Suspicious
Suspect

50f80b086aac1820defd105200518c2f

Share on LinkedIn
Print
PE Executable
MD5: 50f80b086aac1820defd105200518c2f
Size: 1.12 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 50f80b086aac1820defd105200518c2f
Sha1 b66cd7c24d5867bc26ad615d33c0123fdc0c634a
Sha256 99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4
Sha384 cf0fc7225b0d1eb1619d83bd8a7ace7c87525bcd701e792503b7e553707364a9c370bb2fcd739ab4fa0c9b22385b6044
Sha512 fdf7f4c590ecbd09be60bc29c2feec5b5bd85c74da01641f39b5986f02a32f83199c3b94226dcaf5f68ed27edd12bd5356dcd6dcfcac310d0b249fc36139c025
SSDeep 24576:xb2c6hIECGQ+H/JTL6CfpVobmRi/M9RTQ:xbPQiM/6CxqbmRh
TLSH 683501251D463B48CA7E0FB8C122145873F0D89783A6D72A2FFD51F59EA3B84CC6B952
PeID
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET
50f80b086aac1820defd105200518c2f
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
3iwXTn2e.Resources.resources
3iwXTn2e.g.resources
67337ea3e47f68.Resources.resources
632287a70
[NBF]root.Data
632287a71
[NBF]root.Data
632287a710
[NBF]root.Data
632287a711
[NBF]root.Data
632287a712
[NBF]root.Data
632287a713
[NBF]root.Data
632287a714
[NBF]root.Data
632287a715
[NBF]root.Data
632287a716
[NBF]root.Data
632287a717
[NBF]root.Data
632287a718
[NBF]root.Data
632287a72
[NBF]root.Data
632287a73
[NBF]root.Data
632287a74
[NBF]root.Data
632287a75
[NBF]root.Data
632287a76
[NBF]root.Data
632287a77
[NBF]root.Data
632287a78
[NBF]root.Data
632287a79
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
3iwXTn2e
Full Name
3iwXTn2e
EntryPoint
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Scope Name
3iwXTn2e
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3iwXTn2e
Assembly Version
26.8.9.167
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Main IL Instruction Count
128
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_10
ldloc.s V_10
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0033: nop
nop <null>
ldc.r8 5.9
stloc.0 <null>
ldc.i4.1 <null>
stloc.1 <null>
call System.Object[] sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::5Qpc_y0C()
stloc.2 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
dup <null>
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 9
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 35
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.6 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
stloc.3 <null>
ldc.i4.1 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
call System.String sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/Sk2sf1eAid.Cx0dkmW69mtBe8::bc4T0oKd()
call System.Byte[] sMd9Zs.0Aqks::0tjXsTm2D7fpdJ(System.String)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00A7: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
ldc.i4.5 <null>
br.s IL_00A0: stloc.s V_10
leave IL_017D: ret
ldloc.3 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
brfalse.s IL_00BE: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
br.s IL_00D4: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Boolean sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Yx8tin(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
brfalse.s IL_00E7: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
br.s IL_00FD: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Int32 sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Mb3dqAx8Ny(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
stloc.s V_5
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_4
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_4
call System.Byte[] 2Fmot5Peoi6Mk9.zQq09/8mwNGg.5gcAGk8d6/qx4Q5.Ksf9n4LwXn7op5::Qbb6xf8E(System.Byte[])
stelem.ref <null>
ldc.i4.2 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
nop <null>
ldc.i4 1700188778
ldc.i4.s 12
ldc.i4.8 <null>
call System.String 7zsWLd9qc3.Xr5y4e::Ds5zprK2(System.Int32,System.Byte,System.Int32)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Ca9s2dyY.mk7M2::fq7TLjt25(System.String,System.Object)
pop <null>
leave.s IL_0151: br.s IL_0153
br.s IL_013F: br.s IL_0141
br.s IL_0141: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0151: br.s IL_0153
br.s IL_0153: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_12
ldloc.s V_12
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0177: nop
nop <null>
ldc.i4.2 <null>
stloc.s V_12
br.s IL_0156: ldloc.s V_12
ret <null>
ldtoken System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
pop <null>
ret <null>
Module Name
3iwXTn2e
Full Name
3iwXTn2e
EntryPoint
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Scope Name
3iwXTn2e
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
3iwXTn2e
Assembly Version
26.8.9.167
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
Main IL Instruction Count
128
Main IL 
nop <null>
br.s IL_0003: ldc.i4.7
ldc.i4.7 <null>
stloc.s V_10
ldloc.s V_10
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0033: nop
nop <null>
ldc.r8 5.9
stloc.0 <null>
ldc.i4.1 <null>
stloc.1 <null>
call System.Object[] sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::5Qpc_y0C()
stloc.2 <null>
newobj System.Void System.Collections.Generic.List`1<System.Int32>::.ctor()
dup <null>
ldc.i4.s 15
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 9
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.3 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 20
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.s 35
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
dup <null>
ldc.i4.6 <null>
callvirt System.Void System.Collections.Generic.List`1<System.Int32>::Add(System.Int32)
nop <null>
stloc.3 <null>
ldc.i4.1 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
call System.String sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/Sk2sf1eAid.Cx0dkmW69mtBe8::bc4T0oKd()
call System.Byte[] sMd9Zs.0Aqks::0tjXsTm2D7fpdJ(System.String)
stloc.s V_4
ldloc.s V_4
ldnull <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00A7: ldc.i4.5
ldc.i4.0 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
ldc.i4.5 <null>
br.s IL_00A0: stloc.s V_10
leave IL_017D: ret
ldloc.3 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
brfalse.s IL_00BE: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
br.s IL_00D4: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Boolean sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Yx8tin(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::7jnCc9Rpob6T
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Where<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
brfalse.s IL_00E7: ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
br.s IL_00FD: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::qCz8Rj4m7k
ldftn System.Int32 sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::Mb3dqAx8Ny(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0/5nsKCt9c4Xim.oMd26wf::4wqZfQ0mg
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
stloc.s V_5
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.s V_4
stelem.ref <null>
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.s V_4
call System.Byte[] 2Fmot5Peoi6Mk9.zQq09/8mwNGg.5gcAGk8d6/qx4Q5.Ksf9n4LwXn7op5::Qbb6xf8E(System.Byte[])
stelem.ref <null>
ldc.i4.2 <null>
stloc.s V_10
br IL_0006: ldloc.s V_10
nop <null>
ldc.i4 1700188778
ldc.i4.s 12
ldc.i4.8 <null>
call System.String 7zsWLd9qc3.Xr5y4e::Ds5zprK2(System.Int32,System.Byte,System.Int32)
stloc.s V_6
ldloc.s V_6
ldloc.2 <null>
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object Ca9s2dyY.mk7M2::fq7TLjt25(System.String,System.Object)
pop <null>
leave.s IL_0151: br.s IL_0153
br.s IL_013F: br.s IL_0141
br.s IL_0141: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0151: br.s IL_0153
br.s IL_0153: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_12
ldloc.s V_12
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0177: nop
nop <null>
ldc.i4.2 <null>
stloc.s V_12
br.s IL_0156: ldloc.s V_12
ret <null>
ldtoken System.Void sMd9Zs.0Aqks/3Kipd2cA.1Wryi2cY0::fo1QbSp5W4_znB()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙