Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 9 files
EXE3bb5d4847035cd4ce5deb600919588cf
Structure
Name Value
Module Name
Zassfreuhds.exe
Full Name
Zassfreuhds.exe
EntryPoint
System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::pRIgTjq8C()
Scope Name
Zassfreuhds.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zassfreuhds
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::pRIgTjq8C()
Main IL Instruction Count
112
Main IL 
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0009: ldloc V_0
br IL_01F3: ret
nop <null>
nop <null>
ldsfld System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF> iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/<>O::FwrfSBE95
dup <null>
brtrue IL_00F0: call System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::B96dO9Oxm(System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF>)
pop <null>
ldc.i4 1
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_46422e34af4b45809dfc5486d016fc77
brfalse IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
pop <null>
ldc.i4 6
br IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
br IL_0068: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 10
beq IL_00FF: leave IL_01F3
ldloc V_1
ldc.i4 990
beq IL_0068: ldloc V_1
br IL_009E: ldc.i4.0
ldc.i4.0 <null>
stsfld System.Int32 iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::c6cTrGuMG
ldc.i4 2
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_d299bbf3aca842238ba69baec65d3dea
brtrue IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
pop <null>
ldc.i4 0
br IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
ldsfld System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF> iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::agQ90gWsa
ldnull <null>
ldc.i4.0 <null>
newobj System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF::.ctor(System.Int32)
callvirt System.Void System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF>::Invoke(System.Object,iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF)
ldc.i4 10
br IL_0064: stloc V_1
ldnull <null>
ldftn System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::MsXKfsAyU(System.Object,System.Object)
newobj System.Void System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF> iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/<>O::FwrfSBE95
call System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::B96dO9Oxm(System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF>)
ldc.i4 2
br IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
leave IL_01F3: ret
pop <null>
ldc.i4 2
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_a0192b1ca177438297c0ba8e6d6815da
brtrue IL_0136: switch(IL_0152)
pop <null>
ldc.i4 0
br IL_0136: switch(IL_0152)
br IL_0132: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0132: ldloc V_3
br IL_0152: leave IL_01F3
leave IL_01F3: ret
ldnull <null>
stsfld System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF> iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::agQ90gWsa
ldc.i4 1
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_14d745ebb55b45e7ae43327318548453
brtrue IL_018E: switch(IL_01AE,IL_01D3)
pop <null>
ldc.i4 0
br IL_018E: switch(IL_01AE,IL_01D3)
br IL_018A: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_018A: ldloc V_2
br IL_01AE: ldnull
ldnull <null>
stsfld System.Object iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::STEiLk6Vo
ldc.i4 1
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_de301e9c5db94dd7894398a04b415068
brfalse IL_018E: switch(IL_01AE,IL_01D3)
pop <null>
ldc.i4 5
br IL_018E: switch(IL_01AE,IL_01D3)
endfinally <null>
ldc.i4 0
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_87dae40b3cdb4512a95968b82963d29b
brtrue IL_000D: switch(IL_01F3,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_01F3,IL_002D)
ret <null>
Module Name
Zassfreuhds.exe
Full Name
Zassfreuhds.exe
EntryPoint
System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::pRIgTjq8C()
Scope Name
Zassfreuhds.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Zassfreuhds
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::pRIgTjq8C()
Main IL Instruction Count
112
Main IL 
ldc.i4 1
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0009: ldloc V_0
br IL_01F3: ret
nop <null>
nop <null>
ldsfld System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF> iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/<>O::FwrfSBE95
dup <null>
brtrue IL_00F0: call System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::B96dO9Oxm(System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF>)
pop <null>
ldc.i4 1
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_46422e34af4b45809dfc5486d016fc77
brfalse IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
pop <null>
ldc.i4 6
br IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
br IL_0068: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 10
beq IL_00FF: leave IL_01F3
ldloc V_1
ldc.i4 990
beq IL_0068: ldloc V_1
br IL_009E: ldc.i4.0
ldc.i4.0 <null>
stsfld System.Int32 iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::c6cTrGuMG
ldc.i4 2
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_d299bbf3aca842238ba69baec65d3dea
brtrue IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
pop <null>
ldc.i4 0
br IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
ldsfld System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF> iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::agQ90gWsa
ldnull <null>
ldc.i4.0 <null>
newobj System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF::.ctor(System.Int32)
callvirt System.Void System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF>::Invoke(System.Object,iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF)
ldc.i4 10
br IL_0064: stloc V_1
ldnull <null>
ldftn System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::MsXKfsAyU(System.Object,System.Object)
newobj System.Void System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF> iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/<>O::FwrfSBE95
call System.Void iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::B96dO9Oxm(System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF>)
ldc.i4 2
br IL_006C: switch(IL_00C3,IL_00DE,IL_009E)
leave IL_01F3: ret
pop <null>
ldc.i4 2
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_a0192b1ca177438297c0ba8e6d6815da
brtrue IL_0136: switch(IL_0152)
pop <null>
ldc.i4 0
br IL_0136: switch(IL_0152)
br IL_0132: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0132: ldloc V_3
br IL_0152: leave IL_01F3
leave IL_01F3: ret
ldnull <null>
stsfld System.EventHandler`1<iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6/Iankmj8rSg2IEhR2LF> iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::agQ90gWsa
ldc.i4 1
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_14d745ebb55b45e7ae43327318548453
brtrue IL_018E: switch(IL_01AE,IL_01D3)
pop <null>
ldc.i4 0
br IL_018E: switch(IL_01AE,IL_01D3)
br IL_018A: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_018A: ldloc V_2
br IL_01AE: ldnull
ldnull <null>
stsfld System.Object iwMFoGvyexMWhy4mAs.WVWTZI4WtnWHI4iLd6::STEiLk6Vo
ldc.i4 1
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_de301e9c5db94dd7894398a04b415068
brfalse IL_018E: switch(IL_01AE,IL_01D3)
pop <null>
ldc.i4 5
br IL_018E: switch(IL_01AE,IL_01D3)
endfinally <null>
ldc.i4 0
ldsfld <Module>{4578c009-b563-4f91-b336-c08b90b15b01} <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_11a8edfd0ac6491ea11b9c7b49da2b03
ldfld System.Int32 <Module>{4578c009-b563-4f91-b336-c08b90b15b01}::m_87dae40b3cdb4512a95968b82963d29b
brtrue IL_000D: switch(IL_01F3,IL_002D)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_01F3,IL_002D)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙