Malicious
Malicious

62a993c8458911147bc76fe10f0de75e

Share on LinkedIn
Print
PE Executable
MD5: 62a993c8458911147bc76fe10f0de75e
Size: 829.95 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 62a993c8458911147bc76fe10f0de75e
Sha1 35ac9b94234b4b73fd6976c4248b988b2a884af9
Sha256 880d74780d64dd25ce6f24c1c7a04f7d6028ba89a7acfe35fcfe428c89ef24d1
Sha384 14cf8cea0e74ff63ee23f3d340346309138d3bb1f8cbb6a698cd10a4c741b34bca22c01ff874da37825b9459b44bc451
Sha512 aaac9cdbcbe4d6881a652a2d9bb4424b76df0c7c6ae22cba5875e12a6b380a9592710e9c37d1c55536d9da827b449453cb0dc20c04e398ad69bee70e7254a506
SSDeep 12288:u2gOO0wmyIaWz2/Ix17ZmFFNHIollOYlilp/aGJCweW8Fn5qEVtDY1:uBOO0n5wU17ZKplyda2Pen5VI
TLSH 0E05BF2A36925F21D14A1373C1C34A008BEA86676AD7F70B72C413D61D477FEEE0A697
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
62a993c8458911147bc76fe10f0de75e
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
lY5CYWbnV1d82AhdeA.rMYAaHHIqqGtdZnDHr
JRlgdtGgGGbbk1Frpv.7oOmDUReEm6JPA6NC4
K6Saya8CJP1xT2f5FA.WCfUjjFJbeZghHh90X
xHhT6oKsfXFC8wF1lP.V0OpMMXHDAbhNXIIHR
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Igccl.exe
Full Name
Igccl.exe
EntryPoint
System.Void JUNhH0xFwGsP9bPImT.VnuVAMN7wLu5kXVVUI::tu9cvEv7K()
Scope Name
Igccl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Igccl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void JUNhH0xFwGsP9bPImT.VnuVAMN7wLu5kXVVUI::tu9cvEv7K()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0197: ldsfld mDVRxcN8su5Hx2JDq7V mDVRxcN8su5Hx2JDq7V::P8ENFj7Kip
nop <null>
ldsfld HtTALINGF6vEmi9Fb2Z HtTALINGF6vEmi9Fb2Z::stWNRAPK9D
call System.Byte[] HtTALINGF6vEmi9Fb2Z::PjNNqpjnWa(HtTALINGF6vEmi9Fb2Z)
stloc.s V_2
ldc.i4 3
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_f41a39b6d9324924bf2cec2cb0048248
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0072: ldloc V_0
br IL_0096: ldc.i4 2056358367
ldc.i4 2056358367
ldc.i4 1015667916
xor <null>
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_5959f1549fce47eb83381ade5576491d
xor <null>
ldsfld VqZi9pNNe11dgI31JDW VqZi9pNNe11dgI31JDW::pTHNxcDiRJ
call System.String VqZi9pNNe11dgI31JDW::PjNNqpjnWa(System.Int32,VqZi9pNNe11dgI31JDW)
ldc.i4 1043795004
ldc.i4 1361646842
add <null>
ldc.i4 -2111225067
xor <null>
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_3e869d7209d14164a30af83b4139548b
xor <null>
ldsfld VqZi9pNNe11dgI31JDW VqZi9pNNe11dgI31JDW::pTHNxcDiRJ
call System.String VqZi9pNNe11dgI31JDW::PjNNqpjnWa(System.Int32,VqZi9pNNe11dgI31JDW)
newobj System.Void lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld Qf741PNcC04S0jGMegj Qf741PNcC04S0jGMegj::uRKNUD97BC
call lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl Qf741PNcC04S0jGMegj::PjNNqpjnWa(System.Object,System.Byte[],Qf741PNcC04S0jGMegj)
ldsfld IwLnNKNSCjrkNpnhpb0 IwLnNKNSCjrkNpnhpb0::rmCNVHyytV
call lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl IwLnNKNSCjrkNpnhpb0::PjNNqpjnWa(System.Object,IwLnNKNSCjrkNpnhpb0)
ldsfld gdBmUgNuRS6WEQA8SSO gdBmUgNuRS6WEQA8SSO::eXZNk7y7vi
call System.Void gdBmUgNuRS6WEQA8SSO::PjNNqpjnWa(System.Object,gdBmUgNuRS6WEQA8SSO)
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_a375b8ce175d4bf6b9779a22db517eae
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 2
br IL_0076: switch(IL_0120,IL_0096)
leave IL_01C0: ret
pop <null>
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_cc56903b189b4dfcb97c00099a8d8f7f
brtrue IL_0157: switch(IL_0173)
pop <null>
ldc.i4 5
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0153: ldloc V_3
br IL_0173: leave IL_01C0
leave IL_01C0: ret
ldc.i4 2
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_7e7f74cdcda54e00b9b78c3bcf3b3d23
brfalse IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ldsfld mDVRxcN8su5Hx2JDq7V mDVRxcN8su5Hx2JDq7V::P8ENFj7Kip
call System.Void mDVRxcN8su5Hx2JDq7V::PjNNqpjnWa(mDVRxcN8su5Hx2JDq7V)
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_b3a2963a7c0b4b8a8bc8cdef8cd73911
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ret <null>
Module Name
Igccl.exe
Full Name
Igccl.exe
EntryPoint
System.Void JUNhH0xFwGsP9bPImT.VnuVAMN7wLu5kXVVUI::tu9cvEv7K()
Scope Name
Igccl.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Igccl
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void JUNhH0xFwGsP9bPImT.VnuVAMN7wLu5kXVVUI::tu9cvEv7K()
Main IL Instruction Count
99
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0197: ldsfld mDVRxcN8su5Hx2JDq7V mDVRxcN8su5Hx2JDq7V::P8ENFj7Kip
nop <null>
ldsfld HtTALINGF6vEmi9Fb2Z HtTALINGF6vEmi9Fb2Z::stWNRAPK9D
call System.Byte[] HtTALINGF6vEmi9Fb2Z::PjNNqpjnWa(HtTALINGF6vEmi9Fb2Z)
stloc.s V_2
ldc.i4 3
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_f41a39b6d9324924bf2cec2cb0048248
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 1
br IL_0076: switch(IL_0120,IL_0096)
br IL_0072: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 989
beq IL_0072: ldloc V_0
br IL_0096: ldc.i4 2056358367
ldc.i4 2056358367
ldc.i4 1015667916
xor <null>
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_5959f1549fce47eb83381ade5576491d
xor <null>
ldsfld VqZi9pNNe11dgI31JDW VqZi9pNNe11dgI31JDW::pTHNxcDiRJ
call System.String VqZi9pNNe11dgI31JDW::PjNNqpjnWa(System.Int32,VqZi9pNNe11dgI31JDW)
ldc.i4 1043795004
ldc.i4 1361646842
add <null>
ldc.i4 -2111225067
xor <null>
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_3e869d7209d14164a30af83b4139548b
xor <null>
ldsfld VqZi9pNNe11dgI31JDW VqZi9pNNe11dgI31JDW::pTHNxcDiRJ
call System.String VqZi9pNNe11dgI31JDW::PjNNqpjnWa(System.Int32,VqZi9pNNe11dgI31JDW)
newobj System.Void lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl::.ctor(System.String,System.String)
ldloc.s V_2
ldsfld Qf741PNcC04S0jGMegj Qf741PNcC04S0jGMegj::uRKNUD97BC
call lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl Qf741PNcC04S0jGMegj::PjNNqpjnWa(System.Object,System.Byte[],Qf741PNcC04S0jGMegj)
ldsfld IwLnNKNSCjrkNpnhpb0 IwLnNKNSCjrkNpnhpb0::rmCNVHyytV
call lNrUlcKBK6SDhJdwM82.xApEaCKqZhCSgIVWpNl IwLnNKNSCjrkNpnhpb0::PjNNqpjnWa(System.Object,IwLnNKNSCjrkNpnhpb0)
ldsfld gdBmUgNuRS6WEQA8SSO gdBmUgNuRS6WEQA8SSO::eXZNk7y7vi
call System.Void gdBmUgNuRS6WEQA8SSO::PjNNqpjnWa(System.Object,gdBmUgNuRS6WEQA8SSO)
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_a375b8ce175d4bf6b9779a22db517eae
brtrue IL_0076: switch(IL_0120,IL_0096)
pop <null>
ldc.i4 2
br IL_0076: switch(IL_0120,IL_0096)
leave IL_01C0: ret
pop <null>
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_cc56903b189b4dfcb97c00099a8d8f7f
brtrue IL_0157: switch(IL_0173)
pop <null>
ldc.i4 5
br IL_0157: switch(IL_0173)
br IL_0153: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_0153: ldloc V_3
br IL_0173: leave IL_01C0
leave IL_01C0: ret
ldc.i4 2
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_7e7f74cdcda54e00b9b78c3bcf3b3d23
brfalse IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 3
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ldsfld mDVRxcN8su5Hx2JDq7V mDVRxcN8su5Hx2JDq7V::P8ENFj7Kip
call System.Void mDVRxcN8su5Hx2JDq7V::PjNNqpjnWa(mDVRxcN8su5Hx2JDq7V)
ldc.i4 0
ldsfld <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e} <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_e5e84b7bb42b46e3923c9f96bfd44fc8
ldfld System.Int32 <Module>{4ccb49fc-d3f6-4780-8277-0fa21cf57d0e}::m_b3a2963a7c0b4b8a8bc8cdef8cd73911
brtrue IL_0014: switch(IL_0038,IL_0197,IL_01C0)
pop <null>
ldc.i4 1
br IL_0014: switch(IL_0038,IL_0197,IL_01C0)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙