Suspicious
Suspect

PE Executable
MD5: 2c3386eef926e484cd7ca46cad396a9b
Size: 1.01 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 2c3386eef926e484cd7ca46cad396a9b
Sha1 6b7d1a14e7f0f6cd807e4602b79d31ca1d69789e
Sha256 490644b09dd5e68cfea06b6380672071ec83ae4a04dcbb1a61322dcabdf9e0d3
Sha384 26fdf6db622c193e91ae693bf839163cd33326c51e536e48fd0baf032c48a23a8d745c61ebd4e79f22eb7bccc8a0cca5
Sha512 351d6f667335d17c5b13ccf4bf66c8479bb39b6a167f4298a0d46e125cc7feffce0c6ca879a671d2cf28eea9448570c22d003dbeeca75d0ce1b27b09be7bf0ea
SSDeep 12288:ShKreek9DMYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BwzupW9:SX2PCmQui1rBgc+9jR
TLSH E625BF2D368F884DD591EB788F3337D41770D47258F2D3567F8C5338AA2AAE59A8C242
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
2c3386eef926e484cd7ca46cad396a9b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
3prBjJ.Resources.resources
3prBjJ.g.resources
3b683159c200c0.Resources.resources
a2cd95aa0
[NBF]root.Data
a2cd95aa1
[NBF]root.Data
a2cd95aa2
[NBF]root.Data
a2cd95aa3
[NBF]root.Data
a2cd95aa4
[NBF]root.Data
a2cd95aa5
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
3prBjJ
Full Name
3prBjJ
EntryPoint
System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
Scope Name
3prBjJ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3prBjJ
Assembly Version
8.6.28.145
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
Main IL Instruction Count
199
Main IL 
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0009: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0049: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.s 12
stloc.s V_11
br.s IL_000C: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.1 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B1: ldc.i4.s 12
ldc.i4.7 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldc.i4.s 12
br.s IL_00AA: stloc.s V_11
nop <null>
ldc.i4 1395027792
ldc.i4.s 18
ldnull <null>
ldc.i4.4 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object oq7D3Yjxbp.mn5N1oFfsZq7z::Ggd3c6Ji8Kf(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.2 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void 6Nwdri.dFb6z9::Fm1iy6(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0104: ldc.i4.3
ldc.i4.4 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldc.i4.3 <null>
br.s IL_00FD: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4 197487083
ldc.i4.8 <null>
ldc.i4.5 <null>
ldc.i8 2
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.3 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
nop <null>
ldc.i4 197487075
ldc.i4.0 <null>
ldc.i4.s 11
ldc.i8 14
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.6 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
ldloc.s V_5
nop <null>
ldc.i4 1395027836
ldc.i4.s 21
ldnull <null>
ldc.i4.7 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.5 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
leave IL_025A: br.s IL_025C
br.s IL_0184: br.s IL_0186
br.s IL_0186: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_0191: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01B9: nop
nop <null>
nop <null>
ldc.i4 197487076
ldc.i4.7 <null>
ldc.i4.1 <null>
ldc.i8 15
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
nop <null>
ldc.i4 1395027798
ldc.i4.5 <null>
ldnull <null>
ldc.i4.2 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.3 <null>
stloc.s V_13
br.s IL_0194: ldloc.s V_13
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.2 <null>
ldc.i4 129
ldc.i4 190511071
ldc.i8 8
call System.String Hca4s5o.6dgPRn7kn::3jdSmPs9T4frt(System.Int32,System.Char,System.Int32,System.Int64)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.0 <null>
stloc.s V_13
br IL_0194: ldloc.s V_13
nop <null>
leave.s IL_0230: br.s IL_0232
br.s IL_0221: br.s IL_0223
br.s IL_0223: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0230: br.s IL_0232
br.s IL_0232: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0252: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_025A: br.s IL_025C
br.s IL_025C: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_027C: nop
nop <null>
ret <null>
ldtoken System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
pop <null>
ret <null>
Module Name
3prBjJ
Full Name
3prBjJ
EntryPoint
System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
Scope Name
3prBjJ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3prBjJ
Assembly Version
8.6.28.145
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
Main IL Instruction Count
199
Main IL 
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0009: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0049: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.s 12
stloc.s V_11
br.s IL_000C: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.1 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B1: ldc.i4.s 12
ldc.i4.7 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldc.i4.s 12
br.s IL_00AA: stloc.s V_11
nop <null>
ldc.i4 1395027792
ldc.i4.s 18
ldnull <null>
ldc.i4.4 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object oq7D3Yjxbp.mn5N1oFfsZq7z::Ggd3c6Ji8Kf(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.2 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void 6Nwdri.dFb6z9::Fm1iy6(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0104: ldc.i4.3
ldc.i4.4 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldc.i4.3 <null>
br.s IL_00FD: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4 197487083
ldc.i4.8 <null>
ldc.i4.5 <null>
ldc.i8 2
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.3 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
nop <null>
ldc.i4 197487075
ldc.i4.0 <null>
ldc.i4.s 11
ldc.i8 14
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.6 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
ldloc.s V_5
nop <null>
ldc.i4 1395027836
ldc.i4.s 21
ldnull <null>
ldc.i4.7 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.5 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
leave IL_025A: br.s IL_025C
br.s IL_0184: br.s IL_0186
br.s IL_0186: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_0191: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01B9: nop
nop <null>
nop <null>
ldc.i4 197487076
ldc.i4.7 <null>
ldc.i4.1 <null>
ldc.i8 15
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
nop <null>
ldc.i4 1395027798
ldc.i4.5 <null>
ldnull <null>
ldc.i4.2 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.3 <null>
stloc.s V_13
br.s IL_0194: ldloc.s V_13
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.2 <null>
ldc.i4 129
ldc.i4 190511071
ldc.i8 8
call System.String Hca4s5o.6dgPRn7kn::3jdSmPs9T4frt(System.Int32,System.Char,System.Int32,System.Int64)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.0 <null>
stloc.s V_13
br IL_0194: ldloc.s V_13
nop <null>
leave.s IL_0230: br.s IL_0232
br.s IL_0221: br.s IL_0223
br.s IL_0223: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0230: br.s IL_0232
br.s IL_0232: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0252: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_025A: br.s IL_025C
br.s IL_025C: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_027C: nop
nop <null>
ret <null>
ldtoken System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
pop <null>
ret <null>
2c3386eef926e484cd7ca46cad396a9b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
3prBjJ.Resources.resources
3prBjJ.g.resources
3b683159c200c0.Resources.resources
a2cd95aa0
[NBF]root.Data
a2cd95aa1
[NBF]root.Data
a2cd95aa2
[NBF]root.Data
a2cd95aa3
[NBF]root.Data
a2cd95aa4
[NBF]root.Data
a2cd95aa5
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙