Malicious
Malicious

67dc3753315c57ef1b7914f664ec8978

PE Executable
MD5: 67dc3753315c57ef1b7914f664ec8978
Size: 787.46 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
787.46 KB · 787,456 B
Hashes
MD5 67dc3753315c57ef1b7914f664ec8978 Sha1 db9e50fe5373de52c326339a992e5ea542352db1 Sha256 25879d185b70aad4641d2c22a46ffc93f57b01937793464de7cef138a5b91d60 Sha384 3b662645f7b7800579e39375d30c541d25d54d9aadc25caf9fc4e686705b1b90e7647cc155f4c1c49db62fa0b8d44571 Sha512 bb0126f99a9ebdaf72f0ab330f02051cf98c15ba7ce3021072f5e925b3a1e6623caa2ae9352236023866fe49978ecbf0568505840ae0e5f64fcdc3218527a05a SSDeep 12288:e5zefXa5cmP76gM3i7NLAvDurK7pwhuX63PMj8bk0qGsPDaff:zicm6gt7+vyrcqfUucGsuff TLSH 97F4CF4B76968E31D1880236C1EB450583E165477A77E70E798427DB2A033FAFE8B397
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXE67dc3753315c57ef1b7914f664ec8978
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINBZ9Hn7tyWx9YgJtsNs.e4WtmHjsbDbl7rRA5a
BINRm27VtK77RxCTgbHBK.b1WGXB7yQwQ2GhrIHj
BINpaSJ5IyUZ6YqwqD5yF.eVfBVK9FO7puNOYRRh
BINW1RX55kA0Lg85kQJGX.WlfCgQhRmV9KYv0Wd3
Name Value
Module Name
Uxlmrzu.exe
Full Name
Uxlmrzu.exe
EntryPoint
System.Void NsFqwDgslXylv8kYKy.NsPArNSFBdA7D9MZWQ::KEXsN2g9g()
Scope Name
Uxlmrzu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Uxlmrzu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void NsFqwDgslXylv8kYKy.NsPArNSFBdA7D9MZWQ::KEXsN2g9g()
Main IL Instruction Count
63
Main IL 
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0009: ldloc V_1
br IL_0105: ret
nop <null>
newobj System.Void TChaPbpcgfCB18uORJ.HeJuyC6NA6gTMjBbQI::.ctor()
call System.Byte[] Ecpenmkgggq.Properties.Gtbwnkrmvct::get_Teqssllluts()
callvirt System.Void TChaPbpcgfCB18uORJ.HeJuyC6NA6gTMjBbQI::MOPn9QaGE(System.Byte[])
ldc.i4 0
ldsfld <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715} <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_8197bfa0abab4781ab1e4a3b6483ddaa
ldfld System.Int32 <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_5a8581fee03a4d7ea59ccfac98dd8e28
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 1
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_006E: ldloc V_0
br IL_008E: leave IL_0105
leave IL_0105: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715} <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_8197bfa0abab4781ab1e4a3b6483ddaa
ldfld System.Int32 <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_53d22e35ffb0409380ad6043e49aa081
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 1
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0105
leave IL_0105: ret
ldc.i4 7
ldsfld <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715} <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_8197bfa0abab4781ab1e4a3b6483ddaa
ldfld System.Int32 <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_6e5ef49d55b64fa9ac57f22a29dda255
brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
ret <null>
call System.Void jDUdhahx8f57GHumoR0.cq0mrPh3nf3PF29qFUd::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 1
ldsfld <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715} <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_8197bfa0abab4781ab1e4a3b6483ddaa
ldfld System.Int32 <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_4aaefd9e27804498a5c53d67f15ab94d
brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
Module Name
Uxlmrzu.exe
Full Name
Uxlmrzu.exe
EntryPoint
System.Void NsFqwDgslXylv8kYKy.NsPArNSFBdA7D9MZWQ::KEXsN2g9g()
Scope Name
Uxlmrzu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Uxlmrzu
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void NsFqwDgslXylv8kYKy.NsPArNSFBdA7D9MZWQ::KEXsN2g9g()
Main IL Instruction Count
63
Main IL 
ldc.i4 2
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0009: ldloc V_1
br IL_0105: ret
nop <null>
newobj System.Void TChaPbpcgfCB18uORJ.HeJuyC6NA6gTMjBbQI::.ctor()
call System.Byte[] Ecpenmkgggq.Properties.Gtbwnkrmvct::get_Teqssllluts()
callvirt System.Void TChaPbpcgfCB18uORJ.HeJuyC6NA6gTMjBbQI::MOPn9QaGE(System.Byte[])
ldc.i4 0
ldsfld <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715} <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_8197bfa0abab4781ab1e4a3b6483ddaa
ldfld System.Int32 <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_5a8581fee03a4d7ea59ccfac98dd8e28
brtrue IL_0072: switch(IL_008E)
pop <null>
ldc.i4 1
br IL_0072: switch(IL_008E)
br IL_006E: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_006E: ldloc V_0
br IL_008E: leave IL_0105
leave IL_0105: ret
pop <null>
ldc.i4 0
ldsfld <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715} <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_8197bfa0abab4781ab1e4a3b6483ddaa
ldfld System.Int32 <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_53d22e35ffb0409380ad6043e49aa081
brtrue IL_00C5: switch(IL_00E1)
pop <null>
ldc.i4 1
br IL_00C5: switch(IL_00E1)
br IL_00C1: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 988
beq IL_00C1: ldloc V_2
br IL_00E1: leave IL_0105
leave IL_0105: ret
ldc.i4 7
ldsfld <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715} <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_8197bfa0abab4781ab1e4a3b6483ddaa
ldfld System.Int32 <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_6e5ef49d55b64fa9ac57f22a29dda255
brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 0
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
ret <null>
call System.Void jDUdhahx8f57GHumoR0.cq0mrPh3nf3PF29qFUd::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 1
ldsfld <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715} <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_8197bfa0abab4781ab1e4a3b6483ddaa
ldfld System.Int32 <Module>{3d51624e-7ea8-4bdd-a21d-9c8f5b0d6715}::m_4aaefd9e27804498a5c53d67f15ab94d
brtrue IL_000D: switch(IL_0105,IL_0031,IL_0106)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0105,IL_0031,IL_0106)
1 malicious · 7 files
EXE67dc3753315c57ef1b7914f664ec8978
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙