Suspicious
Suspect

50f80b086aac1820defd105200518c2f

PE Executable
MD5: 50f80b086aac1820defd105200518c2f
Size: 1.12 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 50f80b086aac1820defd105200518c2f
Sha1 b66cd7c24d5867bc26ad615d33c0123fdc0c634a
Sha256 99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4
Sha384 cf0fc7225b0d1eb1619d83bd8a7ace7c87525bcd701e792503b7e553707364a9c370bb2fcd739ab4fa0c9b22385b6044
Sha512 fdf7f4c590ecbd09be60bc29c2feec5b5bd85c74da01641f39b5986f02a32f83199c3b94226dcaf5f68ed27edd12bd5356dcd6dcfcac310d0b249fc36139c025
SSDeep 24576:xb2c6hIECGQ+H/JTL6CfpVobmRi/M9RTQ:xbPQiM/6CxqbmRh
TLSH 683501251D463B48CA7E0FB8C122145873F0D89783A6D72A2FFD51F59EA3B84CC6B952
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
50f80b086aac1820defd105200518c2f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
3iwXTn2e.Resources.resources
3iwXTn2e.g.resources
67337ea3e47f68.Resources.resources
632287a70
[NBF]root.Data
632287a71
[NBF]root.Data
632287a710
[NBF]root.Data
632287a711
[NBF]root.Data
632287a712
[NBF]root.Data
632287a713
[NBF]root.Data
632287a714
[NBF]root.Data
632287a715
[NBF]root.Data
632287a716
[NBF]root.Data
632287a717
[NBF]root.Data
632287a718
[NBF]root.Data
632287a72
[NBF]root.Data
632287a73
[NBF]root.Data
632287a74
[NBF]root.Data
632287a75
[NBF]root.Data
632287a76
[NBF]root.Data
632287a77
[NBF]root.Data
632287a78
[NBF]root.Data
632287a79
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
3iwXTn2e
Full Name
3iwXTn2e
EntryPoint
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Scope Name
3iwXTn2e
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3iwXTn2e
Assembly Version
26.8.9.167
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Main IL Instruction Count
128
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_10
ldloc.s V_10
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0033: nop
nop <null>
ldc.r8 5.9
stloc.0 <null>
ldc.i4.1 <null>
stloc.1 <null>
call System.Object[] sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::5Qpc_y0C()
stloc.2 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
dup <null>
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 9
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 35
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.6 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
stloc.3 <null>
ldc.i4.1 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
call System.String sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/Sk2sf1eAid.Cx0dkmW69mtBe8::bc4T0oKd()
call System.Byte[] sMd9Zs.0Aqks::0tjXsTm2D7fpdJ(System.String)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00A7: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
ldc.i4.5 <null>
br.s IL_00A0: stloc.s V_10
leave IL_017D: ret
ldloc.3 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
brfalse.s IL_00BE: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
br.s IL_00D4: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Boolean sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Yx8tin(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
brfalse.s IL_00E7: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
br.s IL_00FD: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Int32 sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Mb3dqAx8Ny(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
stloc.s V_5
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_4
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_4
call System.Byte[] 2Fmot5Peoi6Mk9.zQq09/8mwNGg.5gcAGk8d6/qx4Q5.Ksf9n4LwXn7op5::Qbb6xf8E(System.Byte[])
stelem.ref <null>
ldc.i4.2 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
nop <null>
ldc.i4 1700188778
ldc.i4.s 12
ldc.i4.8 <null>
call System.String 7zsWLd9qc3.Xr5y4e::Ds5zprK2(System.Int32,System.Byte,System.Int32)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Ca9s2dyY.mk7M2::fq7TLjt25(System.String,System.Object)
pop <null>
leave.s IL_0151: br.s IL_0153
br.s IL_013F: br.s IL_0141
br.s IL_0141: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0151: br.s IL_0153
br.s IL_0153: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_12
ldloc.s V_12
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0177: nop
nop <null>
ldc.i4.2 <null>
stloc.s V_12
br.s IL_0156: ldloc.s V_12
ret <null>
ldtoken System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
pop <null>
ret <null>
Module Name
3iwXTn2e
Full Name
3iwXTn2e
EntryPoint
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Scope Name
3iwXTn2e
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3iwXTn2e
Assembly Version
26.8.9.167
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Main IL Instruction Count
128
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_10
ldloc.s V_10
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0033: nop
nop <null>
ldc.r8 5.9
stloc.0 <null>
ldc.i4.1 <null>
stloc.1 <null>
call System.Object[] sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::5Qpc_y0C()
stloc.2 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
dup <null>
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 9
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 35
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.6 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
stloc.3 <null>
ldc.i4.1 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
call System.String sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/Sk2sf1eAid.Cx0dkmW69mtBe8::bc4T0oKd()
call System.Byte[] sMd9Zs.0Aqks::0tjXsTm2D7fpdJ(System.String)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00A7: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
ldc.i4.5 <null>
br.s IL_00A0: stloc.s V_10
leave IL_017D: ret
ldloc.3 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
brfalse.s IL_00BE: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
br.s IL_00D4: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Boolean sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Yx8tin(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
brfalse.s IL_00E7: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
br.s IL_00FD: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Int32 sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Mb3dqAx8Ny(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
stloc.s V_5
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_4
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_4
call System.Byte[] 2Fmot5Peoi6Mk9.zQq09/8mwNGg.5gcAGk8d6/qx4Q5.Ksf9n4LwXn7op5::Qbb6xf8E(System.Byte[])
stelem.ref <null>
ldc.i4.2 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
nop <null>
ldc.i4 1700188778
ldc.i4.s 12
ldc.i4.8 <null>
call System.String 7zsWLd9qc3.Xr5y4e::Ds5zprK2(System.Int32,System.Byte,System.Int32)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Ca9s2dyY.mk7M2::fq7TLjt25(System.String,System.Object)
pop <null>
leave.s IL_0151: br.s IL_0153
br.s IL_013F: br.s IL_0141
br.s IL_0141: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0151: br.s IL_0153
br.s IL_0153: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_12
ldloc.s V_12
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0177: nop
nop <null>
ldc.i4.2 <null>
stloc.s V_12
br.s IL_0156: ldloc.s V_12
ret <null>
ldtoken System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
pop <null>
ret <null>
50f80b086aac1820defd105200518c2f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
3iwXTn2e.Resources.resources
3iwXTn2e.g.resources
67337ea3e47f68.Resources.resources
632287a70
[NBF]root.Data
632287a71
[NBF]root.Data
632287a710
[NBF]root.Data
632287a711
[NBF]root.Data
632287a712
[NBF]root.Data
632287a713
[NBF]root.Data
632287a714
[NBF]root.Data
632287a715
[NBF]root.Data
632287a716
[NBF]root.Data
632287a717
[NBF]root.Data
632287a718
[NBF]root.Data
632287a72
[NBF]root.Data
632287a73
[NBF]root.Data
632287a74
[NBF]root.Data
632287a75
[NBF]root.Data
632287a76
[NBF]root.Data
632287a77
[NBF]root.Data
632287a78
[NBF]root.Data
632287a79
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙