Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 9 files
EXE32dfcc9398750a83a25661297692fe53
Structure
Name Value
Module Name
Alpwxb.exe
Full Name
Alpwxb.exe
EntryPoint
System.Void kCZBVdM9mRigFH1U5n.kyGK5XEPZwDfp6V5bT::OXhNrnGdC()
Scope Name
Alpwxb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Alpwxb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void kCZBVdM9mRigFH1U5n.kyGK5XEPZwDfp6V5bT::OXhNrnGdC()
Main IL Instruction Count
115
Main IL 
ldc.i4 1
stloc V_6
ldloc V_6
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_6
ldc.i4 989
beq IL_0009: ldloc V_6
br IL_01FF: ret
nop <null>
newobj System.Void iTIwaPlfeCb26HDYbT.koBmjas7ja7H3glcmW::.ctor()
stloc.s V_0
ldc.i4 1
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_2a4be12b649946beaf488daa1bae759c
brtrue IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
pop <null>
ldc.i4 0
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
br IL_0062: ldloc V_4
ldc.i4 0
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_4
ldc.i4 12
beq IL_00E6: newobj System.Void mQUlXybsMDdPoiOjCR.OfEAfGQGWpoLF9GQp1::.ctor()
ldloc V_4
ldc.i4 992
beq IL_0062: ldloc V_4
br IL_0182: newobj System.Void System.InvalidOperationException::.ctor()
newobj System.Void V0w0d4030RjCEJdXN7.sckxnUyDa9PSi5UWsU::.ctor()
stloc.s V_5
ldc.i4 3
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
newobj System.Void OlUWeWSHyG6A00ZJqQ.q6JhDq1L3xgoXAQ2be::.ctor()
stloc.s V_3
ldc.i4 12
br IL_005E: stloc V_4
br IL_0188: leave IL_01FF
ldc.i4 2
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_71b55e4266044cc9b95588420d71ff91
brfalse IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
pop <null>
ldc.i4 7
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
newobj System.Void mQUlXybsMDdPoiOjCR.OfEAfGQGWpoLF9GQp1::.ctor()
dup <null>
dup <null>
ldsfld VbSHQMZqoVsv1QInZMj VbSHQMZqoVsv1QInZMj::GaKZfrBOgk
call System.Void VbSHQMZqoVsv1QInZMj::i8KZNwm3Yd(System.Object,mQUlXybsMDdPoiOjCR.OfEAfGQGWpoLF9GQp1,VbSHQMZqoVsv1QInZMj)
dup <null>
ldloc.s V_3
ldsfld AhdohaZe0wy2NmMgF7u AhdohaZe0wy2NmMgF7u::cFlZXkXaXX
call System.Void AhdohaZe0wy2NmMgF7u::i8KZNwm3Yd(System.Object,OlUWeWSHyG6A00ZJqQ.q6JhDq1L3xgoXAQ2be,AhdohaZe0wy2NmMgF7u)
ldloc.s V_3
ldloc.s V_2
ldsfld IdNLTxZHBvYWjwpT9TL IdNLTxZHBvYWjwpT9TL::UDZZWAeSCI
call System.Void IdNLTxZHBvYWjwpT9TL::i8KZNwm3Yd(System.Object,Aqw3FNBPwY8HViwfIr.bXGK0o8vySZ2tIf3XE,IdNLTxZHBvYWjwpT9TL)
ldloc.s V_2
ldloc.s V_5
ldsfld h9w64FZyZrUA5dUh5sG h9w64FZyZrUA5dUh5sG::NloZ0mqe8c
call System.Void h9w64FZyZrUA5dUh5sG::i8KZNwm3Yd(System.Object,V0w0d4030RjCEJdXN7.sckxnUyDa9PSi5UWsU,h9w64FZyZrUA5dUh5sG)
ldloc.s V_5
ldloc.s V_0
ldsfld AagqTuZgRjtxHOYKNuq AagqTuZgRjtxHOYKNuq::mYsZh71j8C
call System.Void AagqTuZgRjtxHOYKNuq::i8KZNwm3Yd(System.Object,iTIwaPlfeCb26HDYbT.koBmjas7ja7H3glcmW,AagqTuZgRjtxHOYKNuq)
ldsfld imV0urZ3KqvRQejinku imV0urZ3KqvRQejinku::bjEZUTiIgZ
call System.Boolean imV0urZ3KqvRQejinku::i8KZNwm3Yd(System.Object,imV0urZ3KqvRQejinku)
brfalse IL_0182: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 4
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_18f5aa41c07441f69ecae766bcc6e847
brtrue IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
pop <null>
ldc.i4 12
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
newobj System.Void Aqw3FNBPwY8HViwfIr.bXGK0o8vySZ2tIf3XE::.ctor()
stloc.s V_2
ldc.i4 12
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_eae41b7d06e34278a607886f82c07010
brtrue IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
pop <null>
ldc.i4 0
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_01FF: ret
pop <null>
ldc.i4 0
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_382d774d755b46c482f10bc21a198c5a
brfalse IL_01BF: switch(IL_01DB)
pop <null>
ldc.i4 4
br IL_01BF: switch(IL_01DB)
br IL_01BB: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_01BB: ldloc V_1
br IL_01DB: leave IL_01FF
leave IL_01FF: ret
ldc.i4 0
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_cfbe10972a2745ad8fc9d28192cad8f7
brfalse IL_000D: switch(IL_01FF,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_01FF,IL_002D)
ret <null>
Module Name
Alpwxb.exe
Full Name
Alpwxb.exe
EntryPoint
System.Void kCZBVdM9mRigFH1U5n.kyGK5XEPZwDfp6V5bT::OXhNrnGdC()
Scope Name
Alpwxb.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Alpwxb
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void kCZBVdM9mRigFH1U5n.kyGK5XEPZwDfp6V5bT::OXhNrnGdC()
Main IL Instruction Count
115
Main IL 
ldc.i4 1
stloc V_6
ldloc V_6
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_6
ldc.i4 989
beq IL_0009: ldloc V_6
br IL_01FF: ret
nop <null>
newobj System.Void iTIwaPlfeCb26HDYbT.koBmjas7ja7H3glcmW::.ctor()
stloc.s V_0
ldc.i4 1
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_2a4be12b649946beaf488daa1bae759c
brtrue IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
pop <null>
ldc.i4 0
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
br IL_0062: ldloc V_4
ldc.i4 0
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_4
ldc.i4 12
beq IL_00E6: newobj System.Void mQUlXybsMDdPoiOjCR.OfEAfGQGWpoLF9GQp1::.ctor()
ldloc V_4
ldc.i4 992
beq IL_0062: ldloc V_4
br IL_0182: newobj System.Void System.InvalidOperationException::.ctor()
newobj System.Void V0w0d4030RjCEJdXN7.sckxnUyDa9PSi5UWsU::.ctor()
stloc.s V_5
ldc.i4 3
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
newobj System.Void OlUWeWSHyG6A00ZJqQ.q6JhDq1L3xgoXAQ2be::.ctor()
stloc.s V_3
ldc.i4 12
br IL_005E: stloc V_4
br IL_0188: leave IL_01FF
ldc.i4 2
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_71b55e4266044cc9b95588420d71ff91
brfalse IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
pop <null>
ldc.i4 7
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
newobj System.Void mQUlXybsMDdPoiOjCR.OfEAfGQGWpoLF9GQp1::.ctor()
dup <null>
dup <null>
ldsfld VbSHQMZqoVsv1QInZMj VbSHQMZqoVsv1QInZMj::GaKZfrBOgk
call System.Void VbSHQMZqoVsv1QInZMj::i8KZNwm3Yd(System.Object,mQUlXybsMDdPoiOjCR.OfEAfGQGWpoLF9GQp1,VbSHQMZqoVsv1QInZMj)
dup <null>
ldloc.s V_3
ldsfld AhdohaZe0wy2NmMgF7u AhdohaZe0wy2NmMgF7u::cFlZXkXaXX
call System.Void AhdohaZe0wy2NmMgF7u::i8KZNwm3Yd(System.Object,OlUWeWSHyG6A00ZJqQ.q6JhDq1L3xgoXAQ2be,AhdohaZe0wy2NmMgF7u)
ldloc.s V_3
ldloc.s V_2
ldsfld IdNLTxZHBvYWjwpT9TL IdNLTxZHBvYWjwpT9TL::UDZZWAeSCI
call System.Void IdNLTxZHBvYWjwpT9TL::i8KZNwm3Yd(System.Object,Aqw3FNBPwY8HViwfIr.bXGK0o8vySZ2tIf3XE,IdNLTxZHBvYWjwpT9TL)
ldloc.s V_2
ldloc.s V_5
ldsfld h9w64FZyZrUA5dUh5sG h9w64FZyZrUA5dUh5sG::NloZ0mqe8c
call System.Void h9w64FZyZrUA5dUh5sG::i8KZNwm3Yd(System.Object,V0w0d4030RjCEJdXN7.sckxnUyDa9PSi5UWsU,h9w64FZyZrUA5dUh5sG)
ldloc.s V_5
ldloc.s V_0
ldsfld AagqTuZgRjtxHOYKNuq AagqTuZgRjtxHOYKNuq::mYsZh71j8C
call System.Void AagqTuZgRjtxHOYKNuq::i8KZNwm3Yd(System.Object,iTIwaPlfeCb26HDYbT.koBmjas7ja7H3glcmW,AagqTuZgRjtxHOYKNuq)
ldsfld imV0urZ3KqvRQejinku imV0urZ3KqvRQejinku::bjEZUTiIgZ
call System.Boolean imV0urZ3KqvRQejinku::i8KZNwm3Yd(System.Object,imV0urZ3KqvRQejinku)
brfalse IL_0182: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 4
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_18f5aa41c07441f69ecae766bcc6e847
brtrue IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
pop <null>
ldc.i4 12
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
newobj System.Void Aqw3FNBPwY8HViwfIr.bXGK0o8vySZ2tIf3XE::.ctor()
stloc.s V_2
ldc.i4 12
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_eae41b7d06e34278a607886f82c07010
brtrue IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
pop <null>
ldc.i4 0
br IL_0066: switch(IL_00B1,IL_00A0,IL_0182,IL_015C,IL_00C2)
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_01FF: ret
pop <null>
ldc.i4 0
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_382d774d755b46c482f10bc21a198c5a
brfalse IL_01BF: switch(IL_01DB)
pop <null>
ldc.i4 4
br IL_01BF: switch(IL_01DB)
br IL_01BB: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 988
beq IL_01BB: ldloc V_1
br IL_01DB: leave IL_01FF
leave IL_01FF: ret
ldc.i4 0
ldsfld <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c} <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_915bd289e02f4540a2913ba3f0d0c570
ldfld System.Int32 <Module>{50f15be5-abb3-49b2-a970-fbc3edc41a8c}::m_cfbe10972a2745ad8fc9d28192cad8f7
brfalse IL_000D: switch(IL_01FF,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_01FF,IL_002D)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙