Deep Malware Analysis of 3e854289e75caa50b05c08f861355ec7 | md5: 3e854289e75caa50b05c08f861355ec7 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.91

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	3e854289e75caa50b05c08f861355ec7
Sha1	aaa7e50344a84213d44c2e73a8310db2df937a3e
Sha256	d0a7b65b8b2502cd1a4aebf1bfd7d89ab77384ffddedb70fb5613929b6e918fa
Sha384	3b17415af38e05c25d1c20de39d1eb2a6049d69cc60f65a33c94c5908fbc0cd21a477b7465f6c09fb191449c72dafe06
Sha512	55381c8a272251671cbb1856aa55531f5c85699d41bafdacfff2f38ec0876ce23e2426211f6a424f334b0e607a7f345c62ec7b28e38914045a66ffdd25be90e4
SSDeep	12288:VQk26BbcDAfuPlGZo5W1agAMZXaPM7v5BPApFiTK:VQiUIagwKvQFi
TLSH	2705CF6737524E11C2841737C1E7150183B6A98779A7F30F768863962C073FEEA4BAA7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Ftlnkeedj.exe
Full Name	Ftlnkeedj.exe
EntryPoint	System.Void kNnaovwiPkDwqksqCH.x1UB6udsZB5OAbtWxc::QmSFcQlRC()
Scope Name	Ftlnkeedj.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ftlnkeedj
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void kNnaovwiPkDwqksqCH.x1UB6udsZB5OAbtWxc::QmSFcQlRC()
Main IL Instruction Count	68
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0010: ldloc V_1 br IL_0117: ldsfld KEXOVDYJa0fhFBH92CA KEXOVDYJa0fhFBH92CA::eE6YPZtZib ret <null> nop <null> newobj System.Void lbdjMQsnWZ9xcsOALf.h5mOFroScDgxf3mxfP::.ctor() ldsfld Esgb1DYNOSPqRXveM1i Esgb1DYNOSPqRXveM1i::m68Y10LQ0b call System.Byte[] Esgb1DYNOSPqRXveM1i::g9SYj3kQau(Esgb1DYNOSPqRXveM1i) ldsfld SThcKVYaAvuuf0soc31 SThcKVYaAvuuf0soc31::dBWYuHMb0n call System.Void SThcKVYaAvuuf0soc31::g9SYj3kQau(System.Object,System.Byte[],SThcKVYaAvuuf0soc31) ldc.i4 0 ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_97e530388ee343108c04d4098f441930 brfalse IL_0084: switch(IL_00A0) pop <null> ldc.i4 1 br IL_0084: switch(IL_00A0) br IL_0080: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0080: ldloc V_0 br IL_00A0: leave IL_0038 leave IL_0038: ret pop <null> ldc.i4 0 ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_9ac32ab27fd24b4ba886e5421d1f6d27 brtrue IL_00D7: switch(IL_00F3) pop <null> ldc.i4 1 br IL_00D7: switch(IL_00F3) br IL_00D3: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00D3: ldloc V_2 br IL_00F3: leave IL_0038 leave IL_0038: ret ldc.i4 2 ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_d31352d0f1e04369a1653890c9f662fd brtrue IL_0014: switch(IL_0039,IL_0117,IL_0038) pop <null> ldc.i4 1 br IL_0014: switch(IL_0039,IL_0117,IL_0038) ldsfld KEXOVDYJa0fhFBH92CA KEXOVDYJa0fhFBH92CA::eE6YPZtZib call System.Void KEXOVDYJa0fhFBH92CA::g9SYj3kQau(KEXOVDYJa0fhFBH92CA) ldc.i4 0 ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_edffb4002877413383a9fce9c729552e brfalse IL_0014: switch(IL_0039,IL_0117,IL_0038) pop <null> ldc.i4 4 br IL_0014: switch(IL_0039,IL_0117,IL_0038)
Module Name	Ftlnkeedj.exe
Full Name	Ftlnkeedj.exe
EntryPoint	System.Void kNnaovwiPkDwqksqCH.x1UB6udsZB5OAbtWxc::QmSFcQlRC()
Scope Name	Ftlnkeedj.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ftlnkeedj
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void kNnaovwiPkDwqksqCH.x1UB6udsZB5OAbtWxc::QmSFcQlRC()
Main IL Instruction Count	68
Main IL	br.s IL_0007: ldc.i4 1 call <null> ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 990 beq IL_0010: ldloc V_1 br IL_0117: ldsfld KEXOVDYJa0fhFBH92CA KEXOVDYJa0fhFBH92CA::eE6YPZtZib ret <null> nop <null> newobj System.Void lbdjMQsnWZ9xcsOALf.h5mOFroScDgxf3mxfP::.ctor() ldsfld Esgb1DYNOSPqRXveM1i Esgb1DYNOSPqRXveM1i::m68Y10LQ0b call System.Byte[] Esgb1DYNOSPqRXveM1i::g9SYj3kQau(Esgb1DYNOSPqRXveM1i) ldsfld SThcKVYaAvuuf0soc31 SThcKVYaAvuuf0soc31::dBWYuHMb0n call System.Void SThcKVYaAvuuf0soc31::g9SYj3kQau(System.Object,System.Byte[],SThcKVYaAvuuf0soc31) ldc.i4 0 ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_97e530388ee343108c04d4098f441930 brfalse IL_0084: switch(IL_00A0) pop <null> ldc.i4 1 br IL_0084: switch(IL_00A0) br IL_0080: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0080: ldloc V_0 br IL_00A0: leave IL_0038 leave IL_0038: ret pop <null> ldc.i4 0 ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_9ac32ab27fd24b4ba886e5421d1f6d27 brtrue IL_00D7: switch(IL_00F3) pop <null> ldc.i4 1 br IL_00D7: switch(IL_00F3) br IL_00D3: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00D3: ldloc V_2 br IL_00F3: leave IL_0038 leave IL_0038: ret ldc.i4 2 ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_d31352d0f1e04369a1653890c9f662fd brtrue IL_0014: switch(IL_0039,IL_0117,IL_0038) pop <null> ldc.i4 1 br IL_0014: switch(IL_0039,IL_0117,IL_0038) ldsfld KEXOVDYJa0fhFBH92CA KEXOVDYJa0fhFBH92CA::eE6YPZtZib call System.Void KEXOVDYJa0fhFBH92CA::g9SYj3kQau(KEXOVDYJa0fhFBH92CA) ldc.i4 0 ldsfld <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013} <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_0d214a2ec58247cda1564a0405851eec ldfld System.Int32 <Module>{3344b8b9-df5a-4726-b78b-7e806f11d013}::m_edffb4002877413383a9fce9c729552e brfalse IL_0014: switch(IL_0039,IL_0117,IL_0038) pop <null> ldc.i4 4 br IL_0014: switch(IL_0039,IL_0117,IL_0038)