Suspicious
Suspect

28d6ac597789297a345ebb33a5e21589

PE Executable
MD5: 28d6ac597789297a345ebb33a5e21589
Size: 852.48 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 28d6ac597789297a345ebb33a5e21589
Sha1 c06051b08e3a0dd17d10d66c9b0306e922715251
Sha256 e74dc2c4237ec2cb4bcce022af6ebf67d46863c6b91ba6083029dc0be0bdf980
Sha384 8dd7fdebe99bbe7fc33f7b8bd35024a0a0b28cbf6d4c1eb8784d677b034403a91aa9e9283080e4bf43d9368a360a1a3a
Sha512 b128ae5089b8e069a2c85a3c766fd03656679150b757ba6535641f212dccc0e831e20fb2efcdec87740ec480516abab8f3d8a89ec0ac88d919b002831176610c
SSDeep 12288:gUAuiZcstO5Lkq6C06MNfK6gCSMHuonxx9Wh9ENJcaIvqGPilMt9zV/:ouiZcstwoCiI637xS92JIiFS9
TLSH 2A05CE3223E85B55F0BF9B38943154018BF2BD1ADB27E76E7D9810DD1931B80CA66B23
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon
28d6ac597789297a345ebb33a5e21589
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Tt5qd2Cb0wy.g.resources
Tt5qd2Cb0wy.Resources.resources
9bc2860d961c41.Resources.resources
ff359b220
[NBF]root.Data
ff359b221
[NBF]root.Data
ff359b2210
[NBF]root.Data
ff359b2211
[NBF]root.Data
ff359b2212
[NBF]root.Data
ff359b2213
[NBF]root.Data
ff359b2214
[NBF]root.Data
ff359b2215
[NBF]root.Data
ff359b2216
[NBF]root.Data
ff359b2217
[NBF]root.Data
ff359b2218
[NBF]root.Data
ff359b2219
[NBF]root.Data
ff359b222
[NBF]root.Data
ff359b2220
[NBF]root.Data
ff359b2221
[NBF]root.Data
ff359b223
[NBF]root.Data
ff359b224
[NBF]root.Data
ff359b225
[NBF]root.Data
ff359b226
[NBF]root.Data
ff359b227
[NBF]root.Data
ff359b228
[NBF]root.Data
ff359b229
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Tt5qd2Cb0wy
Full Name
Tt5qd2Cb0wy
EntryPoint
System.Void Tt5qd2Cb0wy.Tm2qq6bQjH::wKe36fHks4()
Scope Name
Tt5qd2Cb0wy
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tt5qd2Cb0wy
Assembly Version
2.29.19.277
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1341
Main Method
System.Void Tt5qd2Cb0wy.Tm2qq6bQjH::wKe36fHks4()
Main IL Instruction Count
338
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.0 <null>
ldc.i4 10001
newarr System.Int32
stloc.1 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_14
ldc.i4.0 <null>
stloc.s V_15
br.s IL_003A: ldloc.s V_15
ldloc.1 <null>
ldloc.s V_15
ldloc.s V_15
ldc.i4.s 31
mul.ovf <null>
ldc.i4 10000
rem <null>
stelem.i4 <null>
ldloc.s V_15
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_14
ble.s IL_0025: ldloc.1
ldloc.1 <null>
call System.Void System.Array::Sort<System.Int32>(System.Int32[])
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr SystemTools
ldstr cache.cfg
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.3 <null>
ldloc.3 <null>
call System.Object Tt5qd2Cb0wy.0RkqdgX9N6sc1w/2fiYX.2SttJde7n6y::1x_GT2je(System.Int32)
castclass System.Object[]
stloc.s V_4
ldstr resources/13
ldc.i4.0 <null>
newarr System.Object
call System.String System.String::Format(System.String,System.Object[])
stloc.s V_5
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.s V_4
ldc.i4.2 <null>
ldloc.s V_4
ldc.i4.0 <null>
ldelem.ref <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] Tt5qd2Cb0wy.5NwrEw2z6::b_7BgMf8q(System.String)
stelem.ref <null>
call System.String System.IO.Path::GetTempPath()
stloc.s V_6
ldloc.s V_6
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_16
ldloc.s V_16
brfalse.s IL_00C9: ldc.i4.s 100
ldloc.s V_6
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldc.i4.s 100
stloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_9
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_10
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_18
br.s IL_014E: ldloc.s V_18
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_19
ldc.i4.0 <null>
stloc.s V_20
br.s IL_0142: ldloc.s V_20
ldloc.s V_8
ldloc.s V_18
ldloc.s V_20
ldloc.s V_18
ldloc.s V_20
add.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_18
ldloc.s V_20
ldloc.s V_18
ldloc.s V_20
mul.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_20
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_20
ldloc.s V_20
ldloc.s V_19
ble.s IL_011C: ldloc.s V_8
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_18
ldloc.s V_18
ldloc.s V_17
ble.s IL_0111: ldloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_21
ldc.i4.0 <null>
stloc.s V_22
br.s IL_01C9: ldloc.s V_22
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_23
ldc.i4.0 <null>
stloc.s V_24
br.s IL_01BD: ldloc.s V_24
ldloc.s V_10
ldloc.s V_22
ldloc.s V_24
ldc.i4.0 <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_25
ldc.i4.0 <null>
stloc.s V_26
br.s IL_01B1: ldloc.s V_26
ldloc.s V_10
ldloc.s V_22
ldloc.s V_24
call System.Int32& System.Int32[0...,0...]::Address(System.Int32,System.Int32)
dup <null>
stloc.s V_27
ldloc.s V_27
ldind.i4 <null>
ldloc.s V_8
ldloc.s V_22
ldloc.s V_26
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_26
ldloc.s V_24
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
mul.ovf <null>
add.ovf <null>
stind.i4 <null>
ldloc.s V_26
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_26
ldloc.s V_26
ldloc.s V_25
ble.s IL_0181: ldloc.s V_10
ldloc.s V_24
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_24
ldloc.s V_24
ldloc.s V_23
ble.s IL_016A: ldloc.s V_10
ldloc.s V_22
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_22
ldloc.s V_22
ldloc.s V_21
ble.s IL_015F: ldloc.s V_7
ldloc.s V_4
ldc.i4.3 <null>
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] Tt5qd2Cb0wy.eg6C4gA/3MzrFpn9c5Kb.8Qjeq3nM4qNxz/4tpZr8NzRgo56E.Yt9kw::3s_GoYg9n2Cy5(System.Byte[])
stelem.ref <null>
ldloc.s V_10
ldc.i4.s 50
ldc.i4.s 50
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldc.i4.s 100
rem <null>
conv.r8 <null>
ldc.r8 100
div <null>
stloc.s V_11
ldloc.s V_11
ldc.r8 0.95
clt <null>
stloc.s V_12
ldc.r8 0
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_28
ldloc.s V_13
ldc.r8 -1
ldloc.s V_28
conv.r8 <null>
call System.Double System.Math::Pow(System.Double,System.Double)
ldc.i4.2 <null>
ldloc.s V_28
mul.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
conv.r8 <null>
div <null>
add <null>
stloc.s V_13
ldloc.s V_28
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_28
ldloc.s V_28
ldc.i4 1000000
ble.s IL_0219: ldloc.s V_13
ldloc.s V_13
ldc.r8 4
mul <null>
stloc.s V_13
nop <null>
ldstr SystemService
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
stloc.s V_29
ldloc.s V_29
brfalse.s IL_02AA: nop
nop <null>
ldstr Application
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_30
ldloc.s V_30
ldstr SystemService
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_30
ldstr Module initialized. PI≈{0:F5}
ldloc.s V_13
box System.Double
call System.String System.String::Format(System.String,System.Object)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_02A9: nop
nop <null>
ldloc.s V_30
brfalse.s IL_02A8: endfinally
ldloc.s V_30
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
nop <null>
leave.s IL_02BA: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02BA: nop
nop <null>
ldstr L o a d
ldloc.s V_4
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Tt5qd2Cb0wy.Tm2qq6bQjH/9Eget3kPzB4.Nwa6ym5::kNm65kjKwbG8z(System.String,System.Object)
pop <null>
leave.s IL_02F2: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_31
nop <null>
nop <null>
leave.s IL_02EA: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02EA: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02F2: nop
nop <null>
ret <null>
Module Name
Tt5qd2Cb0wy
Full Name
Tt5qd2Cb0wy
EntryPoint
System.Void Tt5qd2Cb0wy.Tm2qq6bQjH::wKe36fHks4()
Scope Name
Tt5qd2Cb0wy
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tt5qd2Cb0wy
Assembly Version
2.29.19.277
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1341
Main Method
System.Void Tt5qd2Cb0wy.Tm2qq6bQjH::wKe36fHks4()
Main IL Instruction Count
338
Main IL 
nop <null>
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.0 <null>
ldc.i4 10001
newarr System.Int32
stloc.1 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_14
ldc.i4.0 <null>
stloc.s V_15
br.s IL_003A: ldloc.s V_15
ldloc.1 <null>
ldloc.s V_15
ldloc.s V_15
ldc.i4.s 31
mul.ovf <null>
ldc.i4 10000
rem <null>
stelem.i4 <null>
ldloc.s V_15
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_14
ble.s IL_0025: ldloc.1
ldloc.1 <null>
call System.Void System.Array::Sort<System.Int32>(System.Int32[])
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr SystemTools
ldstr cache.cfg
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.3 <null>
ldloc.3 <null>
call System.Object Tt5qd2Cb0wy.0RkqdgX9N6sc1w/2fiYX.2SttJde7n6y::1x_GT2je(System.Int32)
castclass System.Object[]
stloc.s V_4
ldstr resources/13
ldc.i4.0 <null>
newarr System.Object
call System.String System.String::Format(System.String,System.Object[])
stloc.s V_5
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
ldloc.s V_4
ldc.i4.2 <null>
ldloc.s V_4
ldc.i4.0 <null>
ldelem.ref <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] Tt5qd2Cb0wy.5NwrEw2z6::b_7BgMf8q(System.String)
stelem.ref <null>
call System.String System.IO.Path::GetTempPath()
stloc.s V_6
ldloc.s V_6
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_16
ldloc.s V_16
brfalse.s IL_00C9: ldc.i4.s 100
ldloc.s V_6
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldc.i4.s 100
stloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_8
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_9
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_10
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_18
br.s IL_014E: ldloc.s V_18
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_19
ldc.i4.0 <null>
stloc.s V_20
br.s IL_0142: ldloc.s V_20
ldloc.s V_8
ldloc.s V_18
ldloc.s V_20
ldloc.s V_18
ldloc.s V_20
add.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_18
ldloc.s V_20
ldloc.s V_18
ldloc.s V_20
mul.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_20
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_20
ldloc.s V_20
ldloc.s V_19
ble.s IL_011C: ldloc.s V_8
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_18
ldloc.s V_18
ldloc.s V_17
ble.s IL_0111: ldloc.s V_7
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_21
ldc.i4.0 <null>
stloc.s V_22
br.s IL_01C9: ldloc.s V_22
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_23
ldc.i4.0 <null>
stloc.s V_24
br.s IL_01BD: ldloc.s V_24
ldloc.s V_10
ldloc.s V_22
ldloc.s V_24
ldc.i4.0 <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_7
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_25
ldc.i4.0 <null>
stloc.s V_26
br.s IL_01B1: ldloc.s V_26
ldloc.s V_10
ldloc.s V_22
ldloc.s V_24
call System.Int32& System.Int32[0...,0...]::Address(System.Int32,System.Int32)
dup <null>
stloc.s V_27
ldloc.s V_27
ldind.i4 <null>
ldloc.s V_8
ldloc.s V_22
ldloc.s V_26
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldloc.s V_9
ldloc.s V_26
ldloc.s V_24
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
mul.ovf <null>
add.ovf <null>
stind.i4 <null>
ldloc.s V_26
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_26
ldloc.s V_26
ldloc.s V_25
ble.s IL_0181: ldloc.s V_10
ldloc.s V_24
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_24
ldloc.s V_24
ldloc.s V_23
ble.s IL_016A: ldloc.s V_10
ldloc.s V_22
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_22
ldloc.s V_22
ldloc.s V_21
ble.s IL_015F: ldloc.s V_7
ldloc.s V_4
ldc.i4.3 <null>
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] Tt5qd2Cb0wy.eg6C4gA/3MzrFpn9c5Kb.8Qjeq3nM4qNxz/4tpZr8NzRgo56E.Yt9kw::3s_GoYg9n2Cy5(System.Byte[])
stelem.ref <null>
ldloc.s V_10
ldc.i4.s 50
ldc.i4.s 50
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldc.i4.s 100
rem <null>
conv.r8 <null>
ldc.r8 100
div <null>
stloc.s V_11
ldloc.s V_11
ldc.r8 0.95
clt <null>
stloc.s V_12
ldc.r8 0
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_28
ldloc.s V_13
ldc.r8 -1
ldloc.s V_28
conv.r8 <null>
call System.Double System.Math::Pow(System.Double,System.Double)
ldc.i4.2 <null>
ldloc.s V_28
mul.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
conv.r8 <null>
div <null>
add <null>
stloc.s V_13
ldloc.s V_28
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_28
ldloc.s V_28
ldc.i4 1000000
ble.s IL_0219: ldloc.s V_13
ldloc.s V_13
ldc.r8 4
mul <null>
stloc.s V_13
nop <null>
ldstr SystemService
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
stloc.s V_29
ldloc.s V_29
brfalse.s IL_02AA: nop
nop <null>
ldstr Application
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_30
ldloc.s V_30
ldstr SystemService
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_30
ldstr Module initialized. PI≈{0:F5}
ldloc.s V_13
box System.Double
call System.String System.String::Format(System.String,System.Object)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_02A9: nop
nop <null>
ldloc.s V_30
brfalse.s IL_02A8: endfinally
ldloc.s V_30
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
nop <null>
nop <null>
leave.s IL_02BA: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02BA: nop
nop <null>
ldstr L o a d
ldloc.s V_4
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Tt5qd2Cb0wy.Tm2qq6bQjH/9Eget3kPzB4.Nwa6ym5::kNm65kjKwbG8z(System.String,System.Object)
pop <null>
leave.s IL_02F2: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_31
nop <null>
nop <null>
leave.s IL_02EA: nop
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02EA: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02F2: nop
nop <null>
ret <null>
28d6ac597789297a345ebb33a5e21589
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Tt5qd2Cb0wy.g.resources
Tt5qd2Cb0wy.Resources.resources
9bc2860d961c41.Resources.resources
ff359b220
[NBF]root.Data
ff359b221
[NBF]root.Data
ff359b2210
[NBF]root.Data
ff359b2211
[NBF]root.Data
ff359b2212
[NBF]root.Data
ff359b2213
[NBF]root.Data
ff359b2214
[NBF]root.Data
ff359b2215
[NBF]root.Data
ff359b2216
[NBF]root.Data
ff359b2217
[NBF]root.Data
ff359b2218
[NBF]root.Data
ff359b2219
[NBF]root.Data
ff359b222
[NBF]root.Data
ff359b2220
[NBF]root.Data
ff359b2221
[NBF]root.Data
ff359b223
[NBF]root.Data
ff359b224
[NBF]root.Data
ff359b225
[NBF]root.Data
ff359b226
[NBF]root.Data
ff359b227
[NBF]root.Data
ff359b228
[NBF]root.Data
ff359b229
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙