Malicious PE Executable analysis – 42b7e92fa00b

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXE42b7e92fa00b91a383be40b2109eab3b

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Urkzyqay.exe
Full Name	Urkzyqay.exe
EntryPoint	System.Void NG8eJHQLDUN4ScnPTi.oOdHUISBWSF9iCvC2N::MIaryBHDL()
Scope Name	Urkzyqay.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Urkzyqay
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void NG8eJHQLDUN4ScnPTi.oOdHUISBWSF9iCvC2N::MIaryBHDL()
Main IL Instruction Count	87
Main IL	ldc.i4 1 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 989 beq IL_0009: ldloc V_3 br IL_002E: nop ret <null> nop <null> ldsfld v3ZNCFEpo1Q4tadXjas v3ZNCFEpo1Q4tadXjas::wJ8EwK9Qpf call System.Boolean v3ZNCFEpo1Q4tadXjas::mIcER0lNgZ(v3ZNCFEpo1Q4tadXjas) brtrue IL_00B1: leave IL_002D ldc.i4 0 ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_749c2292799a4d3ab0b01ea5dbd3242f brtrue IL_006F: switch(IL_008B) pop <null> ldc.i4 0 br IL_006F: switch(IL_008B) br IL_006B: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_006B: ldloc V_1 br IL_008B: ldc.i4 -1332478415 ldc.i4 -1332478415 ldc.i4 -1477865045 xor <null> ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_80c2a1c64bd34d90bb04aac87184a32e xor <null> ldsfld KXfpxyE1DwvdEjabYlA KXfpxyE1DwvdEjabYlA::MUQEiygOuh call System.String KXfpxyE1DwvdEjabYlA::mIcER0lNgZ(System.Int32,KXfpxyE1DwvdEjabYlA) newobj System.Void System.Exception::.ctor(System.String) throw <null> leave IL_002D: ret stloc.s V_0 ldc.i4 0 ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b99671e5a19a4537a230a483a89da75e brfalse IL_00E9: switch(IL_0109,IL_0168) pop <null> ldc.i4 2 br IL_00E9: switch(IL_0109,IL_0168) br IL_00E5: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_00E5: ldloc V_2 br IL_0109: ldc.i4 -102081613 ldc.i4 -102081613 ldc.i4 -1938406831 xor <null> ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_0c55e3a12c5e4ca1baec79fd1da53585 xor <null> ldsfld KXfpxyE1DwvdEjabYlA KXfpxyE1DwvdEjabYlA::MUQEiygOuh call System.String KXfpxyE1DwvdEjabYlA::mIcER0lNgZ(System.Int32,KXfpxyE1DwvdEjabYlA) ldloc.s V_0 ldsfld efAWPTEz3hTCZxAsIhP efAWPTEz3hTCZxAsIhP::euOLKTF8Qa call System.String efAWPTEz3hTCZxAsIhP::mIcER0lNgZ(System.Object,efAWPTEz3hTCZxAsIhP) ldsfld OeFbdRL4DJeAI4PYS6T OeFbdRL4DJeAI4PYS6T::dKpLXFoLiq call System.String OeFbdRL4DJeAI4PYS6T::mIcER0lNgZ(System.String,System.String,OeFbdRL4DJeAI4PYS6T) ldsfld xZiKI4LykPXNXVohCSe xZiKI4LykPXNXVohCSe::UsVLVZ94DK call System.Void xZiKI4LykPXNXVohCSe::mIcER0lNgZ(System.String,xZiKI4LykPXNXVohCSe) ldc.i4 1 ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_0c55e3a12c5e4ca1baec79fd1da53585 brtrue IL_00E9: switch(IL_0109,IL_0168) pop <null> ldc.i4 7 br IL_00E9: switch(IL_0109,IL_0168) leave IL_002D: ret ldc.i4 0 ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_f4e5ebbd7f7b420ba15f5188d7481bdc brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 4 br IL_000D: switch(IL_002D,IL_002E)
Module Name	Urkzyqay.exe
Full Name	Urkzyqay.exe
EntryPoint	System.Void NG8eJHQLDUN4ScnPTi.oOdHUISBWSF9iCvC2N::MIaryBHDL()
Scope Name	Urkzyqay.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Urkzyqay
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void NG8eJHQLDUN4ScnPTi.oOdHUISBWSF9iCvC2N::MIaryBHDL()
Main IL Instruction Count	87
Main IL	ldc.i4 1 stloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] ldloc V_3 ldc.i4 989 beq IL_0009: ldloc V_3 br IL_002E: nop ret <null> nop <null> ldsfld v3ZNCFEpo1Q4tadXjas v3ZNCFEpo1Q4tadXjas::wJ8EwK9Qpf call System.Boolean v3ZNCFEpo1Q4tadXjas::mIcER0lNgZ(v3ZNCFEpo1Q4tadXjas) brtrue IL_00B1: leave IL_002D ldc.i4 0 ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_749c2292799a4d3ab0b01ea5dbd3242f brtrue IL_006F: switch(IL_008B) pop <null> ldc.i4 0 br IL_006F: switch(IL_008B) br IL_006B: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_006B: ldloc V_1 br IL_008B: ldc.i4 -1332478415 ldc.i4 -1332478415 ldc.i4 -1477865045 xor <null> ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_80c2a1c64bd34d90bb04aac87184a32e xor <null> ldsfld KXfpxyE1DwvdEjabYlA KXfpxyE1DwvdEjabYlA::MUQEiygOuh call System.String KXfpxyE1DwvdEjabYlA::mIcER0lNgZ(System.Int32,KXfpxyE1DwvdEjabYlA) newobj System.Void System.Exception::.ctor(System.String) throw <null> leave IL_002D: ret stloc.s V_0 ldc.i4 0 ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b99671e5a19a4537a230a483a89da75e brfalse IL_00E9: switch(IL_0109,IL_0168) pop <null> ldc.i4 2 br IL_00E9: switch(IL_0109,IL_0168) br IL_00E5: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_00E5: ldloc V_2 br IL_0109: ldc.i4 -102081613 ldc.i4 -102081613 ldc.i4 -1938406831 xor <null> ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_0c55e3a12c5e4ca1baec79fd1da53585 xor <null> ldsfld KXfpxyE1DwvdEjabYlA KXfpxyE1DwvdEjabYlA::MUQEiygOuh call System.String KXfpxyE1DwvdEjabYlA::mIcER0lNgZ(System.Int32,KXfpxyE1DwvdEjabYlA) ldloc.s V_0 ldsfld efAWPTEz3hTCZxAsIhP efAWPTEz3hTCZxAsIhP::euOLKTF8Qa call System.String efAWPTEz3hTCZxAsIhP::mIcER0lNgZ(System.Object,efAWPTEz3hTCZxAsIhP) ldsfld OeFbdRL4DJeAI4PYS6T OeFbdRL4DJeAI4PYS6T::dKpLXFoLiq call System.String OeFbdRL4DJeAI4PYS6T::mIcER0lNgZ(System.String,System.String,OeFbdRL4DJeAI4PYS6T) ldsfld xZiKI4LykPXNXVohCSe xZiKI4LykPXNXVohCSe::UsVLVZ94DK call System.Void xZiKI4LykPXNXVohCSe::mIcER0lNgZ(System.String,xZiKI4LykPXNXVohCSe) ldc.i4 1 ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_0c55e3a12c5e4ca1baec79fd1da53585 brtrue IL_00E9: switch(IL_0109,IL_0168) pop <null> ldc.i4 7 br IL_00E9: switch(IL_0109,IL_0168) leave IL_002D: ret ldc.i4 0 ldsfld <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536} <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_b91883881ec24e31b7c181334d562937 ldfld System.Int32 <Module>{fe3c0fdf-eee2-4b8b-9a5d-1b64e229b536}::m_f4e5ebbd7f7b420ba15f5188d7481bdc brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 4 br IL_000D: switch(IL_002D,IL_002E)