Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 2 files
EXE3e3587643b6f93cc8143efd4ef527705
Structure
Name Value
Module Name
BF32FB64-1EF9-4ABF-8806-8B182B7929D4.exe
Full Name
BF32FB64-1EF9-4ABF-8806-8B182B7929D4.exe
EntryPoint
System.Void Program::Main(System.String[])
Scope Name
BF32FB64-1EF9-4ABF-8806-8B182B7929D4.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
BF32FB64-1EF9-4ABF-8806-8B182B7929D4
Assembly Version
1.2.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
52
Main Method
System.Void Program::Main(System.String[])
Main IL Instruction Count
90
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
br IL_0015: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_002F: ret
ret <null>
nop <null>
ldloc.s V_5
brtrue IL_0099: ldarg.0
ldc.i4 1
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_529a00fbbfc34004b6ec41451a559947
brtrue IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
pop <null>
ldc.i4 1
br IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0099: ldarg.0
leave IL_002F: ret
ldc.i4 0
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_1f79cef8d1524743adf857d9c22c06ea
brtrue IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
pop <null>
ldc.i4 0
br IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
ldarg.0 <null>
call System.Threading.Tasks.Task Program::RunAsync(System.Object)
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.s V_2
ldc.i4 3
br IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
ldloca.s V_2
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ldc.i4 2
br IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
leave IL_002F: ret
ldloc.s V_4
brfalse IL_0128: endfinally
ldc.i4 1
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_5e69d7e582c04929b5117609860f86dd
brfalse IL_00F0: switch(IL_0128,IL_0102)
pop <null>
ldc.i4 0
br IL_00F0: switch(IL_0128,IL_0102)
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0128: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_665b75f75d10410b8580d46f50a25ebb
brtrue IL_00F0: switch(IL_0128,IL_0102)
pop <null>
ldc.i4 0
br IL_00F0: switch(IL_0128,IL_0102)
endfinally <null>
ldc.i4 0
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_eabbbec656254d9ab80cfd6bac4e7291
brtrue IL_0019: switch(IL_002F,IL_0030,IL_0148)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_002F,IL_0030,IL_0148)
ldc.i4.1 <null>
ldc.i4 205731486
ldc.i4 1454784333
xor <null>
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_9243de46a1734ad2961d26fc6464be4a
xor <null>
call System.String mjldbepFpfgR2sirhk.Kusbq8F7xd8hvTfPmi::grulUC7Fy(System.Int32)
ldsfld System.String Client.Settings::PASSWORD
call System.String Core.Encryption.HASHS::Decrypt(System.Object,System.Object)
ldloca.s V_5
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_4
ldc.i4 1
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_ab2d93f00d5e455c9dc0333e4760188f
brtrue IL_0019: switch(IL_002F,IL_0030,IL_0148)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_002F,IL_0030,IL_0148)
Module Name
BF32FB64-1EF9-4ABF-8806-8B182B7929D4.exe
Full Name
BF32FB64-1EF9-4ABF-8806-8B182B7929D4.exe
EntryPoint
System.Void Program::Main(System.String[])
Scope Name
BF32FB64-1EF9-4ABF-8806-8B182B7929D4.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
BF32FB64-1EF9-4ABF-8806-8B182B7929D4
Assembly Version
1.2.4.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
52
Main Method
System.Void Program::Main(System.String[])
Main IL Instruction Count
90
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_3
br IL_0015: ldloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
br IL_002F: ret
ret <null>
nop <null>
ldloc.s V_5
brtrue IL_0099: ldarg.0
ldc.i4 1
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_529a00fbbfc34004b6ec41451a559947
brtrue IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
pop <null>
ldc.i4 1
br IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0099: ldarg.0
leave IL_002F: ret
ldc.i4 0
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_1f79cef8d1524743adf857d9c22c06ea
brtrue IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
pop <null>
ldc.i4 0
br IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
ldarg.0 <null>
call System.Threading.Tasks.Task Program::RunAsync(System.Object)
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.s V_2
ldc.i4 3
br IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
ldloca.s V_2
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ldc.i4 2
br IL_005B: switch(IL_0099,IL_0075,IL_00C1,IL_00B0)
leave IL_002F: ret
ldloc.s V_4
brfalse IL_0128: endfinally
ldc.i4 1
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_5e69d7e582c04929b5117609860f86dd
brfalse IL_00F0: switch(IL_0128,IL_0102)
pop <null>
ldc.i4 0
br IL_00F0: switch(IL_0128,IL_0102)
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0128: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
ldc.i4 0
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_665b75f75d10410b8580d46f50a25ebb
brtrue IL_00F0: switch(IL_0128,IL_0102)
pop <null>
ldc.i4 0
br IL_00F0: switch(IL_0128,IL_0102)
endfinally <null>
ldc.i4 0
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_eabbbec656254d9ab80cfd6bac4e7291
brtrue IL_0019: switch(IL_002F,IL_0030,IL_0148)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_002F,IL_0030,IL_0148)
ldc.i4.1 <null>
ldc.i4 205731486
ldc.i4 1454784333
xor <null>
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_9243de46a1734ad2961d26fc6464be4a
xor <null>
call System.String mjldbepFpfgR2sirhk.Kusbq8F7xd8hvTfPmi::grulUC7Fy(System.Int32)
ldsfld System.String Client.Settings::PASSWORD
call System.String Core.Encryption.HASHS::Decrypt(System.Object,System.Object)
ldloca.s V_5
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.s V_4
ldc.i4 1
ldsfld <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf} <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_7bab3369a78f4734ae779364905567b9
ldfld System.Int32 <Module>{d4b45e57-9eaf-4c04-83ec-8ab180241acf}::m_ab2d93f00d5e455c9dc0333e4760188f
brtrue IL_0019: switch(IL_002F,IL_0030,IL_0148)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_002F,IL_0030,IL_0148)
Embedded Resources UNKNWOWNsuspect
7huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙