Suspicious
Suspect

PE Executable
MD5: 24e4486d679162817cba86e80d8f7b9f
Size: 83.97 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 24e4486d679162817cba86e80d8f7b9f
Sha1 96a7cad6f78b9d6e663c6795bd6ec278e4cf4c1a
Sha256 31ee08e0aad9297988beb54957c0fa5bce2d9b1d0d2c16e4932e247c73c19348
Sha384 63029017c7165c05e139a7b7a7d7cfbf506538b1feb60334ac66215a5680e01e460b5503cdd6e9ee172882d1e34f3dca
Sha512 4b52f7d1bbfc8de5de3a4c4a7a6218a5bb6ea5424caf7dba4d404d23f90a3f5e7101d701da2f66b6d7e7855887e448f59da94fed5ab1a53afb7b76a1554a7be1
SSDeep 1536:rpjMZKCDV5Ame6CUngfLFtxW1iMZv3ygA+03iQmgsmvhiS34ee/:NMrr1yfQAPyQmgs8V3C/
TLSH 5183C507BA4B8DB1C2485B76CD9F40880360D7C3F693D61A798AD35E1947FEE8941E8B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
24e4486d679162817cba86e80d8f7b9f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
    ​    
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ndvvjefnz
Full Name
Ndvvjefnz
EntryPoint
System.Void Ndvvjefnz.Diagnostics.TracerServer::TrackVisualTracer()
Scope Name
Ndvvjefnz
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ndvvjefnz
Assembly Version
1.0.7098.29603
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Ndvvjefnz.Diagnostics.TracerServer::TrackVisualTracer()
Main IL Instruction Count
96
Main IL 
ldc.i4 5
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0034: ret
ret <null>
ldc.i4 1164798715
call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32)
stloc.s V_1
ldc.i4 2
ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7
ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_5cbfcee2e1dd4f7fba7dbc9b1a291ec0
brfalse IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
ldc.i4 1164798744
call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32)
stloc.s V_2
ldc.i4 3
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
newobj System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::.ctor()
stloc.s V_3
ldc.i4 4
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
ldsfld System.Func`1<System.Byte[]> Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ContextProfile
dup <null>
brfalse IL_0097: pop
br IL_00CD: newobj System.Void Ndvvjefnz.Explorers.AggregatorExplorer::.ctor(System.Func`1<System.Byte[]>)
pop <null>
ldc.i4 0
ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7
ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_8cb5fb6ff7c54d58af4f306881bb1c86
brtrue IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_IsolatedConnection
ldftn System.Byte[] Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::ConnectSimpleConnection()
newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Byte[]> Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ContextProfile
newobj System.Void Ndvvjefnz.Explorers.AggregatorExplorer::.ctor(System.Func`1<System.Byte[]>)
ldloc.s V_3
ldloc.s V_1
ldloc.s V_2
newobj System.Void Ndvvjefnz.Decorators.ExternalDecorator::.ctor(System.String,System.String)
stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::commonMember
ldloc.s V_3
newobj System.Void Ndvvjefnz.Networking.ConnectionListener::.ctor()
stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::groupedCollection
ldloc.s V_3
ldc.i4 1164798765
call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32)
ldc.i4 1164798809
call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32)
newobj System.Void Ndvvjefnz.Mapping.ExecutorMapper::.ctor(System.String,System.String)
stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::scheduledTemplate
dup <null>
ldloc.s V_3
ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::ExcludeCollection(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Ndvvjefnz.Explorers.AggregatorExplorer::ExploreLocalExplorer(System.Action`1<System.IO.MemoryStream>)
ldloc.s V_3
ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::commonMember
ldloc.s V_3
ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::AddControllableCollection(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Ndvvjefnz.Decorators.ExternalDecorator::ArrangeDecorator(System.Action`1<System.IO.MemoryStream>)
ldloc.s V_3
ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::groupedCollection
ldloc.s V_3
ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::CountResponsiveCollection(System.Reflection.Assembly)
newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Ndvvjefnz.Networking.ConnectionListener::CloseExternalConnection(System.Action`1<System.Reflection.Assembly>)
ldloc.s V_3
ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::scheduledTemplate
ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ProfilerTag
dup <null>
brtrue IL_017C: callvirt System.Void Ndvvjefnz.Mapping.ExecutorMapper::MapJoinedMapper(System.Action)
pop <null>
ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_IsolatedConnection
ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::ConnectActiveConnection()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ProfilerTag
callvirt System.Void Ndvvjefnz.Mapping.ExecutorMapper::MapJoinedMapper(System.Action)
callvirt System.Void Ndvvjefnz.Explorers.AggregatorExplorer::CancelExplorer()
ldc.i4 0
ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7
ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_51bcd290357b4510877b317d0506fb8a
brtrue IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
Module Name
Ndvvjefnz
Full Name
Ndvvjefnz
EntryPoint
System.Void Ndvvjefnz.Diagnostics.TracerServer::TrackVisualTracer()
Scope Name
Ndvvjefnz
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ndvvjefnz
Assembly Version
1.0.7098.29603
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Ndvvjefnz.Diagnostics.TracerServer::TrackVisualTracer()
Main IL Instruction Count
96
Main IL 
ldc.i4 5
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0034: ret
ret <null>
ldc.i4 1164798715
call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32)
stloc.s V_1
ldc.i4 2
ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7
ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_5cbfcee2e1dd4f7fba7dbc9b1a291ec0
brfalse IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
ldc.i4 1164798744
call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32)
stloc.s V_2
ldc.i4 3
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
newobj System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::.ctor()
stloc.s V_3
ldc.i4 4
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
ldsfld System.Func`1<System.Byte[]> Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ContextProfile
dup <null>
brfalse IL_0097: pop
br IL_00CD: newobj System.Void Ndvvjefnz.Explorers.AggregatorExplorer::.ctor(System.Func`1<System.Byte[]>)
pop <null>
ldc.i4 0
ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7
ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_8cb5fb6ff7c54d58af4f306881bb1c86
brtrue IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
pop <null>
ldc.i4 1
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_IsolatedConnection
ldftn System.Byte[] Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::ConnectSimpleConnection()
newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Byte[]> Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ContextProfile
newobj System.Void Ndvvjefnz.Explorers.AggregatorExplorer::.ctor(System.Func`1<System.Byte[]>)
ldloc.s V_3
ldloc.s V_1
ldloc.s V_2
newobj System.Void Ndvvjefnz.Decorators.ExternalDecorator::.ctor(System.String,System.String)
stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::commonMember
ldloc.s V_3
newobj System.Void Ndvvjefnz.Networking.ConnectionListener::.ctor()
stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::groupedCollection
ldloc.s V_3
ldc.i4 1164798765
call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32)
ldc.i4 1164798809
call System.String Ndvvjefnz.Mapping.AlphabeticMapper::SetupMapper(System.Int32)
newobj System.Void Ndvvjefnz.Mapping.ExecutorMapper::.ctor(System.String,System.String)
stfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::scheduledTemplate
dup <null>
ldloc.s V_3
ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::ExcludeCollection(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Ndvvjefnz.Explorers.AggregatorExplorer::ExploreLocalExplorer(System.Action`1<System.IO.MemoryStream>)
ldloc.s V_3
ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::commonMember
ldloc.s V_3
ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::AddControllableCollection(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Ndvvjefnz.Decorators.ExternalDecorator::ArrangeDecorator(System.Action`1<System.IO.MemoryStream>)
ldloc.s V_3
ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::groupedCollection
ldloc.s V_3
ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::CountResponsiveCollection(System.Reflection.Assembly)
newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Ndvvjefnz.Networking.ConnectionListener::CloseExternalConnection(System.Action`1<System.Reflection.Assembly>)
ldloc.s V_3
ldfld System.Object Ndvvjefnz.Diagnostics.TracerServer/EditableCollection::scheduledTemplate
ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ProfilerTag
dup <null>
brtrue IL_017C: callvirt System.Void Ndvvjefnz.Mapping.ExecutorMapper::MapJoinedMapper(System.Action)
pop <null>
ldsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_IsolatedConnection
ldftn System.Void Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::ConnectActiveConnection()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Object Ndvvjefnz.Diagnostics.TracerServer/SubscriberConnection::_ProfilerTag
callvirt System.Void Ndvvjefnz.Mapping.ExecutorMapper::MapJoinedMapper(System.Action)
callvirt System.Void Ndvvjefnz.Explorers.AggregatorExplorer::CancelExplorer()
ldc.i4 0
ldsfld <Module>{26212862-9169-4560-ac1f-41928aa1af85} <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_c0ba006a687a498fb47385cffe84e0b7
ldfld System.Int32 <Module>{26212862-9169-4560-ac1f-41928aa1af85}::m_51bcd290357b4510877b317d0506fb8a
brtrue IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_0034,IL_00B7,IL_0060,IL_0087,IL_0035,IL_0076)
24e4486d679162817cba86e80d8f7b9f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
ILRepack.List
    ​    
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙