Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 2c3386eef926e484cd7ca46cad396a9b
Size: 1.01 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 2c3386eef926e484cd7ca46cad396a9b
Sha1 6b7d1a14e7f0f6cd807e4602b79d31ca1d69789e
Sha256 490644b09dd5e68cfea06b6380672071ec83ae4a04dcbb1a61322dcabdf9e0d3
Sha384 26fdf6db622c193e91ae693bf839163cd33326c51e536e48fd0baf032c48a23a8d745c61ebd4e79f22eb7bccc8a0cca5
Sha512 351d6f667335d17c5b13ccf4bf66c8479bb39b6a167f4298a0d46e125cc7feffce0c6ca879a671d2cf28eea9448570c22d003dbeeca75d0ce1b27b09be7bf0ea
SSDeep 12288:ShKreek9DMYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BwzupW9:SX2PCmQui1rBgc+9jR
TLSH E625BF2D368F884DD591EB788F3337D41770D47258F2D3567F8C5338AA2AAE59A8C242
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
2c3386eef926e484cd7ca46cad396a9b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
3prBjJ.Resources.resources
3prBjJ.g.resources
3b683159c200c0.Resources.resources
a2cd95aa0
[NBF]root.Data
a2cd95aa1
[NBF]root.Data
a2cd95aa2
[NBF]root.Data
a2cd95aa3
[NBF]root.Data
a2cd95aa4
[NBF]root.Data
a2cd95aa5
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
3prBjJ
Full Name
3prBjJ
EntryPoint
System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
Scope Name
3prBjJ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3prBjJ
Assembly Version
8.6.28.145
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
Main IL Instruction Count
199
Main IL 
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0009: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0049: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.s 12
stloc.s V_11
br.s IL_000C: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.1 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B1: ldc.i4.s 12
ldc.i4.7 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldc.i4.s 12
br.s IL_00AA: stloc.s V_11
nop <null>
ldc.i4 1395027792
ldc.i4.s 18
ldnull <null>
ldc.i4.4 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object oq7D3Yjxbp.mn5N1oFfsZq7z::Ggd3c6Ji8Kf(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.2 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void 6Nwdri.dFb6z9::Fm1iy6(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0104: ldc.i4.3
ldc.i4.4 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldc.i4.3 <null>
br.s IL_00FD: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4 197487083
ldc.i4.8 <null>
ldc.i4.5 <null>
ldc.i8 2
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.3 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
nop <null>
ldc.i4 197487075
ldc.i4.0 <null>
ldc.i4.s 11
ldc.i8 14
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.6 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
ldloc.s V_5
nop <null>
ldc.i4 1395027836
ldc.i4.s 21
ldnull <null>
ldc.i4.7 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.5 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
leave IL_025A: br.s IL_025C
br.s IL_0184: br.s IL_0186
br.s IL_0186: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_0191: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01B9: nop
nop <null>
nop <null>
ldc.i4 197487076
ldc.i4.7 <null>
ldc.i4.1 <null>
ldc.i8 15
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
nop <null>
ldc.i4 1395027798
ldc.i4.5 <null>
ldnull <null>
ldc.i4.2 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.3 <null>
stloc.s V_13
br.s IL_0194: ldloc.s V_13
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.2 <null>
ldc.i4 129
ldc.i4 190511071
ldc.i8 8
call System.String Hca4s5o.6dgPRn7kn::3jdSmPs9T4frt(System.Int32,System.Char,System.Int32,System.Int64)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.0 <null>
stloc.s V_13
br IL_0194: ldloc.s V_13
nop <null>
leave.s IL_0230: br.s IL_0232
br.s IL_0221: br.s IL_0223
br.s IL_0223: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0230: br.s IL_0232
br.s IL_0232: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0252: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_025A: br.s IL_025C
br.s IL_025C: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_027C: nop
nop <null>
ret <null>
ldtoken System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
pop <null>
ret <null>
Module Name
3prBjJ
Full Name
3prBjJ
EntryPoint
System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
Scope Name
3prBjJ
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3prBjJ
Assembly Version
8.6.28.145
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
Main IL Instruction Count
199
Main IL 
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0009: ldc.i4.8
ldc.i4.8 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0049: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.s 12
stloc.s V_11
br.s IL_000C: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.1 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B1: ldc.i4.s 12
ldc.i4.7 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldc.i4.s 12
br.s IL_00AA: stloc.s V_11
nop <null>
ldc.i4 1395027792
ldc.i4.s 18
ldnull <null>
ldc.i4.4 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object oq7D3Yjxbp.mn5N1oFfsZq7z::Ggd3c6Ji8Kf(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.2 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void 6Nwdri.dFb6z9::Fm1iy6(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0104: ldc.i4.3
ldc.i4.4 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
ldc.i4.3 <null>
br.s IL_00FD: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4 197487083
ldc.i4.8 <null>
ldc.i4.5 <null>
ldc.i8 2
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.3 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
nop <null>
ldc.i4 197487075
ldc.i4.0 <null>
ldc.i4.s 11
ldc.i8 14
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.6 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
ldloc.s V_5
nop <null>
ldc.i4 1395027836
ldc.i4.s 21
ldnull <null>
ldc.i4.7 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.5 <null>
stloc.s V_11
br IL_000C: ldloc.s V_11
nop <null>
leave IL_025A: br.s IL_025C
br.s IL_0184: br.s IL_0186
br.s IL_0186: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_0191: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_13
ldloc.s V_13
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01B9: nop
nop <null>
nop <null>
ldc.i4 197487076
ldc.i4.7 <null>
ldc.i4.1 <null>
ldc.i8 15
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz::sb3QiTj(System.Int32,System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
nop <null>
ldc.i4 1395027798
ldc.i4.5 <null>
ldnull <null>
ldc.i4.2 <null>
call System.String Cyq5qz9ZD7jd.gXc0sy/Yk3xz0gM.kPg5F8om/nMj5K8ba.3otMx7Bz/6JqkZ_1p7xdBb.dWe93rgDJk7y6::gi7BWpj1m(System.Int32,System.Byte,System.Reflection.Assembly,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.3 <null>
stloc.s V_13
br.s IL_0194: ldloc.s V_13
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.2 <null>
ldc.i4 129
ldc.i4 190511071
ldc.i8 8
call System.String Hca4s5o.6dgPRn7kn::3jdSmPs9T4frt(System.Int32,System.Char,System.Int32,System.Int64)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.0 <null>
stloc.s V_13
br IL_0194: ldloc.s V_13
nop <null>
leave.s IL_0230: br.s IL_0232
br.s IL_0221: br.s IL_0223
br.s IL_0223: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0230: br.s IL_0232
br.s IL_0232: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_15
ldloc.s V_15
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0252: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_025A: br.s IL_025C
br.s IL_025C: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_17
ldloc.s V_17
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_027C: nop
nop <null>
ret <null>
ldtoken System.Void 6Nwdri.dFb6z9/Yc6yq9Jy1gb.wNo29sRncQ0y8::Pzz5t2()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙