Malicious PE Executable analysis – 4cc6805799c5

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Very high

1 malicious · 6 files

EXE4cc6805799c5b5b2d56afe4306c1fed2

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Uimxon.exe
Full Name	Uimxon.exe
EntryPoint	System.Void CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B::QQMas0LHv()
Scope Name	Uimxon.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Uimxon
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	39
Main Method	System.Void CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B::QQMas0LHv()
Main IL Instruction Count	89
Main IL	ldc.i4 2 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 991 beq IL_0009: ldloc V_0 br IL_005E: ret ldsfld V0WB37ArfeUsmfLIEw3 V0WB37ArfeUsmfLIEw3::U0MAQNkk0D call System.Void V0WB37ArfeUsmfLIEw3::lk7AsEm0mw(V0WB37ArfeUsmfLIEw3) ldc.i4 0 ldsfld <Module>{7858bd98-0004-4115-9599-c0e85301ceb0} <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_fc6d3045569f4b93b83e4d60e8e175e3 ldfld System.Int32 <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_1a228bba63e64859be2e19195c1fc796 brfalse IL_000D: switch(IL_0035,IL_005F,IL_0178,IL_005E) pop <null> ldc.i4 3 br IL_000D: switch(IL_0035,IL_005F,IL_0178,IL_005E) ret <null> nop <null> ldsfld System.Threading.ThreadStart CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B/<>c::OhesNw1cJ dup <null> brtrue IL_00D3: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) pop <null> ldc.i4 5 ldsfld <Module>{7858bd98-0004-4115-9599-c0e85301ceb0} <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_fc6d3045569f4b93b83e4d60e8e175e3 ldfld System.Int32 <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_de69ae7afc094dfea21ce52419a4b39c brfalse IL_009D: switch(IL_0101,IL_00BD) pop <null> ldc.i4 1 br IL_009D: switch(IL_0101,IL_00BD) br IL_0099: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_0099: ldloc V_2 br IL_00BD: ldsfld CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B/<>c CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B/<>c::AKe7sqsdS ldsfld CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B/<>c CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B/<>c::AKe7sqsdS ldftn System.Void CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B/<>c::Gdlbq349x() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Threading.ThreadStart CVACTrckT6wvQwmBlr.L6g9NVt8NjnKxQ6C8B/<>c::OhesNw1cJ newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) ldsfld mLCJgsAVPZnHgQep7u5 mLCJgsAVPZnHgQep7u5::vAUAwJHCbJ call System.Void mLCJgsAVPZnHgQep7u5::lk7AsEm0mw(System.Object,mLCJgsAVPZnHgQep7u5) ldc.i4 3 ldsfld <Module>{7858bd98-0004-4115-9599-c0e85301ceb0} <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_fc6d3045569f4b93b83e4d60e8e175e3 ldfld System.Int32 <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_6d64f04e748b4e5a9ce24f3f798c8d45 brtrue IL_009D: switch(IL_0101,IL_00BD) pop <null> ldc.i4 0 br IL_009D: switch(IL_0101,IL_00BD) leave IL_0035: ldsfld V0WB37ArfeUsmfLIEw3 V0WB37ArfeUsmfLIEw3::U0MAQNkk0D pop <null> ldc.i4 0 ldsfld <Module>{7858bd98-0004-4115-9599-c0e85301ceb0} <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_fc6d3045569f4b93b83e4d60e8e175e3 ldfld System.Int32 <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_dfc2a74e9dbc4cebbf49bb33f3c6bf2e brfalse IL_0138: switch(IL_0154) pop <null> ldc.i4 0 br IL_0138: switch(IL_0154) br IL_0134: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0134: ldloc V_1 br IL_0154: leave IL_0035 leave IL_0035: ldsfld V0WB37ArfeUsmfLIEw3 V0WB37ArfeUsmfLIEw3::U0MAQNkk0D ldc.i4 0 ldsfld <Module>{7858bd98-0004-4115-9599-c0e85301ceb0} <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_fc6d3045569f4b93b83e4d60e8e175e3 ldfld System.Int32 <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_5a6b60da01fd48c383e68b7681860e5f brtrue IL_000D: switch(IL_0035,IL_005F,IL_0178,IL_005E) pop <null> ldc.i4 7 br IL_000D: switch(IL_0035,IL_005F,IL_0178,IL_005E) ldsfld bW79R6AkiZoqcJ7jawt bW79R6AkiZoqcJ7jawt::tEZA0KkDeU call System.Void bW79R6AkiZoqcJ7jawt::lk7AsEm0mw(bW79R6AkiZoqcJ7jawt) ldc.i4 1 ldsfld <Module>{7858bd98-0004-4115-9599-c0e85301ceb0} <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_fc6d3045569f4b93b83e4d60e8e175e3 ldfld System.Int32 <Module>{7858bd98-0004-4115-9599-c0e85301ceb0}::m_7d210a6a850d4b0ebd49018327991cfd brfalse IL_000D: switch(IL_0035,IL_005F,IL_0178,IL_005E) pop <null> ldc.i4 8 br IL_000D: switch(IL_0035,IL_005F,IL_0178,IL_005E)