Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 30a9e8dcd7b316b4dfcd3d0559fb3e36
Size: 1.23 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 30a9e8dcd7b316b4dfcd3d0559fb3e36
Sha1 2c23819f33faf8c26df7e8fc90d3c31cc046cd92
Sha256 51e8bfd578ae4e51206ad57e2bf501067e84ee7d0307ada70a1f3a35d907a1bd
Sha384 07e5f758e963c3d4ee6a1fee493219dda504b90aafe6c3b2312767ca4b621ae8ee21cfa6b2cbcadec7b22efb938a6d0f
Sha512 33e1f34e954e0668c8cc71d70df6074df8b5a9c84159e7121cb09bb4a9424d6dc8e76dac068858581246636866801631efc45671551f4f6d886c79cb3cc3fc06
SSDeep 24576:SQh2byCnRveYepqMKDmfC4KOSSn2D6ki3:1IvRveYkqM3fC41p2W3
TLSH 6E45E01937DA4194E1BB8B34EBBA4A1447F0BA17CA32C71FA15601FDCB5638961233B3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
30a9e8dcd7b316b4dfcd3d0559fb3e36
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Qte2q4zP3iFcj.g.resources
Qte2q4zP3iFcj.Resources.resources
da2af9a551aba7.Resources.resources
0f4fb8480
[NBF]root.Data
0f4fb8481
[NBF]root.Data
0f4fb84810
[NBF]root.Data
0f4fb84811
[NBF]root.Data
0f4fb84812
[NBF]root.Data
0f4fb84813
[NBF]root.Data
0f4fb84814
[NBF]root.Data
0f4fb84815
[NBF]root.Data
0f4fb84816
[NBF]root.Data
0f4fb84817
[NBF]root.Data
0f4fb84818
[NBF]root.Data
0f4fb84819
[NBF]root.Data
0f4fb8482
[NBF]root.Data
0f4fb84820
[NBF]root.Data
0f4fb84821
[NBF]root.Data
0f4fb84822
[NBF]root.Data
0f4fb84823
[NBF]root.Data
0f4fb84824
[NBF]root.Data
0f4fb84825
[NBF]root.Data
0f4fb84826
[NBF]root.Data
0f4fb84827
[NBF]root.Data
0f4fb84828
[NBF]root.Data
0f4fb84829
[NBF]root.Data
0f4fb8483
[NBF]root.Data
0f4fb84830
[NBF]root.Data
0f4fb84831
[NBF]root.Data
0f4fb84832
[NBF]root.Data
0f4fb84833
[NBF]root.Data
0f4fb84834
[NBF]root.Data
0f4fb84835
[NBF]root.Data
0f4fb84836
[NBF]root.Data
0f4fb84837
[NBF]root.Data
0f4fb84838
[NBF]root.Data
0f4fb84839
[NBF]root.Data
0f4fb8484
[NBF]root.Data
0f4fb84840
[NBF]root.Data
0f4fb84841
[NBF]root.Data
0f4fb8485
[NBF]root.Data
0f4fb8486
[NBF]root.Data
0f4fb8487
[NBF]root.Data
0f4fb8488
[NBF]root.Data
0f4fb8489
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Qte2q4zP3iFcj
Full Name
Qte2q4zP3iFcj
EntryPoint
System.Void Qte2q4zP3iFcj.Wxk0nm6KT8::8Yqjt()
Scope Name
Qte2q4zP3iFcj
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qte2q4zP3iFcj
Assembly Version
7.25.46.161
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1005
Main Method
System.Void Qte2q4zP3iFcj.Wxk0nm6KT8::8Yqjt()
Main IL Instruction Count
106
Main IL 
nop <null>
nop <null>
newobj System.Void Qte2q4zP3iFcj.Wxk0nm6KT8::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.3 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0051: ldloc.3
br.s IL_006E: ldloc.s V_5
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken Qte2q4zP3iFcj.Wxk0nm6KT8
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass Qte2q4zP3iFcj.Wxk0nm6KT8
stloc.0 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.2 <null>
leave.s IL_00ED: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
nop <null>
nop <null>
ldc.i4 214
stloc.s V_7
br.s IL_00B1: ldloc.s V_7
ldloc.s V_7
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_7
ldloc.s V_7
ldc.i4.s 24
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_00AF: nop
ldc.i4.s 24
stloc.s V_7
ldstr resources/9875193
call System.Byte[] Qte2q4zP3iFcj.Jm3k5fcQR0dtii::4bfEM0zygm9R(System.String)
stloc.s V_8
br.s IL_00BF: ldloc.s V_8
nop <null>
nop <null>
ldloc.s V_7
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_10
ldloc.s V_10
brtrue.s IL_008B: ldloc.s V_7
ldloc.s V_8
castclass System.Byte[]
call System.Void Qte2q4zP3iFcj.8TtdWdi3yg2F9H/Rz4m0Wjndy2M.wb7A0zLj::5Ttrk9Wiye0Kx(System.Byte[])
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
leave.s IL_00E5: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E5: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00ED: nop
nop <null>
ret <null>
Module Name
Qte2q4zP3iFcj
Full Name
Qte2q4zP3iFcj
EntryPoint
System.Void Qte2q4zP3iFcj.Wxk0nm6KT8::8Yqjt()
Scope Name
Qte2q4zP3iFcj
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Qte2q4zP3iFcj
Assembly Version
7.25.46.161
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1005
Main Method
System.Void Qte2q4zP3iFcj.Wxk0nm6KT8::8Yqjt()
Main IL Instruction Count
106
Main IL 
nop <null>
nop <null>
newobj System.Void Qte2q4zP3iFcj.Wxk0nm6KT8::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.3 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0051: ldloc.3
br.s IL_006E: ldloc.s V_5
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken Qte2q4zP3iFcj.Wxk0nm6KT8
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass Qte2q4zP3iFcj.Wxk0nm6KT8
stloc.0 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.2 <null>
leave.s IL_00ED: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
nop <null>
nop <null>
ldc.i4 214
stloc.s V_7
br.s IL_00B1: ldloc.s V_7
ldloc.s V_7
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_7
ldloc.s V_7
ldc.i4.s 24
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_00AF: nop
ldc.i4.s 24
stloc.s V_7
ldstr resources/9875193
call System.Byte[] Qte2q4zP3iFcj.Jm3k5fcQR0dtii::4bfEM0zygm9R(System.String)
stloc.s V_8
br.s IL_00BF: ldloc.s V_8
nop <null>
nop <null>
ldloc.s V_7
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_10
ldloc.s V_10
brtrue.s IL_008B: ldloc.s V_7
ldloc.s V_8
castclass System.Byte[]
call System.Void Qte2q4zP3iFcj.8TtdWdi3yg2F9H/Rz4m0Wjndy2M.wb7A0zLj::5Ttrk9Wiye0Kx(System.Byte[])
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
leave.s IL_00E5: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E5: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00ED: nop
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙