Malicious
Malicious

3e854289e75caa50b05c08f861355ec7

PE Executable
MD5: 3e854289e75caa50b05c08f861355ec7
Size: 823.3 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 3e854289e75caa50b05c08f861355ec7
Sha1 aaa7e50344a84213d44c2e73a8310db2df937a3e
Sha256 d0a7b65b8b2502cd1a4aebf1bfd7d89ab77384ffddedb70fb5613929b6e918fa
Sha384 3b17415af38e05c25d1c20de39d1eb2a6049d69cc60f65a33c94c5908fbc0cd21a477b7465f6c09fb191449c72dafe06
Sha512 55381c8a272251671cbb1856aa55531f5c85699d41bafdacfff2f38ec0876ce23e2426211f6a424f334b0e607a7f345c62ec7b28e38914045a66ffdd25be90e4
SSDeep 12288:VQk26BbcDAfuPlGZo5W1agAMZXaPM7v5BPApFiTK:VQiUIagwKvQFi
TLSH 2705CF6737524E11C2841737C1E7150183B6A98779A7F30F768863962C073FEEA4BAA7
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3e854289e75caa50b05c08f861355ec7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CCRB9NgUe7q4ReuQcV.ayaavvQvRbAGE5QxKe
x31DDeLjAZ1c9fy6Ey.IIp00DR4deOXuiDNlL
a0htwphAc4iH4INkBm.0tCABZYNBVAYwB9og7
4m1W907uTyseKhuINe.7lhju4HiXHkQERAQGp
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Ftlnkeedj.exe
Full Name
Ftlnkeedj.exe
EntryPoint
System.Void kNnaovwiPkDwqksqCH.x1UB6udsZB5OAbtWxc::QmSFcQlRC()
Scope Name
Ftlnkeedj.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ftlnkeedj
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void kNnaovwiPkDwqksqCH.x1UB6udsZB5OAbtWxc::QmSFcQlRC()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0117: ldsfld KEXOVDYJa0fhFBH92CA KEXOVDYJa0fhFBH92CA::eE6YPZtZib
ret <null>
nop <null>
newobj System.Void lbdjMQsnWZ9xcsOALf.h5mOFroScDgxf3mxfP::.ctor()
ldsfld Esgb1DYNOSPqRXveM1i Esgb1DYNOSPqRXveM1i::m68Y10LQ0b
call System.Byte[] Esgb1DYNOSPqRXveM1i::g9SYj3kQau(Esgb1DYNOSPqRXveM1i)
ldsfld SThcKVYaAvuuf0soc31 SThcKVYaAvuuf0soc31::dBWYuHMb0n
call System.Void SThcKVYaAvuuf0soc31::g9SYj3kQau(System.Object,System.Byte[],SThcKVYaAvuuf0soc31)
ldc.i4 0
ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec
ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_97e530388ee343108c04d4098f441930
brfalse IL_0084: switch(IL_00A0)
pop <null>
ldc.i4 1
br IL_0084: switch(IL_00A0)
br IL_0080: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0080: ldloc V_0
br IL_00A0: leave IL_0038
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec
ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_9ac32ab27fd24b4ba886e5421d1f6d27
brtrue IL_00D7: switch(IL_00F3)
pop <null>
ldc.i4 1
br IL_00D7: switch(IL_00F3)
br IL_00D3: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00D3: ldloc V_2
br IL_00F3: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec
ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_d31352d0f1e04369a1653890c9f662fd
brtrue IL_0014: switch(IL_0039,IL_0117,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0039,IL_0117,IL_0038)
ldsfld KEXOVDYJa0fhFBH92CA KEXOVDYJa0fhFBH92CA::eE6YPZtZib
call System.Void KEXOVDYJa0fhFBH92CA::g9SYj3kQau(KEXOVDYJa0fhFBH92CA)
ldc.i4 0
ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec
ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_edffb4002877413383a9fce9c729552e
brfalse IL_0014: switch(IL_0039,IL_0117,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0039,IL_0117,IL_0038)
Module Name
Ftlnkeedj.exe
Full Name
Ftlnkeedj.exe
EntryPoint
System.Void kNnaovwiPkDwqksqCH.x1UB6udsZB5OAbtWxc::QmSFcQlRC()
Scope Name
Ftlnkeedj.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Ftlnkeedj
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void kNnaovwiPkDwqksqCH.x1UB6udsZB5OAbtWxc::QmSFcQlRC()
Main IL Instruction Count
68
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0117: ldsfld KEXOVDYJa0fhFBH92CA KEXOVDYJa0fhFBH92CA::eE6YPZtZib
ret <null>
nop <null>
newobj System.Void lbdjMQsnWZ9xcsOALf.h5mOFroScDgxf3mxfP::.ctor()
ldsfld Esgb1DYNOSPqRXveM1i Esgb1DYNOSPqRXveM1i::m68Y10LQ0b
call System.Byte[] Esgb1DYNOSPqRXveM1i::g9SYj3kQau(Esgb1DYNOSPqRXveM1i)
ldsfld SThcKVYaAvuuf0soc31 SThcKVYaAvuuf0soc31::dBWYuHMb0n
call System.Void SThcKVYaAvuuf0soc31::g9SYj3kQau(System.Object,System.Byte[],SThcKVYaAvuuf0soc31)
ldc.i4 0
ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec
ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_97e530388ee343108c04d4098f441930
brfalse IL_0084: switch(IL_00A0)
pop <null>
ldc.i4 1
br IL_0084: switch(IL_00A0)
br IL_0080: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0080: ldloc V_0
br IL_00A0: leave IL_0038
leave IL_0038: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec
ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_9ac32ab27fd24b4ba886e5421d1f6d27
brtrue IL_00D7: switch(IL_00F3)
pop <null>
ldc.i4 1
br IL_00D7: switch(IL_00F3)
br IL_00D3: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00D3: ldloc V_2
br IL_00F3: leave IL_0038
leave IL_0038: ret
ldc.i4 2
ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec
ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_d31352d0f1e04369a1653890c9f662fd
brtrue IL_0014: switch(IL_0039,IL_0117,IL_0038)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0039,IL_0117,IL_0038)
ldsfld KEXOVDYJa0fhFBH92CA KEXOVDYJa0fhFBH92CA::eE6YPZtZib
call System.Void KEXOVDYJa0fhFBH92CA::g9SYj3kQau(KEXOVDYJa0fhFBH92CA)
ldc.i4 0
ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec
ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_edffb4002877413383a9fce9c729552e
brfalse IL_0014: switch(IL_0039,IL_0117,IL_0038)
pop <null>
ldc.i4 4
br IL_0014: switch(IL_0039,IL_0117,IL_0038)
3e854289e75caa50b05c08f861355ec7
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
CCRB9NgUe7q4ReuQcV.ayaavvQvRbAGE5QxKe
x31DDeLjAZ1c9fy6Ey.IIp00DR4deOXuiDNlL
a0htwphAc4iH4INkBm.0tCABZYNBVAYwB9og7
4m1W907uTyseKhuINe.7lhju4HiXHkQERAQGp
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙