Malicious PE Executable analysis – 6eaa48487ed8

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET

Symbol obfuscation

Low

1 malicious · 5 files

EXE6eaa48487ed8cc8291818568acec2412

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
Full Name	SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
EntryPoint	System.Void HidSharp.Conversion.ConfigParameter::WatchConverter()
Scope Name	SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	SAP Ariba ADNOC site Contract RQF 04082025-PDF
Assembly Version	1.0.277.15133
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	754
Main Method	System.Void HidSharp.Conversion.ConfigParameter::WatchConverter()
Main IL Instruction Count	32
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0059: ldsfld HidSharp.Conversion.ConfigParameter/<>c HidSharp.Conversion.ConfigParameter/<>c::_ScalableSelector ret <null> ldsfld System.Action`1<System.IO.MemoryStream> HidSharp.Conversion.ConfigParameter/<>c::m_SolverSelector dup <null> brfalse IL_0039: pop br IL_006F: call System.Void HidSharp.Conversion.ConfigParameter::ConvertHiddenConverter(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 0 ldsfld <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35} <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_2c6c5b4dee9546d9b0f6974a064bc588 ldfld System.Int32 <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_06b04bad3bbe49ea92d9faf51f441f47 brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0059,IL_0029,IL_0028) ldsfld HidSharp.Conversion.ConfigParameter/<>c HidSharp.Conversion.ConfigParameter/<>c::_ScalableSelector ldftn System.Void HidSharp.Conversion.ConfigParameter/<>c::FilterJoinedExplorer(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> HidSharp.Conversion.ConfigParameter/<>c::m_SolverSelector call System.Void HidSharp.Conversion.ConfigParameter::ConvertHiddenConverter(System.Action`1<System.IO.MemoryStream>) ldc.i4 1 ldsfld <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35} <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_2c6c5b4dee9546d9b0f6974a064bc588 ldfld System.Int32 <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_002e8f41611f4e9db68361d291160f1b brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 2 br IL_0012: switch(IL_0059,IL_0029,IL_0028)
Module Name	SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
Full Name	SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
EntryPoint	System.Void HidSharp.Conversion.ConfigParameter::WatchConverter()
Scope Name	SAP Ariba ADNOC site Contract RQF 04082025-PDF.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	SAP Ariba ADNOC site Contract RQF 04082025-PDF
Assembly Version	1.0.277.15133
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	754
Main Method	System.Void HidSharp.Conversion.ConfigParameter::WatchConverter()
Main IL Instruction Count	32
Main IL	ldc.i4 1 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0059: ldsfld HidSharp.Conversion.ConfigParameter/<>c HidSharp.Conversion.ConfigParameter/<>c::_ScalableSelector ret <null> ldsfld System.Action`1<System.IO.MemoryStream> HidSharp.Conversion.ConfigParameter/<>c::m_SolverSelector dup <null> brfalse IL_0039: pop br IL_006F: call System.Void HidSharp.Conversion.ConfigParameter::ConvertHiddenConverter(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 0 ldsfld <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35} <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_2c6c5b4dee9546d9b0f6974a064bc588 ldfld System.Int32 <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_06b04bad3bbe49ea92d9faf51f441f47 brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0059,IL_0029,IL_0028) ldsfld HidSharp.Conversion.ConfigParameter/<>c HidSharp.Conversion.ConfigParameter/<>c::_ScalableSelector ldftn System.Void HidSharp.Conversion.ConfigParameter/<>c::FilterJoinedExplorer(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> HidSharp.Conversion.ConfigParameter/<>c::m_SolverSelector call System.Void HidSharp.Conversion.ConfigParameter::ConvertHiddenConverter(System.Action`1<System.IO.MemoryStream>) ldc.i4 1 ldsfld <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35} <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_2c6c5b4dee9546d9b0f6974a064bc588 ldfld System.Int32 <Module>{44a9b686-c3ff-4786-8551-ea796f52bc35}::m_002e8f41611f4e9db68361d291160f1b brfalse IL_0012: switch(IL_0059,IL_0029,IL_0028) pop <null> ldc.i4 2 br IL_0012: switch(IL_0059,IL_0029,IL_0028)