Malicious
Malicious

PE Executable
MD5: 304b3a7e30d0df05ccde68a1c0e866c8
Size: 569.86 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 304b3a7e30d0df05ccde68a1c0e866c8
Sha1 75f65a520774e6245ee0064b547d6626b63fa517
Sha256 4e9316a576cdd68222c70179622ccd13dcdc90f331459249a2d3b6b158c889d2
Sha384 620f6e70a9418f6c7668cdec3f4212c63e45feeda207e8c543dcc6ea91665c61743ac507454e9a05bb2df8089ce294bc
Sha512 107710962226c1393de2e1cfb7ae13b3585e96ba0dd089df9a3fa0ca22f3fa49ed73f27e4e995e12396342081e4458f4f6c71f6ab764828dd17c1bb815c5a78c
SSDeep 12288:qlwNbE1Cju4yUwM13SbrVLU84z/uZR66jPoUZIQ6qz:qlwpHyUwM1Wp94zWZR6EoUZT6
TLSH 1FC4028B7B942742CA3015B6C5D3993A46F6D9C732B3D7073E08439A9E013D9CE6AB85
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
304b3a7e30d0df05ccde68a1c0e866c8
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hoXMqZtjefPfJs9rNr.4ONlvW3bqj05NSc5eH
8SnM5NC9t64NpAujUr.mHEYi0oJYpx7oDmBto
Qpl81Ugfi2pwJfUdMt.DpfslvPjRnfgA7f9ST
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Jsypuqp.exe
Full Name
Jsypuqp.exe
EntryPoint
System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs::rdopbSFfF()
Scope Name
Jsypuqp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jsypuqp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs::rdopbSFfF()
Main IL Instruction Count
90
Main IL 
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 991
beq IL_0009: ldloc V_0
br IL_0087: ret
ldsfld eP9vEFtqhNXX775IYUt eP9vEFtqhNXX775IYUt::KTJtuYb9ki
call System.Void eP9vEFtqhNXX775IYUt::GwBtj3qJey(eP9vEFtqhNXX775IYUt)
ldc.i4 1
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_874d8285e26f401b98be3b40c661ab93
brtrue IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
call System.Void HdjZ32tDIg4LXwLfxwl::GwBtj3qJey(HdjZ32tDIg4LXwLfxwl)
ldc.i4 2
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_aaed45b1e67e42d5930d3502721e9df0
brtrue IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
ret <null>
nop <null>
ldsfld System.Threading.ThreadStart UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::f4njhqJPj
dup <null>
brfalse IL_0099: pop
br IL_0101: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldc.i4 0
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_5b005f853c644f5eb5f5b29cb56bb4ba
brtrue IL_00CB: switch(IL_00EB,IL_012F)
pop <null>
ldc.i4 4
br IL_00CB: switch(IL_00EB,IL_012F)
br IL_00C7: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_00C7: ldloc V_1
br IL_00EB: ldsfld UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::tfcfKlrYw
ldsfld UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::tfcfKlrYw
ldftn System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::B8w6R8ig8()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::f4njhqJPj
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld SxNItxtQ2lo0RkUkXqd SxNItxtQ2lo0RkUkXqd::HZbtUQSy3S
call System.Void SxNItxtQ2lo0RkUkXqd::GwBtj3qJey(System.Object,SxNItxtQ2lo0RkUkXqd)
ldc.i4 5
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_b0debe4cf01b4c40bbcb07a426342320
brfalse IL_00CB: switch(IL_00EB,IL_012F)
pop <null>
ldc.i4 1
br IL_00CB: switch(IL_00EB,IL_012F)
leave IL_005E: ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
pop <null>
ldc.i4 0
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_06068383f2f74cae85562b2ed3491f24
brtrue IL_0166: switch(IL_0182)
pop <null>
ldc.i4 2
br IL_0166: switch(IL_0182)
br IL_0162: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0162: ldloc V_2
br IL_0182: leave IL_005E
leave IL_005E: ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
ldc.i4 3
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_f3c034f9ee664bea864dd0830cbd6df6
brfalse IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
Module Name
Jsypuqp.exe
Full Name
Jsypuqp.exe
EntryPoint
System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs::rdopbSFfF()
Scope Name
Jsypuqp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jsypuqp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs::rdopbSFfF()
Main IL Instruction Count
90
Main IL 
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 991
beq IL_0009: ldloc V_0
br IL_0087: ret
ldsfld eP9vEFtqhNXX775IYUt eP9vEFtqhNXX775IYUt::KTJtuYb9ki
call System.Void eP9vEFtqhNXX775IYUt::GwBtj3qJey(eP9vEFtqhNXX775IYUt)
ldc.i4 1
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_874d8285e26f401b98be3b40c661ab93
brtrue IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
call System.Void HdjZ32tDIg4LXwLfxwl::GwBtj3qJey(HdjZ32tDIg4LXwLfxwl)
ldc.i4 2
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_aaed45b1e67e42d5930d3502721e9df0
brtrue IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
ret <null>
nop <null>
ldsfld System.Threading.ThreadStart UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::f4njhqJPj
dup <null>
brfalse IL_0099: pop
br IL_0101: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldc.i4 0
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_5b005f853c644f5eb5f5b29cb56bb4ba
brtrue IL_00CB: switch(IL_00EB,IL_012F)
pop <null>
ldc.i4 4
br IL_00CB: switch(IL_00EB,IL_012F)
br IL_00C7: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_00C7: ldloc V_1
br IL_00EB: ldsfld UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::tfcfKlrYw
ldsfld UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::tfcfKlrYw
ldftn System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::B8w6R8ig8()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::f4njhqJPj
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld SxNItxtQ2lo0RkUkXqd SxNItxtQ2lo0RkUkXqd::HZbtUQSy3S
call System.Void SxNItxtQ2lo0RkUkXqd::GwBtj3qJey(System.Object,SxNItxtQ2lo0RkUkXqd)
ldc.i4 5
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_b0debe4cf01b4c40bbcb07a426342320
brfalse IL_00CB: switch(IL_00EB,IL_012F)
pop <null>
ldc.i4 1
br IL_00CB: switch(IL_00EB,IL_012F)
leave IL_005E: ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
pop <null>
ldc.i4 0
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_06068383f2f74cae85562b2ed3491f24
brtrue IL_0166: switch(IL_0182)
pop <null>
ldc.i4 2
br IL_0166: switch(IL_0182)
br IL_0162: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0162: ldloc V_2
br IL_0182: leave IL_005E
leave IL_005E: ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
ldc.i4 3
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_f3c034f9ee664bea864dd0830cbd6df6
brfalse IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
304b3a7e30d0df05ccde68a1c0e866c8
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hoXMqZtjefPfJs9rNr.4ONlvW3bqj05NSc5eH
8SnM5NC9t64NpAujUr.mHEYi0oJYpx7oDmBto
Qpl81Ugfi2pwJfUdMt.DpfslvPjRnfgA7f9ST
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙