Malicious PE Executable analysis – 383a693238e2

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Size

637.44 KB · 637,440 B

First seen

2026-05-13 14:46 · 5 months ago

Last seen

2026-05-13 14:46 · 5 months ago

Last analysis

2026-05-13 14:46 · 5 months ago

Hashes

MD5 34f60b8851d8b921ec0c34ea44216309 Sha1 fb97da5a227bf99638366b7ac123c4e72b8c8e65 Sha256 383a693238e270a870386c253423acc54038ac1715f881c940c04ec2229b9c94 Sha384 45beeca8a8c143005e274c5280f2068c991bb28f414c78cb88d3ae1a48dd5cb931be233c7d4893546c62ea1c1e10b772 Sha512 3d94578eb4d61dc9d1fdde9aa33e77fffc2135998c7866ba83046da55ab3c62778d0773c854f1834880be106f6be1ae34267a25513fa431a6fe1448a8f9f0333 SSDeep 12288:68lg68R4z4lV4EgEea3FB8lNECu28UaZRK:68yR4CJeawfECu2f TLSH 19D49E67B2574E21D2C89F33D08B890093B46A86B597F31E758523A6150A3FFDF062E7

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXE34f60b8851d8b921ec0c34ea44216309

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Wahxyzfvjlm.exe
Full Name	Wahxyzfvjlm.exe
EntryPoint	System.Void r5wtUZfZ8i2Nqn7o3R.sYIvKF6k2AimjOFfed::qFq1pNPCD()
Scope Name	Wahxyzfvjlm.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Wahxyzfvjlm
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void r5wtUZfZ8i2Nqn7o3R.sYIvKF6k2AimjOFfed::qFq1pNPCD()
Main IL Instruction Count	55
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_002D: ret ret <null> nop <null> ldsfld At3e4ukCN6Bh9Ta7lgA At3e4ukCN6Bh9Ta7lgA::BRWk5phWt7 call System.Boolean At3e4ukCN6Bh9Ta7lgA::BpkkgyX6i9(At3e4ukCN6Bh9Ta7lgA) pop <null> ldc.i4 6 ldsfld <Module>{58df1657-ede8-424d-a5dd-53892fdec814} <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_20f96225e26047368a39d0c9623a5dfb ldfld System.Int32 <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_1cb09fb9a86e47408a299f141b36ece0 brfalse IL_006B: switch(IL_0087) pop <null> ldc.i4 0 br IL_006B: switch(IL_0087) br IL_0067: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0067: ldloc V_0 br IL_0087: leave IL_002D leave IL_002D: ret pop <null> ldc.i4 0 ldsfld <Module>{58df1657-ede8-424d-a5dd-53892fdec814} <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_20f96225e26047368a39d0c9623a5dfb ldfld System.Int32 <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_4f520e2a4c484301ac579e372ea2941f brfalse IL_00BE: switch(IL_00DA) pop <null> ldc.i4 6 br IL_00BE: switch(IL_00DA) br IL_00BA: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00BA: ldloc V_2 br IL_00DA: leave IL_002D leave IL_002D: ret ldc.i4 1 ldsfld <Module>{58df1657-ede8-424d-a5dd-53892fdec814} <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_20f96225e26047368a39d0c9623a5dfb ldfld System.Int32 <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_d08d1826fd054273912ef45ce68dc148 brfalse IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)
Module Name	Wahxyzfvjlm.exe
Full Name	Wahxyzfvjlm.exe
EntryPoint	System.Void r5wtUZfZ8i2Nqn7o3R.sYIvKF6k2AimjOFfed::qFq1pNPCD()
Scope Name	Wahxyzfvjlm.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Wahxyzfvjlm
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void r5wtUZfZ8i2Nqn7o3R.sYIvKF6k2AimjOFfed::qFq1pNPCD()
Main IL Instruction Count	55
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_002D: ret ret <null> nop <null> ldsfld At3e4ukCN6Bh9Ta7lgA At3e4ukCN6Bh9Ta7lgA::BRWk5phWt7 call System.Boolean At3e4ukCN6Bh9Ta7lgA::BpkkgyX6i9(At3e4ukCN6Bh9Ta7lgA) pop <null> ldc.i4 6 ldsfld <Module>{58df1657-ede8-424d-a5dd-53892fdec814} <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_20f96225e26047368a39d0c9623a5dfb ldfld System.Int32 <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_1cb09fb9a86e47408a299f141b36ece0 brfalse IL_006B: switch(IL_0087) pop <null> ldc.i4 0 br IL_006B: switch(IL_0087) br IL_0067: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0067: ldloc V_0 br IL_0087: leave IL_002D leave IL_002D: ret pop <null> ldc.i4 0 ldsfld <Module>{58df1657-ede8-424d-a5dd-53892fdec814} <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_20f96225e26047368a39d0c9623a5dfb ldfld System.Int32 <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_4f520e2a4c484301ac579e372ea2941f brfalse IL_00BE: switch(IL_00DA) pop <null> ldc.i4 6 br IL_00BE: switch(IL_00DA) br IL_00BA: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00BA: ldloc V_2 br IL_00DA: leave IL_002D leave IL_002D: ret ldc.i4 1 ldsfld <Module>{58df1657-ede8-424d-a5dd-53892fdec814} <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_20f96225e26047368a39d0c9623a5dfb ldfld System.Int32 <Module>{58df1657-ede8-424d-a5dd-53892fdec814}::m_d08d1826fd054273912ef45ce68dc148 brfalse IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)