Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5: 304b3a7e30d0df05ccde68a1c0e866c8
Size: 569.86 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 304b3a7e30d0df05ccde68a1c0e866c8
Sha1 75f65a520774e6245ee0064b547d6626b63fa517
Sha256 4e9316a576cdd68222c70179622ccd13dcdc90f331459249a2d3b6b158c889d2
Sha384 620f6e70a9418f6c7668cdec3f4212c63e45feeda207e8c543dcc6ea91665c61743ac507454e9a05bb2df8089ce294bc
Sha512 107710962226c1393de2e1cfb7ae13b3585e96ba0dd089df9a3fa0ca22f3fa49ed73f27e4e995e12396342081e4458f4f6c71f6ab764828dd17c1bb815c5a78c
SSDeep 12288:qlwNbE1Cju4yUwM13SbrVLU84z/uZR66jPoUZIQ6qz:qlwpHyUwM1Wp94zWZR6EoUZT6
TLSH 1FC4028B7B942742CA3015B6C5D3993A46F6D9C732B3D7073E08439A9E013D9CE6AB85
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
304b3a7e30d0df05ccde68a1c0e866c8
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hoXMqZtjefPfJs9rNr.4ONlvW3bqj05NSc5eH
8SnM5NC9t64NpAujUr.mHEYi0oJYpx7oDmBto
Qpl81Ugfi2pwJfUdMt.DpfslvPjRnfgA7f9ST
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Jsypuqp.exe
Full Name
Jsypuqp.exe
EntryPoint
System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs::rdopbSFfF()
Scope Name
Jsypuqp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jsypuqp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs::rdopbSFfF()
Main IL Instruction Count
90
Main IL 
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 991
beq IL_0009: ldloc V_0
br IL_0087: ret
ldsfld eP9vEFtqhNXX775IYUt eP9vEFtqhNXX775IYUt::KTJtuYb9ki
call System.Void eP9vEFtqhNXX775IYUt::GwBtj3qJey(eP9vEFtqhNXX775IYUt)
ldc.i4 1
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_874d8285e26f401b98be3b40c661ab93
brtrue IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
call System.Void HdjZ32tDIg4LXwLfxwl::GwBtj3qJey(HdjZ32tDIg4LXwLfxwl)
ldc.i4 2
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_aaed45b1e67e42d5930d3502721e9df0
brtrue IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
ret <null>
nop <null>
ldsfld System.Threading.ThreadStart UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::f4njhqJPj
dup <null>
brfalse IL_0099: pop
br IL_0101: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldc.i4 0
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_5b005f853c644f5eb5f5b29cb56bb4ba
brtrue IL_00CB: switch(IL_00EB,IL_012F)
pop <null>
ldc.i4 4
br IL_00CB: switch(IL_00EB,IL_012F)
br IL_00C7: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_00C7: ldloc V_1
br IL_00EB: ldsfld UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::tfcfKlrYw
ldsfld UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::tfcfKlrYw
ldftn System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::B8w6R8ig8()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::f4njhqJPj
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld SxNItxtQ2lo0RkUkXqd SxNItxtQ2lo0RkUkXqd::HZbtUQSy3S
call System.Void SxNItxtQ2lo0RkUkXqd::GwBtj3qJey(System.Object,SxNItxtQ2lo0RkUkXqd)
ldc.i4 5
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_b0debe4cf01b4c40bbcb07a426342320
brfalse IL_00CB: switch(IL_00EB,IL_012F)
pop <null>
ldc.i4 1
br IL_00CB: switch(IL_00EB,IL_012F)
leave IL_005E: ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
pop <null>
ldc.i4 0
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_06068383f2f74cae85562b2ed3491f24
brtrue IL_0166: switch(IL_0182)
pop <null>
ldc.i4 2
br IL_0166: switch(IL_0182)
br IL_0162: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0162: ldloc V_2
br IL_0182: leave IL_005E
leave IL_005E: ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
ldc.i4 3
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_f3c034f9ee664bea864dd0830cbd6df6
brfalse IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
Module Name
Jsypuqp.exe
Full Name
Jsypuqp.exe
EntryPoint
System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs::rdopbSFfF()
Scope Name
Jsypuqp.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jsypuqp
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs::rdopbSFfF()
Main IL Instruction Count
90
Main IL 
ldc.i4 2
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 991
beq IL_0009: ldloc V_0
br IL_0087: ret
ldsfld eP9vEFtqhNXX775IYUt eP9vEFtqhNXX775IYUt::KTJtuYb9ki
call System.Void eP9vEFtqhNXX775IYUt::GwBtj3qJey(eP9vEFtqhNXX775IYUt)
ldc.i4 1
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_874d8285e26f401b98be3b40c661ab93
brtrue IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
call System.Void HdjZ32tDIg4LXwLfxwl::GwBtj3qJey(HdjZ32tDIg4LXwLfxwl)
ldc.i4 2
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_aaed45b1e67e42d5930d3502721e9df0
brtrue IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
ret <null>
nop <null>
ldsfld System.Threading.ThreadStart UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::f4njhqJPj
dup <null>
brfalse IL_0099: pop
br IL_0101: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldc.i4 0
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_5b005f853c644f5eb5f5b29cb56bb4ba
brtrue IL_00CB: switch(IL_00EB,IL_012F)
pop <null>
ldc.i4 4
br IL_00CB: switch(IL_00EB,IL_012F)
br IL_00C7: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_00C7: ldloc V_1
br IL_00EB: ldsfld UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::tfcfKlrYw
ldsfld UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::tfcfKlrYw
ldftn System.Void UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::B8w6R8ig8()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart UBba1s4UFYeZFyARlp.nV2OKgdfrDsmNO3lGs/<>c::f4njhqJPj
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld SxNItxtQ2lo0RkUkXqd SxNItxtQ2lo0RkUkXqd::HZbtUQSy3S
call System.Void SxNItxtQ2lo0RkUkXqd::GwBtj3qJey(System.Object,SxNItxtQ2lo0RkUkXqd)
ldc.i4 5
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_b0debe4cf01b4c40bbcb07a426342320
brfalse IL_00CB: switch(IL_00EB,IL_012F)
pop <null>
ldc.i4 1
br IL_00CB: switch(IL_00EB,IL_012F)
leave IL_005E: ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
pop <null>
ldc.i4 0
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_06068383f2f74cae85562b2ed3491f24
brtrue IL_0166: switch(IL_0182)
pop <null>
ldc.i4 2
br IL_0166: switch(IL_0182)
br IL_0162: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_0162: ldloc V_2
br IL_0182: leave IL_005E
leave IL_005E: ldsfld HdjZ32tDIg4LXwLfxwl HdjZ32tDIg4LXwLfxwl::uLttsF6LPW
ldc.i4 3
ldsfld <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6} <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_6d106bf0d2684c648de0724a38fc4ba9
ldfld System.Int32 <Module>{0c8ba4fe-9438-41f6-9ae6-da4d62c3aaf6}::m_f3c034f9ee664bea864dd0830cbd6df6
brfalse IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0087,IL_0088,IL_0035,IL_005E)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙