Malicious
Malicious

62a993c8458911147bc76fe10f0de75e

PE Executable
MD5: 62a993c8458911147bc76fe10f0de75e
Size: 829.95 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 62a993c8458911147bc76fe10f0de75e
Sha1 35ac9b94234b4b73fd6976c4248b988b2a884af9
Sha256 880d74780d64dd25ce6f24c1c7a04f7d6028ba89a7acfe35fcfe428c89ef24d1
Sha384 14cf8cea0e74ff63ee23f3d340346309138d3bb1f8cbb6a698cd10a4c741b34bca22c01ff874da37825b9459b44bc451
Sha512 aaac9cdbcbe4d6881a652a2d9bb4424b76df0c7c6ae22cba5875e12a6b380a9592710e9c37d1c55536d9da827b449453cb0dc20c04e398ad69bee70e7254a506
SSDeep 12288:u2gOO0wmyIaWz2/Ix17ZmFFNHIollOYlilp/aGJCweW8Fn5qEVtDY1:uBOO0n5wU17ZKplyda2Pen5VI
TLSH 0E05BF2A36925F21D14A1373C1C34A008BEA86676AD7F70B72C413D61D477FEEE0A697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
62a993c8458911147bc76fe10f0de75e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
lY5CYWbnV1d82AhdeA.rMYAaHHIqqGtdZnDHr
JRlgdtGgGGbbk1Frpv.7oOmDUReEm6JPA6NC4
K6Saya8CJP1xT2f5FA.WCfUjjFJbeZghHh90X
xHhT6oKsfXFC8wF1lP.V0OpMMXHDAbhNXIIHR
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Igccl.exe
Full Name
Igccl.exe
EntryPoint
System.Void JUNhH0xFwGsP9bPImT.VnuVAMN7wLu5kXVVUI::tu9cvEv7K()
Scope Name
Igccl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Igccl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void JUNhH0xFwGsP9bPImT.VnuVAMN7wLu5kXVVUI::tu9cvEv7K()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0197: ldsfld mDVRxcN8su5Hx2JDq7V mDVRxcN8su5Hx2JDq7V::P8ENFj7Kip
nop <null>
ldsfld HtTALINGF6vEmi9Fb2Z HtTALINGF6vEmi9Fb2Z::stWNRAPK9D
call System.Byte[] HtTALINGF6vEmi9Fb2Z::PjNNqpjnWa(HtTALINGF6vEmi9Fb2Z)
stloc.s V_2
ldc.i4 3
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_f41a39b6d9324924bf2cec2cb0048248
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0072: ldloc V_0
br IL_0096: ldc.i4 2056358367
ldc.i4 2056358367
ldc.i4 1015667916
xor <null>
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_5959f1549fce47eb83381ade5576491d
xor <null>
ldsfld VqZi9pNNe11dgI31JDW VqZi9pNNe11dgI31JDW::pTHNxcDiRJ
call System.String VqZi9pNNe11dgI31JDW::PjNNqpjnWa(System.Int32,VqZi9pNNe11dgI31JDW)
ldc.i4 1043795004
ldc.i4 1361646842
add <null>
ldc.i4 -2111225067
xor <null>
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_3e869d7209d14164a30af83b4139548b
xor <null>
ldsfld VqZi9pNNe11dgI31JDW VqZi9pNNe11dgI31JDW::pTHNxcDiRJ
call System.String VqZi9pNNe11dgI31JDW::PjNNqpjnWa(System.Int32,VqZi9pNNe11dgI31JDW)
newobj System.Void lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld Qf741PNcC04S0jGMegj Qf741PNcC04S0jGMegj::uRKNUD97BC
call lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl Qf741PNcC04S0jGMegj::PjNNqpjnWa(System.Object,System.Byte[],Qf741PNcC04S0jGMegj)
ldsfld IwLnNKNSCjrkNpnhpb0 IwLnNKNSCjrkNpnhpb0::rmCNVHyytV
call lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl IwLnNKNSCjrkNpnhpb0::PjNNqpjnWa(System.Object,IwLnNKNSCjrkNpnhpb0)
ldsfld gdBmUgNuRS6WEQA8SSO gdBmUgNuRS6WEQA8SSO::eXZNk7y7vi
call System.Void gdBmUgNuRS6WEQA8SSO::PjNNqpjnWa(System.Object,gdBmUgNuRS6WEQA8SSO)
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_a375b8ce175d4bf6b9779a22db517eae
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 2
br IL_0076: switch(IL_0120,IL_0096)
leave IL_01C0: ret
pop <null>
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_cc56903b189b4dfcb97c00099a8d8f7f
brtrue IL_0157: switch(IL_0173)
pop <null>
ldc.i4 5
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0153: ldloc V_3
br IL_0173: leave IL_01C0
leave IL_01C0: ret
ldc.i4 2
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_7e7f74cdcda54e00b9b78c3bcf3b3d23
brfalse IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ldsfld mDVRxcN8su5Hx2JDq7V mDVRxcN8su5Hx2JDq7V::P8ENFj7Kip
call System.Void mDVRxcN8su5Hx2JDq7V::PjNNqpjnWa(mDVRxcN8su5Hx2JDq7V)
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_b3a2963a7c0b4b8a8bc8cdef8cd73911
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ret <null>
Module Name
Igccl.exe
Full Name
Igccl.exe
EntryPoint
System.Void JUNhH0xFwGsP9bPImT.VnuVAMN7wLu5kXVVUI::tu9cvEv7K()
Scope Name
Igccl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Igccl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void JUNhH0xFwGsP9bPImT.VnuVAMN7wLu5kXVVUI::tu9cvEv7K()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0197: ldsfld mDVRxcN8su5Hx2JDq7V mDVRxcN8su5Hx2JDq7V::P8ENFj7Kip
nop <null>
ldsfld HtTALINGF6vEmi9Fb2Z HtTALINGF6vEmi9Fb2Z::stWNRAPK9D
call System.Byte[] HtTALINGF6vEmi9Fb2Z::PjNNqpjnWa(HtTALINGF6vEmi9Fb2Z)
stloc.s V_2
ldc.i4 3
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_f41a39b6d9324924bf2cec2cb0048248
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0072: ldloc V_0
br IL_0096: ldc.i4 2056358367
ldc.i4 2056358367
ldc.i4 1015667916
xor <null>
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_5959f1549fce47eb83381ade5576491d
xor <null>
ldsfld VqZi9pNNe11dgI31JDW VqZi9pNNe11dgI31JDW::pTHNxcDiRJ
call System.String VqZi9pNNe11dgI31JDW::PjNNqpjnWa(System.Int32,VqZi9pNNe11dgI31JDW)
ldc.i4 1043795004
ldc.i4 1361646842
add <null>
ldc.i4 -2111225067
xor <null>
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_3e869d7209d14164a30af83b4139548b
xor <null>
ldsfld VqZi9pNNe11dgI31JDW VqZi9pNNe11dgI31JDW::pTHNxcDiRJ
call System.String VqZi9pNNe11dgI31JDW::PjNNqpjnWa(System.Int32,VqZi9pNNe11dgI31JDW)
newobj System.Void lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld Qf741PNcC04S0jGMegj Qf741PNcC04S0jGMegj::uRKNUD97BC
call lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl Qf741PNcC04S0jGMegj::PjNNqpjnWa(System.Object,System.Byte[],Qf741PNcC04S0jGMegj)
ldsfld IwLnNKNSCjrkNpnhpb0 IwLnNKNSCjrkNpnhpb0::rmCNVHyytV
call lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl IwLnNKNSCjrkNpnhpb0::PjNNqpjnWa(System.Object,IwLnNKNSCjrkNpnhpb0)
ldsfld gdBmUgNuRS6WEQA8SSO gdBmUgNuRS6WEQA8SSO::eXZNk7y7vi
call System.Void gdBmUgNuRS6WEQA8SSO::PjNNqpjnWa(System.Object,gdBmUgNuRS6WEQA8SSO)
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_a375b8ce175d4bf6b9779a22db517eae
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 2
br IL_0076: switch(IL_0120,IL_0096)
leave IL_01C0: ret
pop <null>
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_cc56903b189b4dfcb97c00099a8d8f7f
brtrue IL_0157: switch(IL_0173)
pop <null>
ldc.i4 5
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0153: ldloc V_3
br IL_0173: leave IL_01C0
leave IL_01C0: ret
ldc.i4 2
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_7e7f74cdcda54e00b9b78c3bcf3b3d23
brfalse IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ldsfld mDVRxcN8su5Hx2JDq7V mDVRxcN8su5Hx2JDq7V::P8ENFj7Kip
call System.Void mDVRxcN8su5Hx2JDq7V::PjNNqpjnWa(mDVRxcN8su5Hx2JDq7V)
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_b3a2963a7c0b4b8a8bc8cdef8cd73911
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ret <null>
62a993c8458911147bc76fe10f0de75e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
lY5CYWbnV1d82AhdeA.rMYAaHHIqqGtdZnDHr
JRlgdtGgGGbbk1Frpv.7oOmDUReEm6JPA6NC4
K6Saya8CJP1xT2f5FA.WCfUjjFJbeZghHh90X
xHhT6oKsfXFC8wF1lP.V0OpMMXHDAbhNXIIHR
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙