Malicious PE Executable analysis – 729e1fea3879

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXE729e1fea387939d388ef597d9bd5c35e

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Whrjeldqku.exe
Full Name	Whrjeldqku.exe
EntryPoint	System.Void oCXSMyfZPlAT9UJtWl.LUtX5p6VJBRhm9W89F::EponvhGOf()
Scope Name	Whrjeldqku.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Whrjeldqku
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void oCXSMyfZPlAT9UJtWl.LUtX5p6VJBRhm9W89F::EponvhGOf()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_002E: nop ret <null> nop <null> newobj System.Void CsH3qcYm4x8N5JwmHG.a1kfoIvkTUQMf4FA2i::.ctor() ldsfld uKxEnRBnlRcJ7FwnxHU uKxEnRBnlRcJ7FwnxHU::gKdBs2DHuf call System.Boolean uKxEnRBnlRcJ7FwnxHU::Y4RBB4dsoG(System.Object,uKxEnRBnlRcJ7FwnxHU) brtrue IL_0096: leave IL_002D ldc.i4 1 ldsfld <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a} <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_c3c03cac836d42e28db2e20d0ab31c9e ldfld System.Int32 <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_02f7417d07be4440a4bdeda57426dcca brfalse IL_0074: switch(IL_0090) pop <null> ldc.i4 0 br IL_0074: switch(IL_0090) br IL_0070: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0070: ldloc V_0 br IL_0090: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 4 ldsfld <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a} <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_c3c03cac836d42e28db2e20d0ab31c9e ldfld System.Int32 <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_79f9cf16b7454979a5f18e96c391d9ed brtrue IL_00CD: switch(IL_00E9) pop <null> ldc.i4 0 br IL_00CD: switch(IL_00E9) br IL_00C9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C9: ldloc V_2 br IL_00E9: leave IL_002D leave IL_002D: ret ldc.i4 6 ldsfld <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a} <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_c3c03cac836d42e28db2e20d0ab31c9e ldfld System.Int32 <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_eb536f3e68224391bb33e687535cc6a8 brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)
Module Name	Whrjeldqku.exe
Full Name	Whrjeldqku.exe
EntryPoint	System.Void oCXSMyfZPlAT9UJtWl.LUtX5p6VJBRhm9W89F::EponvhGOf()
Scope Name	Whrjeldqku.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Whrjeldqku
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void oCXSMyfZPlAT9UJtWl.LUtX5p6VJBRhm9W89F::EponvhGOf()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_002E: nop ret <null> nop <null> newobj System.Void CsH3qcYm4x8N5JwmHG.a1kfoIvkTUQMf4FA2i::.ctor() ldsfld uKxEnRBnlRcJ7FwnxHU uKxEnRBnlRcJ7FwnxHU::gKdBs2DHuf call System.Boolean uKxEnRBnlRcJ7FwnxHU::Y4RBB4dsoG(System.Object,uKxEnRBnlRcJ7FwnxHU) brtrue IL_0096: leave IL_002D ldc.i4 1 ldsfld <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a} <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_c3c03cac836d42e28db2e20d0ab31c9e ldfld System.Int32 <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_02f7417d07be4440a4bdeda57426dcca brfalse IL_0074: switch(IL_0090) pop <null> ldc.i4 0 br IL_0074: switch(IL_0090) br IL_0070: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0070: ldloc V_0 br IL_0090: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_002D: ret pop <null> ldc.i4 4 ldsfld <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a} <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_c3c03cac836d42e28db2e20d0ab31c9e ldfld System.Int32 <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_79f9cf16b7454979a5f18e96c391d9ed brtrue IL_00CD: switch(IL_00E9) pop <null> ldc.i4 0 br IL_00CD: switch(IL_00E9) br IL_00C9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00C9: ldloc V_2 br IL_00E9: leave IL_002D leave IL_002D: ret ldc.i4 6 ldsfld <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a} <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_c3c03cac836d42e28db2e20d0ab31c9e ldfld System.Int32 <Module>{c45ccf47-d306-4f86-9c6b-483362f3a86a}::m_eb536f3e68224391bb33e687535cc6a8 brtrue IL_000D: switch(IL_002D,IL_002E) pop <null> ldc.i4 0 br IL_000D: switch(IL_002D,IL_002E)