Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
PeID
HQR data file
276c53bf2f1cbc62cbdb0f2cae10f0a6
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Siticone.Desktop.UI.AnimatorNS.DoubleBitmapForm.resources
_____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________Mc4vR7tLOtydaPXYmmdPqF3CTgF.resources
icon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
picture.Image
[NBF]root.Data
[NBF]root.Data-preview.png
_____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________YT08wpfWLvnW36zbNrbf6Rjyli.resources
_____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________meoi3D6DiEgbXwe2KPjGCSJsAPB.resources
icon.Image
[NBF]root.Data
[NBF]root.Data-preview.png
_____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________p7E6Exm4xgnYs5LucV7ALO7HY8m.resources
CheckedCheckbox_20px
[NBF]root.Data
[NBF]root.Data-preview.png
CheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
FullImage_64px
[NBF]root.Data
[NBF]root.Data-preview.png
ImageCalendar
[NBF]root.Data
[NBF]root.Data-preview.png
UncheckedCheckbox_20px
UncheckedRadioButton_20px
[NBF]root.Data
[NBF]root.Data-preview.png
error
[NBF]root.Data
[NBF]root.Data-preview.png
info
[NBF]root.Data
[NBF]root.Data-preview.png
question
[NBF]root.Data
[NBF]root.Data-preview.png
slogo_22px
[NBF]root.Data
[NBF]root.Data-preview.png
warning
[NBF]root.Data
[NBF]root.Data-preview.png
_____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________0EpuabFGhrFHZ9zPsQBex4AxrV6A.resources
btDown.Image
btUp.Image
imageList1.ImageStream
[NBF]root.Data
Name Value
Module Name
grbojpojqdakqaz.exe
Full Name
grbojpojqdakqaz.exe
EntryPoint
System.Void HtmlRendererUtils.HtmlRendererUtilsEntry::Main()
Scope Name
grbojpojqdakqaz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
grbojpojqdakqaz
Assembly Version
26.0.0.1001
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
4429
Main Method
System.Void HtmlRendererUtils.HtmlRendererUtilsEntry::Main()
Main IL Instruction Count
49
Main IL 
call System.String HtmlContainerInt.AssemblyNodeIdHelper::CodeSchemaCategoriesResources()
stloc.0 <null>
ldstr CodeQualifiedIdentifierUriConvert
call System.Security.Cryptography.DES BiDiSupport.CodeGraphCommands::CreateWithKey(System.String)
stloc.1 <null>
ldloc.1 <null>
call System.Void CodeGraphSchema.CodeSchemaGraphHelpers::Configure(System.Security.Cryptography.DES)
ldloc.0 <null>
ldloc.1 <null>
call System.Tuple`2<System.Byte[],System.Security.Cryptography.ICryptoTransform> CodeQualifiedIdentifierBuilder.CodeQualifiedIdentifierMemberBuilder::Prepare(System.String,System.Security.Cryptography.DES)
stloc.2 <null>
ldloc.2 <null>
callvirt System.Byte[] System.Tuple`2<System.Byte[],System.Security.Cryptography.ICryptoTransform>::get_Item1()
stloc.3 <null>
ldloc.2 <null>
callvirt System.Security.Cryptography.ICryptoTransform System.Tuple`2<System.Byte[],System.Security.Cryptography.ICryptoTransform>::get_Item2()
stloc.s V_4
ldloc.3 <null>
ldloc.s V_4
call System.String CodeQualifiedIdentifierGenericBuilder.CodeQualifiedIdentifierTypeBuilder::ToDecryptedString(System.Byte[],System.Security.Cryptography.ICryptoTransform)
stloc.s V_5
ldloc.s V_5
call System.Reflection.Assembly CodeQualifiedIdentifierUriConvert.CodeQualifiedName::ThroughFilter(System.String)
stloc.s V_6
ldloc.s V_6
call System.Reflection.MethodInfo CodeSchemaCategoriesResources.Constants::GetTargetMethod(System.Reflection.Assembly)
stloc.s V_7
ldloc.1 <null>
call System.Byte[] CodeSchemaPropertiesResources.GraphReverseEngineeringSettings::CharsetFilter(System.Security.Cryptography.DES)
stloc.s V_8
ldloc.s V_7
ldnull <null>
call System.Boolean System.Reflection.MethodInfo::op_Inequality(System.Reflection.MethodInfo,System.Reflection.MethodInfo)
brfalse IL_006F: leave IL_0081
ldloc.s V_8
brfalse IL_006F: leave IL_0081
ldloc.s V_7
ldloc.s V_8
call System.Void LinkCategories.NodeCategories::IMimeFilter(System.Reflection.MethodInfo,System.Byte[])
leave IL_0081: leave IL_008C
ldloc.1 <null>
brfalse IL_0080: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_008C: ret
pop <null>
leave IL_008C: ret
ret <null>
PDB Path PATH
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙