Deep Malware Analysis of 408088b186386bb92b4e1732fb48b852 | md5: 408088b186386bb92b4e1732fb48b852 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.39

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Medium

3 files

EXE408088b186386bb92b4e1732fb48b852

Structure

BINResources

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Cliente_misarchivos12_duckdns_org_3026.exe
Full Name	Cliente_misarchivos12_duckdns_org_3026.exe
EntryPoint	System.Void NVnGCUW.CIvEdUh::Main(System.String[])
Scope Name	Cliente_misarchivos12_duckdns_org_3026.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Cliente_misarchivos12_duckdns_org_3026
Assembly Version	3.8.2964.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	1581
Main Method	System.Void NVnGCUW.CIvEdUh::Main(System.String[])
Main IL Instruction Count	61
Main IL	call System.Boolean NVnGCUW.CIvEdUh::SetProcessDPIAware() pop <null> leave.s IL_000B: ldc.i4 4080 pop <null> leave.s IL_000B: ldc.i4 4080 ldc.i4 4080 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) leave.s IL_001A: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee pop <null> leave.s IL_001A: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee brtrue.s IL_0032: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldnull <null> ldftn System.Boolean NVnGCUW.CIvEdUh::<Main>b__d(System.Object,System.Security.Cryptography.X509Certificates.X509Certificate,System.Security.Cryptography.X509Certificates.X509Chain,System.Net.Security.SslPolicyErrors) newobj System.Void System.Net.Security.RemoteCertificateValidationCallback::.ctor(System.Object,System.IntPtr) stsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee call System.Void System.Net.ServicePointManager::set_ServerCertificateValidationCallback(System.Net.Security.RemoteCertificateValidationCallback) leave.s IL_0041: ldc.i4.0 pop <null> leave.s IL_0041: ldc.i4.0 ldc.i4.0 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) leave.s IL_004C: ldc.i4.s 100 pop <null> leave.s IL_004C: ldc.i4.s 100 ldc.i4.s 100 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) leave.s IL_0058: ldnull pop <null> leave.s IL_0058: ldnull ldnull <null> call System.Void NVnGCUW.CIvEdUh::StartKeylogger(System.Net.Sockets.NetworkStream) ldarg.0 <null> brfalse.s IL_0076: ldc.i4.0 ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.0 <null> ble.s IL_0076: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --elevated call System.Boolean System.String::op_Equality(System.String,System.String) br.s IL_0077: stloc.0 ldc.i4.0 <null> stloc.0 <null> ldloc.0 <null> brtrue.s IL_0080: leave.s IL_0085 call System.Void NVnGCUW.CIvEdUh::UzFdfKe() leave.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj() pop <null> leave.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj() call System.Void NVnGCUW.CIvEdUh::MvSuBnj() leave.s IL_008F: ldc.i4 5135 pop <null> leave.s IL_008F: ldc.i4 5135 ldc.i4 5135 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj()
Module Name	Cliente_misarchivos12_duckdns_org_3026.exe
Full Name	Cliente_misarchivos12_duckdns_org_3026.exe
EntryPoint	System.Void NVnGCUW.CIvEdUh::Main(System.String[])
Scope Name	Cliente_misarchivos12_duckdns_org_3026.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Cliente_misarchivos12_duckdns_org_3026
Assembly Version	3.8.2964.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	1581
Main Method	System.Void NVnGCUW.CIvEdUh::Main(System.String[])
Main IL Instruction Count	61
Main IL	call System.Boolean NVnGCUW.CIvEdUh::SetProcessDPIAware() pop <null> leave.s IL_000B: ldc.i4 4080 pop <null> leave.s IL_000B: ldc.i4 4080 ldc.i4 4080 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) leave.s IL_001A: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee pop <null> leave.s IL_001A: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee brtrue.s IL_0032: ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldnull <null> ldftn System.Boolean NVnGCUW.CIvEdUh::<Main>b__d(System.Object,System.Security.Cryptography.X509Certificates.X509Certificate,System.Security.Cryptography.X509Certificates.X509Chain,System.Net.Security.SslPolicyErrors) newobj System.Void System.Net.Security.RemoteCertificateValidationCallback::.ctor(System.Object,System.IntPtr) stsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee ldsfld System.Net.Security.RemoteCertificateValidationCallback NVnGCUW.CIvEdUh::CS$<>9__CachedAnonymousMethodDelegatee call System.Void System.Net.ServicePointManager::set_ServerCertificateValidationCallback(System.Net.Security.RemoteCertificateValidationCallback) leave.s IL_0041: ldc.i4.0 pop <null> leave.s IL_0041: ldc.i4.0 ldc.i4.0 <null> call System.Void System.Net.ServicePointManager::set_Expect100Continue(System.Boolean) leave.s IL_004C: ldc.i4.s 100 pop <null> leave.s IL_004C: ldc.i4.s 100 ldc.i4.s 100 call System.Void System.Net.ServicePointManager::set_DefaultConnectionLimit(System.Int32) leave.s IL_0058: ldnull pop <null> leave.s IL_0058: ldnull ldnull <null> call System.Void NVnGCUW.CIvEdUh::StartKeylogger(System.Net.Sockets.NetworkStream) ldarg.0 <null> brfalse.s IL_0076: ldc.i4.0 ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.0 <null> ble.s IL_0076: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --elevated call System.Boolean System.String::op_Equality(System.String,System.String) br.s IL_0077: stloc.0 ldc.i4.0 <null> stloc.0 <null> ldloc.0 <null> brtrue.s IL_0080: leave.s IL_0085 call System.Void NVnGCUW.CIvEdUh::UzFdfKe() leave.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj() pop <null> leave.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj() call System.Void NVnGCUW.CIvEdUh::MvSuBnj() leave.s IL_008F: ldc.i4 5135 pop <null> leave.s IL_008F: ldc.i4 5135 ldc.i4 5135 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0085: call System.Void NVnGCUW.CIvEdUh::MvSuBnj()