Deep Malware Analysis of 41056d5e211891780d2fbcff63d7a82f | md5: 41056d5e211891780d2fbcff63d7a82f | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.33

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Low

11 files

EXE41056d5e211891780d2fbcff63d7a82f

Structure

BINResources

BIN.Net Resources

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	eft_9876.exe
Full Name	eft_9876.exe
EntryPoint	System.Void Ogtpf.Cqwhbk::Main()
Scope Name	eft_9876.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	eft_9876
Assembly Version	1.0.1738.15990
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	82
Main Method	System.Void Ogtpf.Cqwhbk::Main()
Main IL Instruction Count	59
Main IL	nop <null> ldc.i4 4032 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) nop <null> ldstr 1.4.1 newobj System.Void System.Version::.ctor(System.String) stloc.0 <null> ldnull <null> ldloc.0 <null> newobj System.Void Ogtpf.Dbrku::.ctor(System.String,System.Version) stloc.1 <null> newobj System.Void Ogtpf.Zqxsl::.ctor() stloc.2 <null> newobj System.Void Ogtpf.Svytppg::.ctor() stloc.3 <null> newobj System.Void Ogtpf.Nrbsochrn::.ctor() stloc.s V_4 ldloc.2 <null> ldloc.3 <null> ldloc.s V_4 newobj System.Void Ogtpf.Xxfkryvo::.ctor(Ogtpf.Zqxsl,Ogtpf.Svytppg,Ogtpf.Nrbsochrn) stloc.s V_5 nop <null> ldloc.1 <null> ldloc.s V_5 ldftn System.Void Ogtpf.Xxfkryvo::Kywnuhlrpr(System.Object,Ogtpf.Vkfcxolz) newobj System.Void System.EventHandler`1<Ogtpf.Vkfcxolz>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ogtpf.Dbrku::add_DownloadCompleted(System.EventHandler`1<Ogtpf.Vkfcxolz>) nop <null> ldloc.2 <null> ldloc.s V_5 ldftn System.Void Ogtpf.Xxfkryvo::Lyfpgd(System.Object,Ogtpf.Vjnpiysvlp) newobj System.Void System.EventHandler`1<Ogtpf.Vjnpiysvlp>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ogtpf.Zqxsl::add_DecryptionCompleted(System.EventHandler`1<Ogtpf.Vjnpiysvlp>) nop <null> ldloc.3 <null> ldloc.s V_5 ldftn System.Void Ogtpf.Xxfkryvo::Ylabadb(System.Object,Ogtpf.Wyyzsjgrueh) newobj System.Void System.EventHandler`1<Ogtpf.Wyyzsjgrueh>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ogtpf.Svytppg::add_LoadCompleted(System.EventHandler`1<Ogtpf.Wyyzsjgrueh>) nop <null> ldloc.s V_4 ldloc.s V_5 ldftn System.Void Ogtpf.Xxfkryvo::Wtnavnme(System.Object,Ogtpf.Tlzcdbqrxa) newobj System.Void System.EventHandler`1<Ogtpf.Tlzcdbqrxa>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ogtpf.Nrbsochrn::add_InvocationCompleted(System.EventHandler`1<Ogtpf.Tlzcdbqrxa>) nop <null> ldloc.1 <null> callvirt System.Void Ogtpf.Dbrku::Kfpynf() nop <null> nop <null> leave IL_00AC: ret ldloc.s V_5 brfalse IL_00AB: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>
Module Name	eft_9876.exe
Full Name	eft_9876.exe
EntryPoint	System.Void Ogtpf.Cqwhbk::Main()
Scope Name	eft_9876.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	eft_9876
Assembly Version	1.0.1738.15990
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	82
Main Method	System.Void Ogtpf.Cqwhbk::Main()
Main IL Instruction Count	59
Main IL	nop <null> ldc.i4 4032 call System.Void System.Net.ServicePointManager::set_SecurityProtocol(System.Net.SecurityProtocolType) nop <null> ldstr 1.4.1 newobj System.Void System.Version::.ctor(System.String) stloc.0 <null> ldnull <null> ldloc.0 <null> newobj System.Void Ogtpf.Dbrku::.ctor(System.String,System.Version) stloc.1 <null> newobj System.Void Ogtpf.Zqxsl::.ctor() stloc.2 <null> newobj System.Void Ogtpf.Svytppg::.ctor() stloc.3 <null> newobj System.Void Ogtpf.Nrbsochrn::.ctor() stloc.s V_4 ldloc.2 <null> ldloc.3 <null> ldloc.s V_4 newobj System.Void Ogtpf.Xxfkryvo::.ctor(Ogtpf.Zqxsl,Ogtpf.Svytppg,Ogtpf.Nrbsochrn) stloc.s V_5 nop <null> ldloc.1 <null> ldloc.s V_5 ldftn System.Void Ogtpf.Xxfkryvo::Kywnuhlrpr(System.Object,Ogtpf.Vkfcxolz) newobj System.Void System.EventHandler`1<Ogtpf.Vkfcxolz>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ogtpf.Dbrku::add_DownloadCompleted(System.EventHandler`1<Ogtpf.Vkfcxolz>) nop <null> ldloc.2 <null> ldloc.s V_5 ldftn System.Void Ogtpf.Xxfkryvo::Lyfpgd(System.Object,Ogtpf.Vjnpiysvlp) newobj System.Void System.EventHandler`1<Ogtpf.Vjnpiysvlp>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ogtpf.Zqxsl::add_DecryptionCompleted(System.EventHandler`1<Ogtpf.Vjnpiysvlp>) nop <null> ldloc.3 <null> ldloc.s V_5 ldftn System.Void Ogtpf.Xxfkryvo::Ylabadb(System.Object,Ogtpf.Wyyzsjgrueh) newobj System.Void System.EventHandler`1<Ogtpf.Wyyzsjgrueh>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ogtpf.Svytppg::add_LoadCompleted(System.EventHandler`1<Ogtpf.Wyyzsjgrueh>) nop <null> ldloc.s V_4 ldloc.s V_5 ldftn System.Void Ogtpf.Xxfkryvo::Wtnavnme(System.Object,Ogtpf.Tlzcdbqrxa) newobj System.Void System.EventHandler`1<Ogtpf.Tlzcdbqrxa>::.ctor(System.Object,System.IntPtr) callvirt System.Void Ogtpf.Nrbsochrn::add_InvocationCompleted(System.EventHandler`1<Ogtpf.Tlzcdbqrxa>) nop <null> ldloc.1 <null> callvirt System.Void Ogtpf.Dbrku::Kfpynf() nop <null> nop <null> leave IL_00AC: ret ldloc.s V_5 brfalse IL_00AB: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() nop <null> endfinally <null> ret <null>