void MI10RqtTWOane1TTcE.ymX8cqZM6LFnk04QoA::.ctor() ldsfld jKmBAIT2poT07VBKS1K jKmBAIT2poT07VBKS1K::ETUTVbfoXO call System.Byte[] jKmBAIT2poT07VBKS1K::tdWTb6DPVL(jKmBAIT2poT07VBKS1K) ldsfld M6xE9rTpA9D9DHVAtpU M6xE9rTpA9D9DHVAtpU::mqUTPyLJE4 call System.Void M6xE9rTpA9D9DHVAtpU::tdWTb6DPVL(System.Object,System.Byte[],M6xE9rTpA9D9DHVAtpU) ldc.i4 0 ldsfld <Module>{d462e290-bd60-4a86-addc-7e8219a604cf} <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_8542e8c8a7ba4ca7b897526775a8fd00 ldfld System.Int32 <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_f7358567debb48a4829c463162b26e0f brfalse IL_0083: switch(IL_009F) pop <null> ldc.i4 0 br IL_0083: switch(IL_009F) br IL_007F: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_007F: ldloc V_2 br IL_009F: leave IL_013F leave IL_013F: ret pop <null> ldc.i4 4 ldsfld <Module>{d462e290-bd60-4a86-addc-7e8219a604cf} <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_8542e8c8a7ba4ca7b897526775a8fd00 ldfld System.Int32 <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_a6c2f1c211c74e1c96bc935cdc1c62e0 brtrue IL_00D6: switch(IL_00F2) pop <null> ldc.i4 0 br IL_00D6: switch(IL_00F2) br IL_00D2: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_00D2: ldloc V_1 br IL_00F2: leave IL_013F leave IL_013F: ret ldc.i4 6 ldsfld <Module>{d462e290-bd60-4a86-addc-7e8219a604cf} <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_8542e8c8a7ba4ca7b897526775a8fd00 ldfld System.Int32 <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_e95717dcac9f47fe92daf5bf91a3c99d brtrue IL_0014: switch(IL_013F,IL_0038,IL_0116) pop <null> ldc.i4 0 br IL_0014: switch(IL_013F,IL_0038,IL_0116) ldsfld X2yXJqTuk4BSq6uLvoX X2yXJqTuk4BSq6uLvoX::w1STiShM75 call System.Void X2yXJqTuk4BSq6uLvoX::tdWTb6DPVL(X2yXJqTuk4BSq6uLvoX) ldc.i4 1 ldsfld <Module>{d462e290-bd60-4a86-addc-7e8219a604cf} <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_8542e8c8a7ba4ca7b897526775a8fd00 ldfld System.Int32 <Module>{d462e290-bd60-4a86-addc-7e8219a604cf}::m_ac438e664a5742d6a6749009a79cf2da brtrue IL_0014: switch(IL_013F,IL_0038,IL_0116) pop <null> ldc.i4 5 br IL_0014: switch(IL_013F,IL_0038,IL_0116) ret <null>