Malicious PE Executable analysis – 283fec137d7e

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

1 malicious · 33 files

EXE283fec137d7e97103ea5b80e5d36471d

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Activa.exe
Full Name	Activa.exe
EntryPoint	System.Void Activa.Structs.ServerExceptionStruct::NewGetter(System.String[])
Scope Name	Activa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Activa
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	13
Main Method	System.Void Activa.Structs.ServerExceptionStruct::NewGetter(System.String[])
Main IL Instruction Count	73
Main IL	nop <null> nop <null> ldc.i4 512241941 ldc.i4 670987148 xor <null> dup <null> stloc.s V_5 ldc.i4.s 10 rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br IL_00ED: leave.s IL_0100 ldc.i4.0 <null> newobj System.Void Activa.Mappers.DicAuthenticationMapper::.ctor(System.Boolean) stloc.0 <null> ldc.i4.2 <null> stloc.s V_4 ldloc.s V_5 ldc.i4 288674521 mul <null> ldc.i4 366979235 xor <null> br.s IL_0007: ldc.i4 670987148 ldloc.0 <null> ldloc.1 <null> newobj System.Void TGL.Bridges.MapClientBridge::.ctor(Activa.Mappers.DicAuthenticationMapper,TGL.Records.ListenerPublisherRecord) stloc.2 <null> ldc.i4 1264547996 br.s IL_0007: ldc.i4 670987148 ldc.i4.4 <null> stloc.s V_4 ldloc.s V_5 ldc.i4 -1153350570 mul <null> ldc.i4 -1237996942 xor <null> br.s IL_0007: ldc.i4 670987148 newobj System.Void Activa.States.RulesAuthenticationState::.ctor() stloc.1 <null> ldc.i4 889865175 br IL_0007: ldc.i4 670987148 nop <null> ldc.i4 1862937269 br IL_0007: ldc.i4 670987148 ldc.i4.3 <null> stloc.s V_4 ldloc.s V_5 ldc.i4 739484536 mul <null> ldc.i4 -600172110 xor <null> br IL_0007: ldc.i4 670987148 ldc.i4.2 <null> stloc.s V_4 ldloc.s V_5 ldc.i4 -175232500 mul <null> ldc.i4 419958098 xor <null> br IL_0007: ldc.i4 670987148 ldloc.s V_4 switch dnlib.DotNet.Emit.Instruction[] ldc.i4 1631658272 br IL_0007: ldc.i4 670987148 leave.s IL_0100: ret stloc.3 <null> nop <null> ldloc.3 <null> call System.String Activa.Structs.ServerExceptionStruct::⁭‌‌⁯‫‌‍‏⁯‮‍‫‍‍‏⁬‫‌⁯⁯⁭⁯⁮‌⁬⁪‎‎⁫‍⁫‪‫‎⁭‫‭‮(System.Exception) call System.Void Activa.Structs.ServerExceptionStruct::‏⁮‪‫‎‪‍‬‎⁮‭‌⁭‭‬⁪⁬‎‬⁭‏⁪‎‭⁫⁫⁬‍⁮‌‎‎‏⁮‪‬⁯‪⁭‮(System.String) nop <null> nop <null> leave.s IL_0100: ret ret <null>
Module Name	Activa.exe
Full Name	Activa.exe
EntryPoint	System.Void Activa.Structs.ServerExceptionStruct::NewGetter(System.String[])
Scope Name	Activa.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Activa
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	13
Main Method	System.Void Activa.Structs.ServerExceptionStruct::NewGetter(System.String[])
Main IL Instruction Count	73
Main IL	nop <null> nop <null> ldc.i4 512241941 ldc.i4 670987148 xor <null> dup <null> stloc.s V_5 ldc.i4.s 10 rem.un <null> switch dnlib.DotNet.Emit.Instruction[] br IL_00ED: leave.s IL_0100 ldc.i4.0 <null> newobj System.Void Activa.Mappers.DicAuthenticationMapper::.ctor(System.Boolean) stloc.0 <null> ldc.i4.2 <null> stloc.s V_4 ldloc.s V_5 ldc.i4 288674521 mul <null> ldc.i4 366979235 xor <null> br.s IL_0007: ldc.i4 670987148 ldloc.0 <null> ldloc.1 <null> newobj System.Void TGL.Bridges.MapClientBridge::.ctor(Activa.Mappers.DicAuthenticationMapper,TGL.Records.ListenerPublisherRecord) stloc.2 <null> ldc.i4 1264547996 br.s IL_0007: ldc.i4 670987148 ldc.i4.4 <null> stloc.s V_4 ldloc.s V_5 ldc.i4 -1153350570 mul <null> ldc.i4 -1237996942 xor <null> br.s IL_0007: ldc.i4 670987148 newobj System.Void Activa.States.RulesAuthenticationState::.ctor() stloc.1 <null> ldc.i4 889865175 br IL_0007: ldc.i4 670987148 nop <null> ldc.i4 1862937269 br IL_0007: ldc.i4 670987148 ldc.i4.3 <null> stloc.s V_4 ldloc.s V_5 ldc.i4 739484536 mul <null> ldc.i4 -600172110 xor <null> br IL_0007: ldc.i4 670987148 ldc.i4.2 <null> stloc.s V_4 ldloc.s V_5 ldc.i4 -175232500 mul <null> ldc.i4 419958098 xor <null> br IL_0007: ldc.i4 670987148 ldloc.s V_4 switch dnlib.DotNet.Emit.Instruction[] ldc.i4 1631658272 br IL_0007: ldc.i4 670987148 leave.s IL_0100: ret stloc.3 <null> nop <null> ldloc.3 <null> call System.String Activa.Structs.ServerExceptionStruct::⁭‌‌⁯‫‌‍‏⁯‮‍‫‍‍‏⁬‫‌⁯⁯⁭⁯⁮‌⁬⁪‎‎⁫‍⁫‪‫‎⁭‫‭‮(System.Exception) call System.Void Activa.Structs.ServerExceptionStruct::‏⁮‪‫‎‪‍‬‎⁮‭‌⁭‭‬⁪⁬‎‬⁭‏⁪‎‭⁫⁫⁬‍⁮‌‎‎‏⁮‪‬⁯‪⁭‮(System.String) nop <null> nop <null> leave.s IL_0100: ret ret <null>