Malicious PE Executable analysis – 550e19932519

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

3 MB · 2,996,224 B

First seen

2025-07-26 18:01 · one year ago

Last seen

2025-07-26 18:01 · one year ago

Last analysis

2025-07-26 18:01 · one year ago

Hashes

MD5 2861a0fa64cadf709d15d2e280de5cea Sha1 205c39b15bfbfb2b929599cef39f2470f20b167b Sha256 550e199325198e2aeb1c1fe8228a37715962dcad001c447f29f226921e6a9f0e Sha384 c5a995d5e96a7378a3aa15e9150d3c124db3e6fd02d710f23d43dc46ebdb8ee5b4256582bece036dfae4c78f6b5dc25d Sha512 c88a1d3bff0712bbcf96b0e4a8e8d42d92e735cfad70a25ea6db867a134e40c4a00aaf1fd2909837d0aa73ba6425e11dba28b2093e691adceaabf317d90478a6 SSDeep 49152:ZOMakqNelNDy2cmIljJ8dwM/XEbouu6j101xZWyADofDpIp92j4nw5hoJ+nD:EMaNYNO2cmIVJkwE6Cj3MD+pID2jVm+ TLSH 1DD5DF017E44CE52F0091237C2EF49488BB0A9516AE6E33B7DBA377E55123A77D0D9CA

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Symbol obfuscation

Very high

1 malicious · 4 files

EXE2861a0fa64cadf709d15d2e280de5cea

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	PweaboyN6LgHBzvqDk0eRlm1aFH7auRI6oI
Full Name	PweaboyN6LgHBzvqDk0eRlm1aFH7auRI6oI
EntryPoint	System.Void S1XDL2Zxdu2SbDnsCmu.PWmWsWZdrEkPGUjf9b5::hQQ41IoUln()
Scope Name	PweaboyN6LgHBzvqDk0eRlm1aFH7auRI6oI
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Vo9LAVTz
Assembly Version	3.3.0.5
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void S1XDL2Zxdu2SbDnsCmu.PWmWsWZdrEkPGUjf9b5::hQQ41IoUln()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void roiNnIgC5UdsneSCwfR.cN2KWAgPqhucwKjFaCv::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object S1XDL2Zxdu2SbDnsCmu.PWmWsWZdrEkPGUjf9b5::nH948EEjcR callvirt System.Void O7iddJZPDLcOwnpyUjo.OrLF1uZMgmZhJu6df6U::rRmBlspbhA() nop <null> ret <null>`
Module Name	PweaboyN6LgHBzvqDk0eRlm1aFH7auRI6oI
Full Name	PweaboyN6LgHBzvqDk0eRlm1aFH7auRI6oI
EntryPoint	System.Void S1XDL2Zxdu2SbDnsCmu.PWmWsWZdrEkPGUjf9b5::hQQ41IoUln()
Scope Name	PweaboyN6LgHBzvqDk0eRlm1aFH7auRI6oI
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Vo9LAVTz
Assembly Version	3.3.0.5
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	63
Main Method	System.Void S1XDL2Zxdu2SbDnsCmu.PWmWsWZdrEkPGUjf9b5::hQQ41IoUln()
Main IL Instruction Count	14
Main IL	`br.s IL_000B: ldc.i4.0 call <null> ldnull <null> ldc.i4.0 <null> ldelem.ref <null> pop <null> ldc.i4.0 <null> brtrue.s IL_0007: ldnull call System.Void roiNnIgC5UdsneSCwfR.cN2KWAgPqhucwKjFaCv::kLjw4iIsCLsZtxc4lksN0j() nop <null> ldsfld System.Object S1XDL2Zxdu2SbDnsCmu.PWmWsWZdrEkPGUjf9b5::nH948EEjcR callvirt System.Void O7iddJZPDLcOwnpyUjo.OrLF1uZMgmZhJu6df6U::rRmBlspbhA() nop <null> ret <null>`