Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 9 files
EXE66f6119c4eda5de607597459b9e68a57
Structure
Name Value
Module Name
Oszqurn.exe
Full Name
Oszqurn.exe
EntryPoint
System.Void Kn1qWoENLcFIHOaFCQ.osWXyXOCVJItIR2EYE::hBmV9YDI3()
Scope Name
Oszqurn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Oszqurn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void Kn1qWoENLcFIHOaFCQ.osWXyXOCVJItIR2EYE::hBmV9YDI3()
Main IL Instruction Count
110
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0009: ldloc V_1
br IL_01EA: ret
nop <null>
newobj System.Void JiTjlV0UiNZKV43ZFJ.eG2INMRCqyXbOyTE8k::.ctor()
stloc.s V_0
ldc.i4 4
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
br IL_004D: ldloc V_4
ldc.i4 0
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_4
ldc.i4 12
beq IL_00AF: newobj System.Void jGkJVXZWREriuHFfYf.FpBtYZMDMrnAjPjrDm::.ctor()
ldloc V_4
ldc.i4 992
beq IL_004D: ldloc V_4
br IL_00D5: newobj System.Void GG17TebQVYTJ9CUpPy.WVnEvuyFbX174CPDiT::.ctor()
br IL_0173: leave IL_01EA
ldc.i4 1
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_701ec2d6e86d41ab919bda3ac896c63e
brfalse IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
pop <null>
ldc.i4 7
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
newobj System.Void jGkJVXZWREriuHFfYf.FpBtYZMDMrnAjPjrDm::.ctor()
stloc.s V_5
ldc.i4 2
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_bd727ff680614898a276fc9b5c14f2a3
brtrue IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
pop <null>
ldc.i4 3
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
newobj System.Void GG17TebQVYTJ9CUpPy.WVnEvuyFbX174CPDiT::.ctor()
dup <null>
dup <null>
ldsfld fOjtfgKXjS8PngIpti4 fOjtfgKXjS8PngIpti4::SfvKBHwaPZ
call System.Void fOjtfgKXjS8PngIpti4::s5XKV9pWF1(System.Object,GG17TebQVYTJ9CUpPy.WVnEvuyFbX174CPDiT,fOjtfgKXjS8PngIpti4)
dup <null>
ldloc.s V_5
ldsfld X1kLLTKlbxlaAKEr0X6 X1kLLTKlbxlaAKEr0X6::C3bKfANPnS
call System.Void X1kLLTKlbxlaAKEr0X6::s5XKV9pWF1(System.Object,jGkJVXZWREriuHFfYf.FpBtYZMDMrnAjPjrDm,X1kLLTKlbxlaAKEr0X6)
ldloc.s V_5
ldloc.s V_2
ldsfld jF8dgqK6YhNWNQl8knp jF8dgqK6YhNWNQl8knp::DCvKdMs4CR
call System.Void jF8dgqK6YhNWNQl8knp::s5XKV9pWF1(System.Object,lyt0dbUq90RT3od1L6.rDBkewYwiNC6wk1pY9,jF8dgqK6YhNWNQl8knp)
ldloc.s V_2
ldloc.s V_6
ldsfld eOVtZoKxLHoPPbUh6vP eOVtZoKxLHoPPbUh6vP::FvCK2qS7p1
call System.Void eOVtZoKxLHoPPbUh6vP::s5XKV9pWF1(System.Object,O9L1gc2vEsfSGvm8ww.QKSjl4xXKPutJrAxQW,eOVtZoKxLHoPPbUh6vP)
ldloc.s V_6
ldloc.s V_0
ldsfld gxhlRWKIyGxmAfGK7p4 gxhlRWKIyGxmAfGK7p4::gqKK5Xy1v5
call System.Void gxhlRWKIyGxmAfGK7p4::s5XKV9pWF1(System.Object,JiTjlV0UiNZKV43ZFJ.eG2INMRCqyXbOyTE8k,gxhlRWKIyGxmAfGK7p4)
ldsfld M07gmXKmoXLoJcQOTwf M07gmXKmoXLoJcQOTwf::EBoKNJpnVY
call System.Boolean M07gmXKmoXLoJcQOTwf::s5XKV9pWF1(System.Object,M07gmXKmoXLoJcQOTwf)
brfalse IL_016D: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 2
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
newobj System.Void lyt0dbUq90RT3od1L6.rDBkewYwiNC6wk1pY9::.ctor()
stloc.s V_2
ldc.i4 12
br IL_0049: stloc V_4
newobj System.Void O9L1gc2vEsfSGvm8ww.QKSjl4xXKPutJrAxQW::.ctor()
stloc.s V_6
ldc.i4 0
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_e21cd63f166a4014854474dea86dd9bc
brtrue IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
pop <null>
ldc.i4 6
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_01EA: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_077c95ce95ea44109297dd5d028ff070
brtrue IL_01AA: switch(IL_01C6)
pop <null>
ldc.i4 3
br IL_01AA: switch(IL_01C6)
br IL_01A6: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_01A6: ldloc V_3
br IL_01C6: leave IL_01EA
leave IL_01EA: ret
ldc.i4 0
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_51e719ae697840e581caf714c6f3b72a
brtrue IL_000D: switch(IL_01EA,IL_002D)
pop <null>
ldc.i4 6
br IL_000D: switch(IL_01EA,IL_002D)
ret <null>
Module Name
Oszqurn.exe
Full Name
Oszqurn.exe
EntryPoint
System.Void Kn1qWoENLcFIHOaFCQ.osWXyXOCVJItIR2EYE::hBmV9YDI3()
Scope Name
Oszqurn.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Oszqurn
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void Kn1qWoENLcFIHOaFCQ.osWXyXOCVJItIR2EYE::hBmV9YDI3()
Main IL Instruction Count
110
Main IL 
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0009: ldloc V_1
br IL_01EA: ret
nop <null>
newobj System.Void JiTjlV0UiNZKV43ZFJ.eG2INMRCqyXbOyTE8k::.ctor()
stloc.s V_0
ldc.i4 4
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
br IL_004D: ldloc V_4
ldc.i4 0
stloc V_4
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_4
ldc.i4 12
beq IL_00AF: newobj System.Void jGkJVXZWREriuHFfYf.FpBtYZMDMrnAjPjrDm::.ctor()
ldloc V_4
ldc.i4 992
beq IL_004D: ldloc V_4
br IL_00D5: newobj System.Void GG17TebQVYTJ9CUpPy.WVnEvuyFbX174CPDiT::.ctor()
br IL_0173: leave IL_01EA
ldc.i4 1
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_701ec2d6e86d41ab919bda3ac896c63e
brfalse IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
pop <null>
ldc.i4 7
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
newobj System.Void jGkJVXZWREriuHFfYf.FpBtYZMDMrnAjPjrDm::.ctor()
stloc.s V_5
ldc.i4 2
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_bd727ff680614898a276fc9b5c14f2a3
brtrue IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
pop <null>
ldc.i4 3
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
newobj System.Void GG17TebQVYTJ9CUpPy.WVnEvuyFbX174CPDiT::.ctor()
dup <null>
dup <null>
ldsfld fOjtfgKXjS8PngIpti4 fOjtfgKXjS8PngIpti4::SfvKBHwaPZ
call System.Void fOjtfgKXjS8PngIpti4::s5XKV9pWF1(System.Object,GG17TebQVYTJ9CUpPy.WVnEvuyFbX174CPDiT,fOjtfgKXjS8PngIpti4)
dup <null>
ldloc.s V_5
ldsfld X1kLLTKlbxlaAKEr0X6 X1kLLTKlbxlaAKEr0X6::C3bKfANPnS
call System.Void X1kLLTKlbxlaAKEr0X6::s5XKV9pWF1(System.Object,jGkJVXZWREriuHFfYf.FpBtYZMDMrnAjPjrDm,X1kLLTKlbxlaAKEr0X6)
ldloc.s V_5
ldloc.s V_2
ldsfld jF8dgqK6YhNWNQl8knp jF8dgqK6YhNWNQl8knp::DCvKdMs4CR
call System.Void jF8dgqK6YhNWNQl8knp::s5XKV9pWF1(System.Object,lyt0dbUq90RT3od1L6.rDBkewYwiNC6wk1pY9,jF8dgqK6YhNWNQl8knp)
ldloc.s V_2
ldloc.s V_6
ldsfld eOVtZoKxLHoPPbUh6vP eOVtZoKxLHoPPbUh6vP::FvCK2qS7p1
call System.Void eOVtZoKxLHoPPbUh6vP::s5XKV9pWF1(System.Object,O9L1gc2vEsfSGvm8ww.QKSjl4xXKPutJrAxQW,eOVtZoKxLHoPPbUh6vP)
ldloc.s V_6
ldloc.s V_0
ldsfld gxhlRWKIyGxmAfGK7p4 gxhlRWKIyGxmAfGK7p4::gqKK5Xy1v5
call System.Void gxhlRWKIyGxmAfGK7p4::s5XKV9pWF1(System.Object,JiTjlV0UiNZKV43ZFJ.eG2INMRCqyXbOyTE8k,gxhlRWKIyGxmAfGK7p4)
ldsfld M07gmXKmoXLoJcQOTwf M07gmXKmoXLoJcQOTwf::EBoKNJpnVY
call System.Boolean M07gmXKmoXLoJcQOTwf::s5XKV9pWF1(System.Object,M07gmXKmoXLoJcQOTwf)
brfalse IL_016D: newobj System.Void System.InvalidOperationException::.ctor()
ldc.i4 2
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
newobj System.Void lyt0dbUq90RT3od1L6.rDBkewYwiNC6wk1pY9::.ctor()
stloc.s V_2
ldc.i4 12
br IL_0049: stloc V_4
newobj System.Void O9L1gc2vEsfSGvm8ww.QKSjl4xXKPutJrAxQW::.ctor()
stloc.s V_6
ldc.i4 0
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_e21cd63f166a4014854474dea86dd9bc
brtrue IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
pop <null>
ldc.i4 6
br IL_0051: switch(IL_0136,IL_016D,IL_008B,IL_00D5,IL_0147)
newobj System.Void System.InvalidOperationException::.ctor()
throw <null>
leave IL_01EA: ret
pop <null>
ldc.i4 0
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_077c95ce95ea44109297dd5d028ff070
brtrue IL_01AA: switch(IL_01C6)
pop <null>
ldc.i4 3
br IL_01AA: switch(IL_01C6)
br IL_01A6: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_01A6: ldloc V_3
br IL_01C6: leave IL_01EA
leave IL_01EA: ret
ldc.i4 0
ldsfld <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243} <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_cb2989374b644020beff259109725ab3
ldfld System.Int32 <Module>{e6654aef-794d-458a-a1ab-40cdb8ead243}::m_51e719ae697840e581caf714c6f3b72a
brtrue IL_000D: switch(IL_01EA,IL_002D)
pop <null>
ldc.i4 6
br IL_000D: switch(IL_01EA,IL_002D)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙