Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 8 files
EXE3ff8b90ad30e021a442e5d50d7e94382
Structure
Name Value
Module Name
SCptNUOZS4CDxLGV
Full Name
SCptNUOZS4CDxLGV
EntryPoint
System.Void A8jrATxUUjfdT78VOJp.g6HDaPx03H0J8974rot::OkDxxMfUs6(System.String[])
Scope Name
SCptNUOZS4CDxLGV
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
w9bK2YAJSVcHinGF9EqFRIpiQzUQ
Assembly Version
9.2.5.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void A8jrATxUUjfdT78VOJp.g6HDaPx03H0J8974rot::OkDxxMfUs6(System.String[])
Main IL Instruction Count
79
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_003E: ldarg.0
nop <null>
ret <null>
ldarg.0 <null>
ldlen <null>
brfalse IL_0073: ldnull
ldc.i4 1
ldsfld <Module>{25599680-370e-47a9-8922-461869009c9d} <Module>{25599680-370e-47a9-8922-461869009c9d}::m_f0e8f6d559b34681a7c32445300d3d22
ldfld System.Int32 <Module>{25599680-370e-47a9-8922-461869009c9d}::m_c9a0844372df4d7f81fc6b54773faa9a
brtrue IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
pop <null>
ldc.i4 5
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
br IL_0108: ldarg.0
ldc.i4 3
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
ldnull <null>
br IL_010B: ldarg.0
br IL_0108: ldarg.0
call System.Void RBYBHjv1OHMa9yWsMPf.he027gvgkxhUet5u0wW::GQBewRAkY1e()
ldc.i4 1
ldsfld <Module>{25599680-370e-47a9-8922-461869009c9d} <Module>{25599680-370e-47a9-8922-461869009c9d}::m_f0e8f6d559b34681a7c32445300d3d22
ldfld System.Int32 <Module>{25599680-370e-47a9-8922-461869009c9d}::m_c3430974ec2a43da84644282c4eb883c
brfalse IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
nop <null>
newobj System.Void FMVFnlelRMmnvRvFoRY.G1hSfLet1RF324M7P1V::.ctor()
pop <null>
ldc.i4 7
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
ldarg.0 <null>
brfalse IL_0073: ldnull
ldc.i4 0
ldsfld <Module>{25599680-370e-47a9-8922-461869009c9d} <Module>{25599680-370e-47a9-8922-461869009c9d}::m_f0e8f6d559b34681a7c32445300d3d22
ldfld System.Int32 <Module>{25599680-370e-47a9-8922-461869009c9d}::m_1f7a37e972da45228fc3db28eebf74e1
brtrue IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
nop <null>
ldc.i4 -824220155
ldc.i4 -695102222
xor <null>
ldsfld <Module>{25599680-370e-47a9-8922-461869009c9d} <Module>{25599680-370e-47a9-8922-461869009c9d}::m_f0e8f6d559b34681a7c32445300d3d22
ldfld System.Int32 <Module>{25599680-370e-47a9-8922-461869009c9d}::m_2438bc274bf04cfaa4ae9f989939edd1
xor <null>
call System.String lSbrwyEgCkci3sHQqRK.cX7u1EEmfcafJJ1BPdF::y0dE24xJGd(System.Int32)
newobj System.Void MiuaOSNAR9u7xtdP9WK.yqgr2HNq4gZsuP6L1Ru::.ctor(System.String)
call System.Void MiuaOSNAR9u7xtdP9WK.yqgr2HNq4gZsuP6L1Ru::W2eNWH6dZD()
ldc.i4 6
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldarg.0 <null>
brfalse IL_011F: ldnull
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
ble IL_011F: ldnull
br IL_0125: ldarg.0
ldnull <null>
br IL_0128: newobj System.Void NqO1kPYKVkL9mh7cc2a.Wuk16hYkOFOeyhgh7VH::.ctor(System.String,System.String)
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
newobj System.Void NqO1kPYKVkL9mh7cc2a.Wuk16hYkOFOeyhgh7VH::.ctor(System.String,System.String)
call System.Void mZAW1HeJg8ufM6HGsHq.RxoiwtePGkDNuY32gxm::SVtemXKQc8(NqO1kPYKVkL9mh7cc2a.Wuk16hYkOFOeyhgh7VH)
ldc.i4 4
stloc V_0
br IL_000E: ldloc V_0
Module Name
SCptNUOZS4CDxLGV
Full Name
SCptNUOZS4CDxLGV
EntryPoint
System.Void A8jrATxUUjfdT78VOJp.g6HDaPx03H0J8974rot::OkDxxMfUs6(System.String[])
Scope Name
SCptNUOZS4CDxLGV
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
w9bK2YAJSVcHinGF9EqFRIpiQzUQ
Assembly Version
9.2.5.8
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
47
Main Method
System.Void A8jrATxUUjfdT78VOJp.g6HDaPx03H0J8974rot::OkDxxMfUs6(System.String[])
Main IL Instruction Count
79
Main IL 
ldc.i4 2
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_003E: ldarg.0
nop <null>
ret <null>
ldarg.0 <null>
ldlen <null>
brfalse IL_0073: ldnull
ldc.i4 1
ldsfld <Module>{25599680-370e-47a9-8922-461869009c9d} <Module>{25599680-370e-47a9-8922-461869009c9d}::m_f0e8f6d559b34681a7c32445300d3d22
ldfld System.Int32 <Module>{25599680-370e-47a9-8922-461869009c9d}::m_c9a0844372df4d7f81fc6b54773faa9a
brtrue IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
pop <null>
ldc.i4 5
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
br IL_0108: ldarg.0
ldc.i4 3
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
ldnull <null>
br IL_010B: ldarg.0
br IL_0108: ldarg.0
call System.Void RBYBHjv1OHMa9yWsMPf.he027gvgkxhUet5u0wW::GQBewRAkY1e()
ldc.i4 1
ldsfld <Module>{25599680-370e-47a9-8922-461869009c9d} <Module>{25599680-370e-47a9-8922-461869009c9d}::m_f0e8f6d559b34681a7c32445300d3d22
ldfld System.Int32 <Module>{25599680-370e-47a9-8922-461869009c9d}::m_c3430974ec2a43da84644282c4eb883c
brfalse IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
nop <null>
newobj System.Void FMVFnlelRMmnvRvFoRY.G1hSfLet1RF324M7P1V::.ctor()
pop <null>
ldc.i4 7
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
ldarg.0 <null>
brfalse IL_0073: ldnull
ldc.i4 0
ldsfld <Module>{25599680-370e-47a9-8922-461869009c9d} <Module>{25599680-370e-47a9-8922-461869009c9d}::m_f0e8f6d559b34681a7c32445300d3d22
ldfld System.Int32 <Module>{25599680-370e-47a9-8922-461869009c9d}::m_1f7a37e972da45228fc3db28eebf74e1
brtrue IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
nop <null>
ldc.i4 -824220155
ldc.i4 -695102222
xor <null>
ldsfld <Module>{25599680-370e-47a9-8922-461869009c9d} <Module>{25599680-370e-47a9-8922-461869009c9d}::m_f0e8f6d559b34681a7c32445300d3d22
ldfld System.Int32 <Module>{25599680-370e-47a9-8922-461869009c9d}::m_2438bc274bf04cfaa4ae9f989939edd1
xor <null>
call System.String lSbrwyEgCkci3sHQqRK.cX7u1EEmfcafJJ1BPdF::y0dE24xJGd(System.Int32)
newobj System.Void MiuaOSNAR9u7xtdP9WK.yqgr2HNq4gZsuP6L1Ru::.ctor(System.String)
call System.Void MiuaOSNAR9u7xtdP9WK.yqgr2HNq4gZsuP6L1Ru::W2eNWH6dZD()
ldc.i4 6
br IL_0012: switch(IL_003E,IL_00A2,IL_007E,IL_0073,IL_00D8,IL_0064,IL_003C,IL_00B3)
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldarg.0 <null>
brfalse IL_011F: ldnull
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
ble IL_011F: ldnull
br IL_0125: ldarg.0
ldnull <null>
br IL_0128: newobj System.Void NqO1kPYKVkL9mh7cc2a.Wuk16hYkOFOeyhgh7VH::.ctor(System.String,System.String)
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
newobj System.Void NqO1kPYKVkL9mh7cc2a.Wuk16hYkOFOeyhgh7VH::.ctor(System.String,System.String)
call System.Void mZAW1HeJg8ufM6HGsHq.RxoiwtePGkDNuY32gxm::SVtemXKQc8(NqO1kPYKVkL9mh7cc2a.Wuk16hYkOFOeyhgh7VH)
ldc.i4 4
stloc V_0
br IL_000E: ldloc V_0
An error has occurred. This application may no longer respond until reloaded. Reload 🗙