Malicious PE Executable analysis – 5392eb608fc7

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 7 files

EXE5392eb608fc713327511e473980d0a98

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Ybtamnf.exe
Full Name	Ybtamnf.exe
EntryPoint	System.Void bFm65Zo9DRWdOUOR58.ImXEUpkhTKjlxmmiLX::D6NPA2I0y()
Scope Name	Ybtamnf.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ybtamnf
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void bFm65Zo9DRWdOUOR58.ImXEUpkhTKjlxmmiLX::D6NPA2I0y()
Main IL Instruction Count	63
Main IL	ldc.i4 1 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 990 beq IL_0009: ldloc V_0 br IL_0105: ret nop <null> newobj System.Void friWrXmOChcmwTftAq.Ixv8nV2Cm3JeKrbedV::.ctor() call System.Byte[] Zrkvelxmaa.Properties.Lsjkk::get_Scydhpl() callvirt System.Void friWrXmOChcmwTftAq.Ixv8nV2Cm3JeKrbedV::axXiMCZun(System.Byte[]) ldc.i4 0 ldsfld <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c} <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_f49b5bc9594846d9b9f7b1740c4ae945 ldfld System.Int32 <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_ea7ba8b235654b17bbbcbf607909cf44 brfalse IL_0072: switch(IL_008E) pop <null> ldc.i4 0 br IL_0072: switch(IL_008E) br IL_006E: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_006E: ldloc V_1 br IL_008E: leave IL_0105 leave IL_0105: ret pop <null> ldc.i4 0 ldsfld <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c} <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_f49b5bc9594846d9b9f7b1740c4ae945 ldfld System.Int32 <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_83f5f7bda8764035b232269e495293f3 brtrue IL_00C5: switch(IL_00E1) pop <null> ldc.i4 4 br IL_00C5: switch(IL_00E1) br IL_00C1: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C1: ldloc V_2 br IL_00E1: leave IL_0105 leave IL_0105: ret ldc.i4 6 ldsfld <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c} <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_f49b5bc9594846d9b9f7b1740c4ae945 ldfld System.Int32 <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_953449ad92dc472b9ac889a04c4c80e1 brfalse IL_000D: switch(IL_0031,IL_0106,IL_0105) pop <null> ldc.i4 2 br IL_000D: switch(IL_0031,IL_0106,IL_0105) ret <null> call System.Void rOKqsH8Tkf3OaWmQgPO.I3WfRy8RplApbfMBBQx::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 3 ldsfld <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c} <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_f49b5bc9594846d9b9f7b1740c4ae945 ldfld System.Int32 <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_d4efe22b941b4a09b4218c28dec93cb2 brfalse IL_000D: switch(IL_0031,IL_0106,IL_0105) pop <null> ldc.i4 0 br IL_000D: switch(IL_0031,IL_0106,IL_0105)
Module Name	Ybtamnf.exe
Full Name	Ybtamnf.exe
EntryPoint	System.Void bFm65Zo9DRWdOUOR58.ImXEUpkhTKjlxmmiLX::D6NPA2I0y()
Scope Name	Ybtamnf.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Ybtamnf
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void bFm65Zo9DRWdOUOR58.ImXEUpkhTKjlxmmiLX::D6NPA2I0y()
Main IL Instruction Count	63
Main IL	ldc.i4 1 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 990 beq IL_0009: ldloc V_0 br IL_0105: ret nop <null> newobj System.Void friWrXmOChcmwTftAq.Ixv8nV2Cm3JeKrbedV::.ctor() call System.Byte[] Zrkvelxmaa.Properties.Lsjkk::get_Scydhpl() callvirt System.Void friWrXmOChcmwTftAq.Ixv8nV2Cm3JeKrbedV::axXiMCZun(System.Byte[]) ldc.i4 0 ldsfld <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c} <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_f49b5bc9594846d9b9f7b1740c4ae945 ldfld System.Int32 <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_ea7ba8b235654b17bbbcbf607909cf44 brfalse IL_0072: switch(IL_008E) pop <null> ldc.i4 0 br IL_0072: switch(IL_008E) br IL_006E: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_006E: ldloc V_1 br IL_008E: leave IL_0105 leave IL_0105: ret pop <null> ldc.i4 0 ldsfld <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c} <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_f49b5bc9594846d9b9f7b1740c4ae945 ldfld System.Int32 <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_83f5f7bda8764035b232269e495293f3 brtrue IL_00C5: switch(IL_00E1) pop <null> ldc.i4 4 br IL_00C5: switch(IL_00E1) br IL_00C1: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C1: ldloc V_2 br IL_00E1: leave IL_0105 leave IL_0105: ret ldc.i4 6 ldsfld <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c} <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_f49b5bc9594846d9b9f7b1740c4ae945 ldfld System.Int32 <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_953449ad92dc472b9ac889a04c4c80e1 brfalse IL_000D: switch(IL_0031,IL_0106,IL_0105) pop <null> ldc.i4 2 br IL_000D: switch(IL_0031,IL_0106,IL_0105) ret <null> call System.Void rOKqsH8Tkf3OaWmQgPO.I3WfRy8RplApbfMBBQx::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 3 ldsfld <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c} <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_f49b5bc9594846d9b9f7b1740c4ae945 ldfld System.Int32 <Module>{c4dc43b3-10f3-4d77-a968-e3a7a42b6b9c}::m_d4efe22b941b4a09b4218c28dec93cb2 brfalse IL_000D: switch(IL_0031,IL_0106,IL_0105) pop <null> ldc.i4 0 br IL_000D: switch(IL_0031,IL_0106,IL_0105)