Deep Malware Analysis of 64d46feb763648ce967002165a23a318 | md5: 64d46feb763648ce967002165a23a318 | Executable | PE (Portable Executable) | .Net | Managed .NET | PE File Layout | Win 32 Exe | x86 | SOS: 0.83

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	64d46feb763648ce967002165a23a318
Sha1	96bf7371d2728d6dedd7514b86eec3cd21f15c7b
Sha256	e3fe0ffb77b77d7279d08e0d2500b97548312f53d493999f7b329845bbd0d6e8
Sha384	7a011aed100905bf2c26ae37a942961a2ae1bb5da848838e998308667d632548a9922e748c8eade7ba34c28e868ad64b
Sha512	b72bd5b23e2809b5f43e60f7a209e9272db8aee7279f58c4217c4a595870508af9f9f7c2435ae6335d29bcba791c9c81fda25932254a6f563610ae5647f9da2f
SSDeep	12288:r7fdT/Jv64occwtS+sng7UywBPT5x7egmE9q1N9PswuYfxRag:3V/JyxwU+snmwBL5x7dm9PuYfx
TLSH	A705022A37C917A4E9FEAB388574500657F1F806D732FA6E7D6C51FE0A31B809912723

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Module Name	kr6LJba5n
Full Name	kr6LJba5n
EntryPoint	System.Void kr6LJba5n.eTa6K::7Rtds2_QJnf9()
Scope Name	kr6LJba5n
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	kr6LJba5n
Assembly Version	3.5.38.257
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Info	PE Detect: PeReader OK (file layout)
Total Strings	571
Main Method	System.Void kr6LJba5n.eTa6K::7Rtds2_QJnf9()
Main IL Instruction Count	169
Main IL	nop <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.1 <null> ldc.i4.s 25 stloc.2 <null> ldc.i4 2931804 box System.Int32 stloc.3 <null> ldsfld System.String kr6LJba5n.eTa6K/7jqZd4Jx6Enam0.Ff9tz6/Ko1y9TxtSmk.He7wc0::5mnESi1f stloc.s V_4 ldloc.s V_4 call System.String kr6LJba5n.eTa6K/7jqZd4Jx6Enam0.Ff9tz6/8MdeFc1.gRt4De1i6::Wg4_j0SytXw5x8(System.String) stloc.s V_5 ldloc.s V_5 call System.Byte[] kr6LJba5n.sMa4x::Cm0k6EttMec38(System.String) stloc.s V_6 ldloc.s V_6 ldnull <null> ceq <null> stloc.s V_13 ldloc.s V_13 brfalse.s IL_0044: nop ldstr GetA returned Nothing. newobj System.Void System.InvalidOperationException::.ctor(System.String) throw <null> nop <null> ldloc.s V_6 ldloc.3 <null> call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object) call System.Object kr6LJba5n.xRp7_2Fcr::Mgx67Xksm9k(System.Byte[],System.Int32) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_7 ldloc.s V_7 ldnull <null> ceq <null> stloc.s V_14 ldloc.s V_14 brfalse.s IL_006F: nop ldstr Encryption returned Nothing. newobj System.Void System.InvalidOperationException::.ctor(System.String) throw <null> nop <null> ldloc.s V_7 ldnull <null> ldstr ToArray ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) castclass System.Byte[] stloc.s V_8 ldc.i4.3 <null> stloc.s V_9 ldc.i4.7 <null> stloc.0 <null> nop <null> ldloc.s V_9 ldc.i4.3 <null> beq.s IL_009A: nop br.s IL_00A1: nop nop <null> ldloc.s V_8 stloc.s V_10 br.s IL_00A1: nop nop <null> ldc.i4.s 9 stloc.0 <null> ldtoken System.Reflection.Assembly call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) stloc.s V_11 ldloc.s V_11 callvirt System.Reflection.MethodInfo[] System.Type::GetMethods() ldsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn brfalse.s IL_00C6: ldsfld kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::so0DdTr4Le2y ldsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn br.s IL_00DC: call System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo> System.Linq.Enumerable::Where<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>,System.Func`2<System.Reflection.MethodInfo,System.Boolean>) ldsfld kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::so0DdTr4Le2y ldftn System.Boolean kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Woy3tZ2c6zpGF8(System.Reflection.MethodInfo) newobj System.Void System.Func`2<System.Reflection.MethodInfo,System.Boolean>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn call System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo> System.Linq.Enumerable::Where<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>,System.Func`2<System.Reflection.MethodInfo,System.Boolean>) call System.Reflection.MethodInfo[] System.Linq.Enumerable::ToArray<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>) stloc.s V_12 ldloc.s V_12 stloc.s V_15 ldc.i4.0 <null> stloc.s V_16 br IL_0190: ldloc.s V_16 ldloc.s V_15 ldloc.s V_16 ldelem.ref <null> stloc.s V_17 nop <null> ldloc.s V_17 ldnull <null> ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldloc.s V_10 stelem.ref <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_18 ldloc.s V_18 ldnull <null> ldstr GetTypes ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.s 25 box System.Int32 stelem.ref <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[]) ldnull <null> ldstr GetMethods ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.0 <null> box System.Int32 stelem.ref <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) call System.Object kr6LJba5n.eTa6K::rC_0t9PsDp5db(System.Object) pop <null> leave.s IL_01A1: ldc.i4.4 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_19 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0188: nop nop <null> nop <null> ldloc.s V_16 ldc.i4.1 <null> add.ovf <null> stloc.s V_16 ldloc.s V_16 ldloc.s V_15 ldlen <null> conv.i4 <null> clt <null> stloc.s V_20 ldloc.s V_20 brtrue IL_00F4: ldloc.s V_15 ldc.i4.4 <null> stloc.0 <null> ret <null>
Module Name	kr6LJba5n
Full Name	kr6LJba5n
EntryPoint	System.Void kr6LJba5n.eTa6K::7Rtds2_QJnf9()
Scope Name	kr6LJba5n
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	kr6LJba5n
Assembly Version	3.5.38.257
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	571
Main Method	System.Void kr6LJba5n.eTa6K::7Rtds2_QJnf9()
Main IL Instruction Count	169
Main IL	nop <null> newobj System.Void System.Windows.Forms.Form::.ctor() stloc.1 <null> ldc.i4.s 25 stloc.2 <null> ldc.i4 2931804 box System.Int32 stloc.3 <null> ldsfld System.String kr6LJba5n.eTa6K/7jqZd4Jx6Enam0.Ff9tz6/Ko1y9TxtSmk.He7wc0::5mnESi1f stloc.s V_4 ldloc.s V_4 call System.String kr6LJba5n.eTa6K/7jqZd4Jx6Enam0.Ff9tz6/8MdeFc1.gRt4De1i6::Wg4_j0SytXw5x8(System.String) stloc.s V_5 ldloc.s V_5 call System.Byte[] kr6LJba5n.sMa4x::Cm0k6EttMec38(System.String) stloc.s V_6 ldloc.s V_6 ldnull <null> ceq <null> stloc.s V_13 ldloc.s V_13 brfalse.s IL_0044: nop ldstr GetA returned Nothing. newobj System.Void System.InvalidOperationException::.ctor(System.String) throw <null> nop <null> ldloc.s V_6 ldloc.3 <null> call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object) call System.Object kr6LJba5n.xRp7_2Fcr::Mgx67Xksm9k(System.Byte[],System.Int32) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_7 ldloc.s V_7 ldnull <null> ceq <null> stloc.s V_14 ldloc.s V_14 brfalse.s IL_006F: nop ldstr Encryption returned Nothing. newobj System.Void System.InvalidOperationException::.ctor(System.String) throw <null> nop <null> ldloc.s V_7 ldnull <null> ldstr ToArray ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) castclass System.Byte[] stloc.s V_8 ldc.i4.3 <null> stloc.s V_9 ldc.i4.7 <null> stloc.0 <null> nop <null> ldloc.s V_9 ldc.i4.3 <null> beq.s IL_009A: nop br.s IL_00A1: nop nop <null> ldloc.s V_8 stloc.s V_10 br.s IL_00A1: nop nop <null> ldc.i4.s 9 stloc.0 <null> ldtoken System.Reflection.Assembly call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) stloc.s V_11 ldloc.s V_11 callvirt System.Reflection.MethodInfo[] System.Type::GetMethods() ldsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn brfalse.s IL_00C6: ldsfld kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::so0DdTr4Le2y ldsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn br.s IL_00DC: call System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo> System.Linq.Enumerable::Where<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>,System.Func`2<System.Reflection.MethodInfo,System.Boolean>) ldsfld kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::so0DdTr4Le2y ldftn System.Boolean kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Woy3tZ2c6zpGF8(System.Reflection.MethodInfo) newobj System.Void System.Func`2<System.Reflection.MethodInfo,System.Boolean>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Func`2<System.Reflection.MethodInfo,System.Boolean> kr6LJba5n.eTa6K/f_5BLjf.6Wsse1qRkP0gDr::Pn0mn call System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo> System.Linq.Enumerable::Where<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>,System.Func`2<System.Reflection.MethodInfo,System.Boolean>) call System.Reflection.MethodInfo[] System.Linq.Enumerable::ToArray<System.Reflection.MethodInfo>(System.Collections.Generic.IEnumerable`1<System.Reflection.MethodInfo>) stloc.s V_12 ldloc.s V_12 stloc.s V_15 ldc.i4.0 <null> stloc.s V_16 br IL_0190: ldloc.s V_16 ldloc.s V_15 ldloc.s V_16 ldelem.ref <null> stloc.s V_17 nop <null> ldloc.s V_17 ldnull <null> ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldloc.s V_10 stelem.ref <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_18 ldloc.s V_18 ldnull <null> ldstr GetTypes ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.s 25 box System.Int32 stelem.ref <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[]) ldnull <null> ldstr GetMethods ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldc.i4.0 <null> box System.Int32 stelem.ref <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) call System.Object kr6LJba5n.eTa6K::rC_0t9PsDp5db(System.Object) pop <null> leave.s IL_01A1: ldc.i4.4 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_19 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0188: nop nop <null> nop <null> ldloc.s V_16 ldc.i4.1 <null> add.ovf <null> stloc.s V_16 ldloc.s V_16 ldloc.s V_15 ldlen <null> conv.i4 <null> clt <null> stloc.s V_20 ldloc.s V_20 brtrue IL_00F4: ldloc.s V_15 ldc.i4.4 <null> stloc.0 <null> ret <null>