Malicious PE Executable analysis – 6b58696a77c4

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXE6b58696a77c43b21585f02cd6569e735

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Wbflwygzzvo.exe
Full Name	Wbflwygzzvo.exe
EntryPoint	System.Void J1esFOGeionw0aG2by.MeCLQyjr0UBJrj96FU::ItLO254Ut()
Scope Name	Wbflwygzzvo.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Wbflwygzzvo
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void J1esFOGeionw0aG2by.MeCLQyjr0UBJrj96FU::ItLO254Ut()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 989 beq IL_0009: ldloc V_0 br IL_002D: ret ret <null> nop <null> newobj System.Void yGXudBy4rBoQRwAs62.JHoV7eiS9VEeaVo3ew::.ctor() ldsfld KKUa9pTODmf4hMojWZl KKUa9pTODmf4hMojWZl::qg6TZbVf23 call System.Boolean KKUa9pTODmf4hMojWZl::tnCTT66Xpr(System.Object,KKUa9pTODmf4hMojWZl) brtrue IL_0096: leave IL_002D ldc.i4 1 ldsfld <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6} <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_a16ed184dc7840a8859f8eb96b4ac781 ldfld System.Int32 <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_f6ab5be84a434f5e933d56b407938255 brtrue IL_0074: switch(IL_0090) pop <null> ldc.i4 0 br IL_0074: switch(IL_0090) br IL_0070: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0070: ldloc V_1 br IL_0090: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 0 ldsfld <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6} <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_a16ed184dc7840a8859f8eb96b4ac781 ldfld System.Int32 <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_fd6f4d6d67db418ea8c8e7ca68e81d4f brfalse IL_00CD: switch(IL_00E9) pop <null> ldc.i4 4 br IL_00CD: switch(IL_00E9) br IL_00C9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C9: ldloc V_2 br IL_00E9: leave IL_002D leave IL_002D: ret ldc.i4 2 ldsfld <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6} <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_a16ed184dc7840a8859f8eb96b4ac781 ldfld System.Int32 <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_b9066dfb93d54905aa8cf756d5574401 brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)
Module Name	Wbflwygzzvo.exe
Full Name	Wbflwygzzvo.exe
EntryPoint	System.Void J1esFOGeionw0aG2by.MeCLQyjr0UBJrj96FU::ItLO254Ut()
Scope Name	Wbflwygzzvo.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Wbflwygzzvo
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void J1esFOGeionw0aG2by.MeCLQyjr0UBJrj96FU::ItLO254Ut()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 989 beq IL_0009: ldloc V_0 br IL_002D: ret ret <null> nop <null> newobj System.Void yGXudBy4rBoQRwAs62.JHoV7eiS9VEeaVo3ew::.ctor() ldsfld KKUa9pTODmf4hMojWZl KKUa9pTODmf4hMojWZl::qg6TZbVf23 call System.Boolean KKUa9pTODmf4hMojWZl::tnCTT66Xpr(System.Object,KKUa9pTODmf4hMojWZl) brtrue IL_0096: leave IL_002D ldc.i4 1 ldsfld <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6} <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_a16ed184dc7840a8859f8eb96b4ac781 ldfld System.Int32 <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_f6ab5be84a434f5e933d56b407938255 brtrue IL_0074: switch(IL_0090) pop <null> ldc.i4 0 br IL_0074: switch(IL_0090) br IL_0070: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_0070: ldloc V_1 br IL_0090: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 0 ldsfld <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6} <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_a16ed184dc7840a8859f8eb96b4ac781 ldfld System.Int32 <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_fd6f4d6d67db418ea8c8e7ca68e81d4f brfalse IL_00CD: switch(IL_00E9) pop <null> ldc.i4 4 br IL_00CD: switch(IL_00E9) br IL_00C9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C9: ldloc V_2 br IL_00E9: leave IL_002D leave IL_002D: ret ldc.i4 2 ldsfld <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6} <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_a16ed184dc7840a8859f8eb96b4ac781 ldfld System.Int32 <Module>{fc08a985-c321-4f11-92b4-b32c93bc9ed6}::m_b9066dfb93d54905aa8cf756d5574401 brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)