Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 17 files
EXE5fa4d3a8dd96a9d7300788ac2ec902c3
Structure
Name Value
Module Name
Taskmgr.exe
Full Name
Taskmgr.exe
EntryPoint
System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::DlndnMhf8()
Scope Name
Taskmgr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Taskmgr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
20
Main Method
System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::DlndnMhf8()
Main IL Instruction Count
112
Main IL 
br IL_0007: ldc.i4 2
pop <null>
ldc.i4.0 <null>
ldc.i4 2
br IL_00D8: switch(IL_00C1,IL_002E,IL_0011,IL_00C1,IL_00A3,IL_006A,IL_00AD,IL_0079,IL_0042,IL_010F)
ldc.i4 4
call System.Boolean zhCoPa6D3ZHIBD0vqv.yLnJV7RxLUWxi1gOCW::UM9o0el5bP(System.Int32)
brfalse IL_0203: ret
ldc.i4 1
stloc V_5
br IL_00D4: ldloc V_5
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::XGdjhfIKe()
brfalse IL_00C1: call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::QNpncB7i3()
ldc.i4 7
br IL_00D0: stloc V_5
newobj System.Void System.Random::.ctor()
ldc.i4 4000
ldc.i4 8000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4 9
stloc V_5
ldc.i4.0 <null>
brfalse IL_00D4: ldloc V_5
call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::d9dkcdSqq()
ldc.i4 4
br IL_00D8: switch(IL_00C1,IL_002E,IL_0011,IL_00C1,IL_00A3,IL_006A,IL_00AD,IL_0079,IL_0042,IL_010F)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.1 <null>
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::yW3tcA5ADGbKaMCUXD()
brtrue IL_00B2: pop
pop <null>
ldc.i4 0
stloc V_5
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::c1Xwcjk7PTBgsDHEYj()
brfalse IL_0042: newobj System.Void System.Random::.ctor()
br IL_00D4: ldloc V_5
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::v5pO0mQSF()
brfalse IL_0203: ret
br IL_0042: newobj System.Void System.Random::.ctor()
pop <null>
ldc.i4 8
stloc V_5
br IL_00D4: ldloc V_5
call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::QNpncB7i3()
br IL_006A: call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::d9dkcdSqq()
ldc.i4 2
stloc V_5
ldloc V_5
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4 5
br IL_00D0: stloc V_5
ldc.i4.1 <null>
ldc.i4 40
call System.String zhCoPa6D3ZHIBD0vqv.yLnJV7RxLUWxi1gOCW::AwBouxn3PB(System.Int32)
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
ldloc.0 <null>
brtrue IL_012D: ldc.i4.s 26
leave IL_0203: ret
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldc.i4 44
call System.String zhCoPa6D3ZHIBD0vqv.yLnJV7RxLUWxi1gOCW::AwBouxn3PB(System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String)
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.String System.IO.Path::GetFileName(System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.2 <null>
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::c1Xwcjk7PTBgsDHEYj()
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::yW3tcA5ADGbKaMCUXD()
brtrue IL_01C6: pop
pop <null>
ldc.i4 3
stloc V_4
br IL_01A4: ldloc V_4
call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::vKJ9UZUAT()
ldc.i4 4
stloc V_4
ldc.i4.0 <null>
brfalse IL_01A4: ldloc V_4
call System.String System.Windows.Forms.Application::get_ExecutablePath()
ldloc.2 <null>
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue IL_01D6: call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::e1l0Zmtxr()
br IL_01C1: br IL_0171
ldc.i4 3
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_0171: call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::vKJ9UZUAT()
pop <null>
ldc.i4 2
br IL_01A0: stloc V_4
leave IL_0203: ret
call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::e1l0Zmtxr()
leave IL_01ED: leave IL_0203
ldloc.1 <null>
brfalse IL_01EC: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0203: ret
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0203: ret
ret <null>
Module Name
Taskmgr.exe
Full Name
Taskmgr.exe
EntryPoint
System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::DlndnMhf8()
Scope Name
Taskmgr.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Taskmgr
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
20
Main Method
System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::DlndnMhf8()
Main IL Instruction Count
112
Main IL 
br IL_0007: ldc.i4 2
pop <null>
ldc.i4.0 <null>
ldc.i4 2
br IL_00D8: switch(IL_00C1,IL_002E,IL_0011,IL_00C1,IL_00A3,IL_006A,IL_00AD,IL_0079,IL_0042,IL_010F)
ldc.i4 4
call System.Boolean zhCoPa6D3ZHIBD0vqv.yLnJV7RxLUWxi1gOCW::UM9o0el5bP(System.Int32)
brfalse IL_0203: ret
ldc.i4 1
stloc V_5
br IL_00D4: ldloc V_5
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::XGdjhfIKe()
brfalse IL_00C1: call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::QNpncB7i3()
ldc.i4 7
br IL_00D0: stloc V_5
newobj System.Void System.Random::.ctor()
ldc.i4 4000
ldc.i4 8000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4 9
stloc V_5
ldc.i4.0 <null>
brfalse IL_00D4: ldloc V_5
call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::d9dkcdSqq()
ldc.i4 4
br IL_00D8: switch(IL_00C1,IL_002E,IL_0011,IL_00C1,IL_00A3,IL_006A,IL_00AD,IL_0079,IL_0042,IL_010F)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.1 <null>
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::yW3tcA5ADGbKaMCUXD()
brtrue IL_00B2: pop
pop <null>
ldc.i4 0
stloc V_5
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::c1Xwcjk7PTBgsDHEYj()
brfalse IL_0042: newobj System.Void System.Random::.ctor()
br IL_00D4: ldloc V_5
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::v5pO0mQSF()
brfalse IL_0203: ret
br IL_0042: newobj System.Void System.Random::.ctor()
pop <null>
ldc.i4 8
stloc V_5
br IL_00D4: ldloc V_5
call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::QNpncB7i3()
br IL_006A: call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::d9dkcdSqq()
ldc.i4 2
stloc V_5
ldloc V_5
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4 5
br IL_00D0: stloc V_5
ldc.i4.1 <null>
ldc.i4 40
call System.String zhCoPa6D3ZHIBD0vqv.yLnJV7RxLUWxi1gOCW::AwBouxn3PB(System.Int32)
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
stloc.1 <null>
ldloc.0 <null>
brtrue IL_012D: ldc.i4.s 26
leave IL_0203: ret
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldc.i4 44
call System.String zhCoPa6D3ZHIBD0vqv.yLnJV7RxLUWxi1gOCW::AwBouxn3PB(System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String)
call System.String System.Windows.Forms.Application::get_ExecutablePath()
call System.String System.IO.Path::GetFileName(System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.2 <null>
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::c1Xwcjk7PTBgsDHEYj()
call System.Boolean ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::yW3tcA5ADGbKaMCUXD()
brtrue IL_01C6: pop
pop <null>
ldc.i4 3
stloc V_4
br IL_01A4: ldloc V_4
call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::vKJ9UZUAT()
ldc.i4 4
stloc V_4
ldc.i4.0 <null>
brfalse IL_01A4: ldloc V_4
call System.String System.Windows.Forms.Application::get_ExecutablePath()
ldloc.2 <null>
ldc.i4.5 <null>
callvirt System.Boolean System.String::Equals(System.String,System.StringComparison)
brtrue IL_01D6: call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::e1l0Zmtxr()
br IL_01C1: br IL_0171
ldc.i4 3
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_0171: call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::vKJ9UZUAT()
pop <null>
ldc.i4 2
br IL_01A0: stloc V_4
leave IL_0203: ret
call System.Void ESGx3sAliJMObInEwI.WWXkeHwZNbkN2vcreE::e1l0Zmtxr()
leave IL_01ED: leave IL_0203
ldloc.1 <null>
brfalse IL_01EC: endfinally
ldloc.1 <null>
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave IL_0203: ret
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0203: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙