Suspicious
Suspect

PE Executable
MD5: 4c5af2a9fdea7bd68955f0487b5d8d52
Size: 612.35 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 4c5af2a9fdea7bd68955f0487b5d8d52
Sha1 02b84a29ce3309d1a580291dfe21de2efb36721e
Sha256 b4a588d319d2f3789e66c4f1fec6ff9ad7aacd6e5cce69de76d648a424a4df2a
Sha384 d7a3d41d4aaf59d8ecfbb2e302a5a3e930dafb9b6aa3caad24680e54b6a540cc84875a72291dfaae1c253fc422dcd833
Sha512 32ea98789f364ab26f0187b9236d4ed0b727baaa1c9aa49b9eb46b47d95857dd9e15eb212fbc842737a50e8245dc25bfba5e033ca9618fb553b1df1ba1403a3a
SSDeep 12288:JTaebGf2X56DtozYgSpU5b7L9ig4GGdRoXA3GzuKp6:JTa86DtozYg5BR8RVWT6
TLSH E3D4BE211F861F9AE6AE4BB8C052185877F0D453E3D3DB276FEC44F92AA7F84CA46441
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
29 items
  • 4c5af2a9fdea7bd68955f0487b5d8d52SOS: 0.84
    • Structure
      • DosHeader
      • PE Header
      • Optional Header (x86)
      • Section Headers
        • .text
        • .rsrc
        • .reloc
    • Resources
      • RT_VERSION
        • ID:0001
          • ID:0
    • .Net Resources
      • Pedicarela.telaiqox.ref
      • 2Pjfod0LKgs1.Resources.resources
      • 7b93c114938895.Resources.resources
        • b219f9190
          • [NBF]root.Data
        • b219f9191
          • [NBF]root.Data
        • b219f9192
          • [NBF]root.Data
        • b219f9193
          • [NBF]root.Data
        • b219f9194
          • [NBF]root.Data
        • b219f9195
          • [NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
2Pjfod0LKgs1
Full Name
2Pjfod0LKgs1
EntryPoint
System.Void Zwd96jAp.5JziE::Wy1f6()
Scope Name
2Pjfod0LKgs1
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
2Pjfod0LKgs1
Assembly Version
24.7.7.156
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Zwd96jAp.5JziE::Wy1f6()
Main IL Instruction Count
330
Main IL 
ldsfld System.Char[] 0irHsoD8p.9nxLdYg1W4qaf::0Podpd5FG4snw_
stloc.s V_26
ldc.i4.4 <null>
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.r8 1
stloc.0 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.String System.Windows.Forms.Application::get_StartupPath()
nop <null>
ldc.i4 745548343
ldc.i4.7 <null>
ldnull <null>
ldnull <null>
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi::aTo9M0bqwZb(System.Int32,System.Int32,rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi,System.String)
call System.String System.String::Concat(System.String,System.String)
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_21
br.s IL_000A: ldloc.s V_21
ldloca.s V_2
initobj System.Int16
br.s IL_0065: br.s IL_0067
br.s IL_0067: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00A7: nop
nop <null>
nop <null>
ldc.i4 745548355
ldc.i4.1 <null>
ldnull <null>
ldnull <null>
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi::aTo9M0bqwZb(System.Int32,System.Int32,rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi,System.String)
stloc.3 <null>
ldloc.3 <null>
stloc.s V_4
ldc.i4.s 11
stloc.s V_23
br.s IL_006A: ldloc.s V_23
ldc.i4.1 <null>
stloc.s V_12
ldc.i4.3 <null>
stloc.s V_23
br.s IL_006A: ldloc.s V_23
ldloc.s V_4
call System.Collections.Generic.IEnumerable`1<System.Char> System.Linq.Enumerable::Reverse<System.Char>(System.Collections.Generic.IEnumerable`1<System.Char>)
call System.Char[] System.Linq.Enumerable::ToArray<System.Char>(System.Collections.Generic.IEnumerable`1<System.Char>)
newobj System.Void System.String::.ctor(System.Char[])
stloc.s V_4
ldloc.s V_12
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_12
ldloc.s V_12
ldc.i4 10000
ble.s IL_00F3: ldc.i4.3
ldc.i4.s 12
stloc.s V_23
br IL_006A: ldloc.s V_23
ldc.i4.3 <null>
br.s IL_00EC: stloc.s V_23
ldloc.3 <null>
ldloca.s V_5
call System.Boolean System.DateTime::TryParse(System.String,System.DateTime&)
pop <null>
ldtoken System.Int32
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
callvirt System.Reflection.Assembly System.Type::get_Assembly()
stloc.s V_6
ldloc.s V_6
nop <null>
ldc.i4.s 22
ldc.i4 229250262
ldc.i4.8 <null>
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom::qa8GqCn34tE(System.Byte,System.Int32,System.Int32)
callvirt System.Type System.Reflection.Assembly::GetType(System.String)
stloc.s V_7
ldc.i4.2 <null>
stloc.s V_23
br IL_006A: ldloc.s V_23
ldtoken System.Object
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_8
ldloc.s V_7
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldloc.s V_8
stelem.ref <null>
callvirt System.Type System.Type::MakeGenericType(System.Type[])
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_23
br IL_006A: ldloc.s V_23
ldloc.s V_9
call System.Object System.Activator::CreateInstance(System.Type)
castclass System.Collections.Generic.List`1<System.Object>
stloc.s V_10
ldloc.s V_10
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldloc.s V_10
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldc.i4.4 <null>
stloc.s V_23
br IL_006A: ldloc.s V_23
ldloc.s V_13
brfalse.s IL_0192: ldc.i4.s 10
ldc.i4.1 <null>
stloc.s V_23
br IL_006A: ldloc.s V_23
ldc.i4.s 10
br.s IL_018B: stloc.s V_23
leave IL_03FE: ret
nop <null>
br.s IL_019E: br.s IL_01A0
br.s IL_01A0: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01DC: ldloc.s V_10
ldloc.s V_10
ldc.i4.0 <null>
callvirt System.Object System.Collections.Generic.List`1<System.Object>::get_Item(System.Int32)
ldnull <null>
nop <null>
ldc.i4 745548382
ldc.i4.7 <null>
ldnull <null>
ldnull <null>
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi::aTo9M0bqwZb(System.Int32,System.Int32,rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi,System.String)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.Collections.IEnumerable
callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator()
stloc.s V_14
ldc.i4.s 11
stloc.s V_25
br.s IL_01A3: ldloc.s V_25
ldloc.s V_14
callvirt System.Object System.Collections.IEnumerator::get_Current()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_15
ldloc.s V_15
brtrue.s IL_022D: ldc.i4.s 10
ldc.i4.7 <null>
stloc.s V_25
br IL_01A3: ldloc.s V_25
ldc.i4.s 10
br.s IL_0226: stloc.s V_25
ldnull <null>
br.s IL_0271: ldc.i4.1
ldloc.s V_15
ldnull <null>
nop <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4 1037337516
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom::pMt3S2w(rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom,System.Int32,System.Int32)
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.3 <null>
nop <null>
ldc.i4.6 <null>
ldc.i4 1595758
ldtoken Ney3m5Ps8Fmxt9.7GokCi9x0Ect/xQz4M7s.Gt3g5BqaXd
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom::ge5Y3zGc(System.Int32,System.Int32,System.Type)
call System.String System.String::Concat(System.String,System.String)
stelem.ref <null>
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldc.i4.1 <null>
box System.Boolean
ldc.i4.0 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean)
stloc.s V_16
ldloc.s V_16
brfalse.s IL_0295: ldc.i4.2
ldloc.s V_26
ldc.i4.s 52
ldelem.u2 <null>
ldc.i4 30305
sub <null>
stloc.s V_25
br IL_01A3: ldloc.s V_25
ldc.i4.2 <null>
br.s IL_028E: stloc.s V_25
ldloc.s V_10
ldloc.s V_15
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldc.i4.6 <null>
stloc.s V_25
br IL_01A3: ldloc.s V_25
nop <null>
nop <null>
ldc.i4.s 11
stloc.s V_25
br IL_01A3: ldloc.s V_25
ldloc.s V_14
callvirt System.Boolean System.Collections.IEnumerator::MoveNext()
stloc.s V_17
ldloc.s V_17
brtrue.s IL_02CF: ldc.i4.5
ldc.i4.6 <null>
stloc.s V_25
br IL_01A3: ldloc.s V_25
ldc.i4.5 <null>
br.s IL_02C8: stloc.s V_25
leave.s IL_0322: br.s IL_0324
br.s IL_02D6: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_28
ldloc.s V_28
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_02FE: ldloc.s V_14
ldloc.s V_14
isinst System.IDisposable
brfalse.s IL_030C: ldc.i4.3
ldc.i4.5 <null>
stloc.s V_28
br.s IL_02D9: ldloc.s V_28
ldc.i4.3 <null>
br.s IL_0308: stloc.s V_28
ldloc.s V_14
isinst System.IDisposable
callvirt System.Void System.IDisposable::Dispose()
nop <null>
ldc.i4.3 <null>
stloc.s V_28
br.s IL_02D9: ldloc.s V_28
endfinally <null>
br.s IL_0324: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_30
ldloc.s V_30
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0350: ldc.r8 1
ldc.r8 1
stloc.s V_11
ldc.i4.1 <null>
stloc.s V_18
ldc.i4.6 <null>
stloc.s V_30
br.s IL_0327: ldloc.s V_30
ldloc.s V_11
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
conv.r8 <null>
ldsfld System.Char[] iFx9a3Zt.7Qckib9J::Fsw84EqtQa2
ldc.i4 308
ldsfld System.Char[] iFx9a3Zt.7Qckib9J::Fsw84EqtQa2
ldc.i4 308
ldelem.u2 <null>
ldsfld System.Char[] iFx9a3Zt.7Qckib9J::Fsw84EqtQa2
ldc.i4 178
ldelem.u2 <null>
and <null>
ldc.i4 158
and <null>
stelem.i2 <null>
div <null>
stloc.s V_11
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_18
ldc.i4.1 <null>
stloc.s V_30
br.s IL_0327: ldloc.s V_30
ldloc.s V_18
ldc.i4 10000
ble.s IL_03B1: ldc.i4.6
ldc.i4.4 <null>
stloc.s V_30
br IL_0327: ldloc.s V_30
ldc.i4.6 <null>
br.s IL_03AA: stloc.s V_30
ldloc.s V_10
call System.Void Nbc3wC9k6nLya8.jNd2Kp6ig8oG1/Ymp46tKc.Hr7gnJ::0Joxy4rP(System.Collections.Generic.List`1<System.Object>)
nop <null>
leave.s IL_03D2: br.s IL_03D4
br.s IL_03C0: br.s IL_03C2
br.s IL_03C2: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_19
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_03D2: br.s IL_03D4
br.s IL_03D4: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_32
ldloc.s V_32
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_03F8: nop
nop <null>
ldc.i4.3 <null>
stloc.s V_32
br.s IL_03D7: ldloc.s V_32
ret <null>
ldtoken System.Void Zwd96jAp.5JziE::Wy1f6()
pop <null>
ret <null>
Module Name
2Pjfod0LKgs1
Full Name
2Pjfod0LKgs1
EntryPoint
System.Void Zwd96jAp.5JziE::Wy1f6()
Scope Name
2Pjfod0LKgs1
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
2Pjfod0LKgs1
Assembly Version
24.7.7.156
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Zwd96jAp.5JziE::Wy1f6()
Main IL Instruction Count
330
Main IL 
ldsfld System.Char[] 0irHsoD8p.9nxLdYg1W4qaf::0Podpd5FG4snw_
stloc.s V_26
ldc.i4.4 <null>
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
ldc.r8 1
stloc.0 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
call System.String System.Windows.Forms.Application::get_StartupPath()
nop <null>
ldc.i4 745548343
ldc.i4.7 <null>
ldnull <null>
ldnull <null>
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi::aTo9M0bqwZb(System.Int32,System.Int32,rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi,System.String)
call System.String System.String::Concat(System.String,System.String)
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_21
br.s IL_000A: ldloc.s V_21
ldloca.s V_2
initobj System.Int16
br.s IL_0065: br.s IL_0067
br.s IL_0067: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00A7: nop
nop <null>
nop <null>
ldc.i4 745548355
ldc.i4.1 <null>
ldnull <null>
ldnull <null>
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi::aTo9M0bqwZb(System.Int32,System.Int32,rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi,System.String)
stloc.3 <null>
ldloc.3 <null>
stloc.s V_4
ldc.i4.s 11
stloc.s V_23
br.s IL_006A: ldloc.s V_23
ldc.i4.1 <null>
stloc.s V_12
ldc.i4.3 <null>
stloc.s V_23
br.s IL_006A: ldloc.s V_23
ldloc.s V_4
call System.Collections.Generic.IEnumerable`1<System.Char> System.Linq.Enumerable::Reverse<System.Char>(System.Collections.Generic.IEnumerable`1<System.Char>)
call System.Char[] System.Linq.Enumerable::ToArray<System.Char>(System.Collections.Generic.IEnumerable`1<System.Char>)
newobj System.Void System.String::.ctor(System.Char[])
stloc.s V_4
ldloc.s V_12
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_12
ldloc.s V_12
ldc.i4 10000
ble.s IL_00F3: ldc.i4.3
ldc.i4.s 12
stloc.s V_23
br IL_006A: ldloc.s V_23
ldc.i4.3 <null>
br.s IL_00EC: stloc.s V_23
ldloc.3 <null>
ldloca.s V_5
call System.Boolean System.DateTime::TryParse(System.String,System.DateTime&)
pop <null>
ldtoken System.Int32
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
callvirt System.Reflection.Assembly System.Type::get_Assembly()
stloc.s V_6
ldloc.s V_6
nop <null>
ldc.i4.s 22
ldc.i4 229250262
ldc.i4.8 <null>
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom::qa8GqCn34tE(System.Byte,System.Int32,System.Int32)
callvirt System.Type System.Reflection.Assembly::GetType(System.String)
stloc.s V_7
ldc.i4.2 <null>
stloc.s V_23
br IL_006A: ldloc.s V_23
ldtoken System.Object
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_8
ldloc.s V_7
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldloc.s V_8
stelem.ref <null>
callvirt System.Type System.Type::MakeGenericType(System.Type[])
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_23
br IL_006A: ldloc.s V_23
ldloc.s V_9
call System.Object System.Activator::CreateInstance(System.Type)
castclass System.Collections.Generic.List`1<System.Object>
stloc.s V_10
ldloc.s V_10
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldloc.s V_10
callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count()
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldc.i4.4 <null>
stloc.s V_23
br IL_006A: ldloc.s V_23
ldloc.s V_13
brfalse.s IL_0192: ldc.i4.s 10
ldc.i4.1 <null>
stloc.s V_23
br IL_006A: ldloc.s V_23
ldc.i4.s 10
br.s IL_018B: stloc.s V_23
leave IL_03FE: ret
nop <null>
br.s IL_019E: br.s IL_01A0
br.s IL_01A0: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01DC: ldloc.s V_10
ldloc.s V_10
ldc.i4.0 <null>
callvirt System.Object System.Collections.Generic.List`1<System.Object>::get_Item(System.Int32)
ldnull <null>
nop <null>
ldc.i4 745548382
ldc.i4.7 <null>
ldnull <null>
ldnull <null>
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi::aTo9M0bqwZb(System.Int32,System.Int32,rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom/8cnQxFg59.ng8MJfi,System.String)
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
castclass System.Collections.IEnumerable
callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator()
stloc.s V_14
ldc.i4.s 11
stloc.s V_25
br.s IL_01A3: ldloc.s V_25
ldloc.s V_14
callvirt System.Object System.Collections.IEnumerator::get_Current()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_15
ldloc.s V_15
brtrue.s IL_022D: ldc.i4.s 10
ldc.i4.7 <null>
stloc.s V_25
br IL_01A3: ldloc.s V_25
ldc.i4.s 10
br.s IL_0226: stloc.s V_25
ldnull <null>
br.s IL_0271: ldc.i4.1
ldloc.s V_15
ldnull <null>
nop <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4 1037337516
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom::pMt3S2w(rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom,System.Int32,System.Int32)
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.3 <null>
nop <null>
ldc.i4.6 <null>
ldc.i4 1595758
ldtoken Ney3m5Ps8Fmxt9.7GokCi9x0Ect/xQz4M7s.Gt3g5BqaXd
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.String rJf58nBktHm.eDj3da8M0Jd/ry2Fq3KwnGp7M.xGr65cB_Wom::ge5Y3zGc(System.Int32,System.Int32,System.Type)
call System.String System.String::Concat(System.String,System.String)
stelem.ref <null>
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldc.i4.1 <null>
box System.Boolean
ldc.i4.0 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean)
stloc.s V_16
ldloc.s V_16
brfalse.s IL_0295: ldc.i4.2
ldloc.s V_26
ldc.i4.s 52
ldelem.u2 <null>
ldc.i4 30305
sub <null>
stloc.s V_25
br IL_01A3: ldloc.s V_25
ldc.i4.2 <null>
br.s IL_028E: stloc.s V_25
ldloc.s V_10
ldloc.s V_15
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object)
nop <null>
ldc.i4.6 <null>
stloc.s V_25
br IL_01A3: ldloc.s V_25
nop <null>
nop <null>
ldc.i4.s 11
stloc.s V_25
br IL_01A3: ldloc.s V_25
ldloc.s V_14
callvirt System.Boolean System.Collections.IEnumerator::MoveNext()
stloc.s V_17
ldloc.s V_17
brtrue.s IL_02CF: ldc.i4.5
ldc.i4.6 <null>
stloc.s V_25
br IL_01A3: ldloc.s V_25
ldc.i4.5 <null>
br.s IL_02C8: stloc.s V_25
leave.s IL_0322: br.s IL_0324
br.s IL_02D6: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_28
ldloc.s V_28
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_02FE: ldloc.s V_14
ldloc.s V_14
isinst System.IDisposable
brfalse.s IL_030C: ldc.i4.3
ldc.i4.5 <null>
stloc.s V_28
br.s IL_02D9: ldloc.s V_28
ldc.i4.3 <null>
br.s IL_0308: stloc.s V_28
ldloc.s V_14
isinst System.IDisposable
callvirt System.Void System.IDisposable::Dispose()
nop <null>
ldc.i4.3 <null>
stloc.s V_28
br.s IL_02D9: ldloc.s V_28
endfinally <null>
br.s IL_0324: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_30
ldloc.s V_30
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0350: ldc.r8 1
ldc.r8 1
stloc.s V_11
ldc.i4.1 <null>
stloc.s V_18
ldc.i4.6 <null>
stloc.s V_30
br.s IL_0327: ldloc.s V_30
ldloc.s V_11
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
conv.r8 <null>
ldsfld System.Char[] iFx9a3Zt.7Qckib9J::Fsw84EqtQa2
ldc.i4 308
ldsfld System.Char[] iFx9a3Zt.7Qckib9J::Fsw84EqtQa2
ldc.i4 308
ldelem.u2 <null>
ldsfld System.Char[] iFx9a3Zt.7Qckib9J::Fsw84EqtQa2
ldc.i4 178
ldelem.u2 <null>
and <null>
ldc.i4 158
and <null>
stelem.i2 <null>
div <null>
stloc.s V_11
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_18
ldc.i4.1 <null>
stloc.s V_30
br.s IL_0327: ldloc.s V_30
ldloc.s V_18
ldc.i4 10000
ble.s IL_03B1: ldc.i4.6
ldc.i4.4 <null>
stloc.s V_30
br IL_0327: ldloc.s V_30
ldc.i4.6 <null>
br.s IL_03AA: stloc.s V_30
ldloc.s V_10
call System.Void Nbc3wC9k6nLya8.jNd2Kp6ig8oG1/Ymp46tKc.Hr7gnJ::0Joxy4rP(System.Collections.Generic.List`1<System.Object>)
nop <null>
leave.s IL_03D2: br.s IL_03D4
br.s IL_03C0: br.s IL_03C2
br.s IL_03C2: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_19
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_03D2: br.s IL_03D4
br.s IL_03D4: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_32
ldloc.s V_32
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_03F8: nop
nop <null>
ldc.i4.3 <null>
stloc.s V_32
br.s IL_03D7: ldloc.s V_32
ret <null>
ldtoken System.Void Zwd96jAp.5JziE::Wy1f6()
pop <null>
ret <null>
29 items
  • 4c5af2a9fdea7bd68955f0487b5d8d52SOS: 0.84
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙