Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 14 files
EXE24bc3e0679b2c6c14b72279210959059
Structure
Name Value
Module Name
Ertgp.exe
Full Name
Ertgp.exe
EntryPoint
System.Void ksxbsxTBdwSGbROvbp.cHdfDukPrISKZbOlBB::kWGlERFtr()
Scope Name
Ertgp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ertgp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void ksxbsxTBdwSGbROvbp.cHdfDukPrISKZbOlBB::kWGlERFtr()
Main IL Instruction Count
102
Main IL 
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0009: ldloc V_2
br IL_0031: nop
nop <null>
ldsfld iEmeoyKcIleZT9sUWko iEmeoyKcIleZT9sUWko::z0QKAc5R7k
call System.Byte[] iEmeoyKcIleZT9sUWko::UlrKp4n7K5(iEmeoyKcIleZT9sUWko)
stloc.s V_1
ldc.i4 2
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
br IL_0056: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 12
beq IL_00FB: ldloc.s V_1
ldloc V_0
ldc.i4 992
beq IL_0056: ldloc V_0
br IL_0113: ldloc.s V_1
br IL_013A: leave IL_01DA
ldc.i4 4
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
ldloc.s V_1
ldsfld aL7pRDKgZdKjjgYA3GT aL7pRDKgZdKjjgYA3GT::DGgKMaIFE0
call System.Void aL7pRDKgZdKjjgYA3GT::UlrKp4n7K5(System.Byte[],aL7pRDKgZdKjjgYA3GT)
ldc.i4 9
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_51b78c06d3cc4dd495740ea55765fc64
brtrue IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
pop <null>
ldc.i4 0
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
ldloc.s V_1
ldsfld OEl6m2KyhdQDg4cu5gV OEl6m2KyhdQDg4cu5gV::rUsKm8yLKq
call System.Byte[] OEl6m2KyhdQDg4cu5gV::UlrKp4n7K5(System.Byte[],OEl6m2KyhdQDg4cu5gV)
stloc.s V_1
ldc.i4 7
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_3ecf84a8a98b4982b1ff710acaeced11
brfalse IL_0052: stloc V_0
pop <null>
ldc.i4 12
br IL_0052: stloc V_0
ldloc.s V_1
ldsfld tYvoiUK2ConGvtf1Ugo tYvoiUK2ConGvtf1Ugo::HMDKrP6f0V
call System.Byte[] tYvoiUK2ConGvtf1Ugo::UlrKp4n7K5(System.Byte[],tYvoiUK2ConGvtf1Ugo)
stloc.s V_1
ldc.i4 3
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
ldloc.s V_1
ldlen <null>
brtrue IL_00A3: ldloc.s V_1
ldc.i4 3
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_5b2a0d9a11fd42ef8d9fe582194595fd
brtrue IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
pop <null>
ldc.i4 1
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
leave IL_01DA: ret
pop <null>
ldc.i4 0
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_62fa39a7408a402e9c2887c4f10a47aa
brtrue IL_0171: switch(IL_018D)
pop <null>
ldc.i4 1
br IL_0171: switch(IL_018D)
br IL_016D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_016D: ldloc V_3
br IL_018D: leave IL_01DA
leave IL_01DA: ret
ldc.i4 5
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_cd00141e8e0c40ffbae45b9bd5de3b46
brfalse IL_000D: switch(IL_0031,IL_01B1,IL_01DA)
pop <null>
ldc.i4 2
br IL_000D: switch(IL_0031,IL_01B1,IL_01DA)
ldsfld j5hpUqKBoJXGDXdRZYi j5hpUqKBoJXGDXdRZYi::FGdKY1LjGU
call System.Void j5hpUqKBoJXGDXdRZYi::UlrKp4n7K5(j5hpUqKBoJXGDXdRZYi)
ldc.i4 0
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_36ebe0cbca7d4bd686c0c94810048d4b
brfalse IL_000D: switch(IL_0031,IL_01B1,IL_01DA)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0031,IL_01B1,IL_01DA)
ret <null>
Module Name
Ertgp.exe
Full Name
Ertgp.exe
EntryPoint
System.Void ksxbsxTBdwSGbROvbp.cHdfDukPrISKZbOlBB::kWGlERFtr()
Scope Name
Ertgp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ertgp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void ksxbsxTBdwSGbROvbp.cHdfDukPrISKZbOlBB::kWGlERFtr()
Main IL Instruction Count
102
Main IL 
ldc.i4 1
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 990
beq IL_0009: ldloc V_2
br IL_0031: nop
nop <null>
ldsfld iEmeoyKcIleZT9sUWko iEmeoyKcIleZT9sUWko::z0QKAc5R7k
call System.Byte[] iEmeoyKcIleZT9sUWko::UlrKp4n7K5(iEmeoyKcIleZT9sUWko)
stloc.s V_1
ldc.i4 2
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
br IL_0056: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 12
beq IL_00FB: ldloc.s V_1
ldloc V_0
ldc.i4 992
beq IL_0056: ldloc V_0
br IL_0113: ldloc.s V_1
br IL_013A: leave IL_01DA
ldc.i4 4
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
ldloc.s V_1
ldsfld aL7pRDKgZdKjjgYA3GT aL7pRDKgZdKjjgYA3GT::DGgKMaIFE0
call System.Void aL7pRDKgZdKjjgYA3GT::UlrKp4n7K5(System.Byte[],aL7pRDKgZdKjjgYA3GT)
ldc.i4 9
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_51b78c06d3cc4dd495740ea55765fc64
brtrue IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
pop <null>
ldc.i4 0
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
ldloc.s V_1
ldsfld OEl6m2KyhdQDg4cu5gV OEl6m2KyhdQDg4cu5gV::rUsKm8yLKq
call System.Byte[] OEl6m2KyhdQDg4cu5gV::UlrKp4n7K5(System.Byte[],OEl6m2KyhdQDg4cu5gV)
stloc.s V_1
ldc.i4 7
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_3ecf84a8a98b4982b1ff710acaeced11
brfalse IL_0052: stloc V_0
pop <null>
ldc.i4 12
br IL_0052: stloc V_0
ldloc.s V_1
ldsfld tYvoiUK2ConGvtf1Ugo tYvoiUK2ConGvtf1Ugo::HMDKrP6f0V
call System.Byte[] tYvoiUK2ConGvtf1Ugo::UlrKp4n7K5(System.Byte[],tYvoiUK2ConGvtf1Ugo)
stloc.s V_1
ldc.i4 3
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
ldloc.s V_1
ldlen <null>
brtrue IL_00A3: ldloc.s V_1
ldc.i4 3
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_5b2a0d9a11fd42ef8d9fe582194595fd
brtrue IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
pop <null>
ldc.i4 1
br IL_005A: switch(IL_013A,IL_0094,IL_00CE,IL_0113,IL_00A3)
leave IL_01DA: ret
pop <null>
ldc.i4 0
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_62fa39a7408a402e9c2887c4f10a47aa
brtrue IL_0171: switch(IL_018D)
pop <null>
ldc.i4 1
br IL_0171: switch(IL_018D)
br IL_016D: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_016D: ldloc V_3
br IL_018D: leave IL_01DA
leave IL_01DA: ret
ldc.i4 5
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_cd00141e8e0c40ffbae45b9bd5de3b46
brfalse IL_000D: switch(IL_0031,IL_01B1,IL_01DA)
pop <null>
ldc.i4 2
br IL_000D: switch(IL_0031,IL_01B1,IL_01DA)
ldsfld j5hpUqKBoJXGDXdRZYi j5hpUqKBoJXGDXdRZYi::FGdKY1LjGU
call System.Void j5hpUqKBoJXGDXdRZYi::UlrKp4n7K5(j5hpUqKBoJXGDXdRZYi)
ldc.i4 0
ldsfld <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7} <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_887bc5b9f71b4aa1a8ca22b3e4a02214
ldfld System.Int32 <Module>{ad8f02de-2d79-40ea-9408-5648afcc59d7}::m_36ebe0cbca7d4bd686c0c94810048d4b
brfalse IL_000D: switch(IL_0031,IL_01B1,IL_01DA)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0031,IL_01B1,IL_01DA)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙