Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
733fc22345484e3139c942d71fdf1b4c
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
1zjZm.Resources.resources
1zjZm.g.resources
9cce71da2c2f1b.Resources.resources
bf3856d50
[NBF]root.Data
bf3856d51
[NBF]root.Data
bf3856d52
[NBF]root.Data
bf3856d53
[NBF]root.Data
bf3856d54
[NBF]root.Data
bf3856d55
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
1zjZm
Full Name
1zjZm
EntryPoint
System.Void 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj::4oqSraM3cL7q8f()
Scope Name
1zjZm
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1zjZm
Assembly Version
24.21.5.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj::4oqSraM3cL7q8f()
Main IL Instruction Count
283
Main IL 
ldsfld System.Int32[] 4fkLc.Ri1a0qfMb2::3ZpknxK24giYX
stloc.s V_22
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
br.s IL_0017: ldc.i4.s 15
ldc.i4.s 15
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0064: nop
nop <null>
ldc.i4.1 <null>
newobj System.Void System.Diagnostics.StackTrace::.ctor(System.Boolean)
stloc.0 <null>
ldloc.0 <null>
callvirt System.Diagnostics.StackFrame[] System.Diagnostics.StackTrace::GetFrames()
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4.4 <null>
stloc.s V_21
br.s IL_001B: ldloc.s V_21
ldloc.s V_12
brfalse.s IL_0088: ldc.i4.s 13
ldc.i4.s 9
stloc.s V_21
br.s IL_001B: ldloc.s V_21
ldc.i4.s 13
br.s IL_0084: stloc.s V_21
leave IL_034D: ret
nop <null>
ldc.i4.6 <null>
ldc.i4 279368131
ldc.i4.s 23
ldnull <null>
call System.String mp2NHdn3y5gF0.xPt91fgD::tr0M3DqyzrE4Yy(System.Int32,System.Int32,System.Byte,System.String)
call System.Boolean 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj::4nyRz(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldc.i4.s 11
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.s V_13
brfalse.s IL_00C0: ldloc.s V_22
ldc.i4.s 12
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.s V_22
ldc.i4 310
ldelem.i4 <null>
ldc.i4 29233
ldsfld System.Char[] 7zqRCg9o.dWz0Cr4::0GswCj9n3Qcit
ldc.i4 467
ldsfld System.Char[] 7zqRCg9o.dWz0Cr4::0GswCj9n3Qcit
ldc.i4 467
ldelem.u2 <null>
ldsfld System.Char[] 7zqRCg9o.dWz0Cr4::0GswCj9n3Qcit
ldc.i4.s 82
ldelem.u2 <null>
and <null>
ldc.i4.s 126
and <null>
stelem.i2 <null>
sub <null>
br.s IL_00B9: stloc.s V_21
leave IL_034D: ret
ldc.i4.s 10
stloc.1 <null>
ldc.i4.s 25
stloc.2 <null>
ldloc.1 <null>
ldloc.2 <null>
mul.ovf <null>
ldc.i4.s 10
div <null>
stloc.3 <null>
ldc.i4.s 14
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.3 <null>
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_4
ldc.i4.s 14
newarr System.Char
dup <null>
ldtoken Bfr3o7xW.<PrivateImplementationDetails>/xP_5q4En3irKo.ႤႣႥ Bfr3o7xW.<PrivateImplementationDetails>::B3373FC3DF27B18CB59DA4B5CB85F97BE9B58AB913F8B674E71A6EF84C47246A
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_5
ldc.i4.s 10
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.s V_5
newobj System.Void System.String::.ctor(System.Char[])
stloc.s V_6
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_6
stelem.ref <null>
ldloc.s V_6
call System.Byte[] Zmy7kL5.jz7AQ1xbyw::Gxs08(System.String)
stloc.s V_7
ldc.i4.7 <null>
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.s V_7
ldnull <null>
ceq <null>
stloc.s V_14
ldloc.s V_14
brfalse.s IL_0169: ldc.i4.8
ldc.i4.0 <null>
stloc.s V_21
br IL_001B: ldloc.s V_21
ldc.i4.8 <null>
br.s IL_0162: stloc.s V_21
leave IL_034D: ret
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_8
ldloc.s V_8
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void System.Threading.Monitor::Enter(System.Object)
nop <null>
br.s IL_018C: br.s IL_018E
br.s IL_018E: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01AE: nop
nop <null>
ldloc.s V_4
ldc.i4.2 <null>
ldloc.s V_7
stelem.ref <null>
ldloc.s V_4
ldc.i4.3 <null>
ldloc.s V_7
call System.Byte[] 7Jjxt.eJy1E4imprQ0z9::bLw6sp9K7(System.Byte[])
stelem.ref <null>
leave.s IL_01F3: br.s IL_01F5
br.s IL_01C4: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_26
ldloc.s V_26
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01E4: nop
nop <null>
ldloc.s V_8
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void System.Threading.Monitor::Exit(System.Object)
nop <null>
endfinally <null>
br.s IL_01F5: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_28
ldloc.s V_28
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_022D: nop
nop <null>
ldc.i4.7 <null>
newobj System.Void System.Text.StringBuilder::.ctor(System.Int32)
stloc.s V_9
ldloc.s V_9
callvirt System.Text.StringBuilder System.Text.StringBuilder::Clear()
pop <null>
ldc.i4.7 <null>
newarr System.Char
dup <null>
ldtoken Bfr3o7xW.<PrivateImplementationDetails>/rFk52eRqsJi8p.ႤႣႭ Bfr3o7xW.<PrivateImplementationDetails>::9B425D78411BF937F05FB72623B29FD8A823EFBA6CF3559209E071C19208DD31
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_28
br.s IL_01F8: ldloc.s V_28
ldloc.s V_10
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
ldc.i4.s 10
stloc.s V_28
br.s IL_01F8: ldloc.s V_28
ldloc.s V_15
ldloc.s V_16
ldelem.u2 <null>
stloc.s V_17
ldloc.s V_9
ldloc.s V_17
callvirt System.Text.StringBuilder System.Text.StringBuilder::Append(System.Char)
pop <null>
nop <null>
ldloc.s V_16
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_16
ldc.i4.s 10
stloc.s V_28
br IL_01F8: ldloc.s V_28
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
clt <null>
stloc.s V_18
ldloc.s V_18
brtrue.s IL_029B: ldc.i4.2
ldc.i4.s 9
stloc.s V_28
br IL_01F8: ldloc.s V_28
ldc.i4.2 <null>
br.s IL_0294: stloc.s V_28
ldloc.s V_9
callvirt System.String System.Text.StringBuilder::ToString()
stloc.s V_11
ldloc.s V_11
ldloc.s V_4
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object 2Hpay3.e_3Nz8Mn/Zys3am4WD.Lct4k::Zw9if7S(System.String,System.Object)
pop <null>
ldc.i4.1 <null>
stloc.s V_28
br IL_01F8: ldloc.s V_28
nop <null>
ldc.i4 689946484
ldc.i4.2 <null>
ldnull <null>
call System.String 3Qqrw6zPLx1p.Stk24Tfi::3ncPymF72(System.Int32,System.Int32,System.Reflection.Assembly)
nop <null>
ldc.i8 4
ldc.i4 298902057
ldc.i4.2 <null>
call System.String 3Qqrw6zPLx1p.Stk24Tfi::yr7W5M(System.Int64,System.Int32,System.Int32)
call System.Void 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj/Eqw5k0iJyQ.Kg7o5_yF::tJj0ii6Sb3Wm(System.String,System.String)
ldc.i4.4 <null>
stloc.s V_28
br IL_01F8: ldloc.s V_28
nop <null>
call System.Void System.Threading.Thread::MemoryBarrier()
nop <null>
ldloc.s V_4
call System.Void System.GC::KeepAlive(System.Object)
nop <null>
leave.s IL_0321: br.s IL_0323
br.s IL_0302: br.s IL_0304
br.s IL_0304: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_19
nop <null>
call System.Void System.Windows.Forms.Application::ExitThread()
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0321: br.s IL_0323
br.s IL_0323: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_30
ldloc.s V_30
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0347: nop
nop <null>
ldc.i4.0 <null>
stloc.s V_30
br.s IL_0326: ldloc.s V_30
ret <null>
ldtoken System.Void 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj::4oqSraM3cL7q8f()
pop <null>
ret <null>
Module Name
1zjZm
Full Name
1zjZm
EntryPoint
System.Void 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj::4oqSraM3cL7q8f()
Scope Name
1zjZm
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
1zjZm
Assembly Version
24.21.5.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj::4oqSraM3cL7q8f()
Main IL Instruction Count
283
Main IL 
ldsfld System.Int32[] 4fkLc.Ri1a0qfMb2::3ZpknxK24giYX
stloc.s V_22
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
br.s IL_0017: ldc.i4.s 15
ldc.i4.s 15
stloc.s V_21
ldloc.s V_21
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0064: nop
nop <null>
ldc.i4.1 <null>
newobj System.Void System.Diagnostics.StackTrace::.ctor(System.Boolean)
stloc.0 <null>
ldloc.0 <null>
callvirt System.Diagnostics.StackFrame[] System.Diagnostics.StackTrace::GetFrames()
ldlen <null>
conv.i4 <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_12
ldc.i4.4 <null>
stloc.s V_21
br.s IL_001B: ldloc.s V_21
ldloc.s V_12
brfalse.s IL_0088: ldc.i4.s 13
ldc.i4.s 9
stloc.s V_21
br.s IL_001B: ldloc.s V_21
ldc.i4.s 13
br.s IL_0084: stloc.s V_21
leave IL_034D: ret
nop <null>
ldc.i4.6 <null>
ldc.i4 279368131
ldc.i4.s 23
ldnull <null>
call System.String mp2NHdn3y5gF0.xPt91fgD::tr0M3DqyzrE4Yy(System.Int32,System.Int32,System.Byte,System.String)
call System.Boolean 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj::4nyRz(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_13
ldc.i4.s 11
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.s V_13
brfalse.s IL_00C0: ldloc.s V_22
ldc.i4.s 12
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.s V_22
ldc.i4 310
ldelem.i4 <null>
ldc.i4 29233
ldsfld System.Char[] 7zqRCg9o.dWz0Cr4::0GswCj9n3Qcit
ldc.i4 467
ldsfld System.Char[] 7zqRCg9o.dWz0Cr4::0GswCj9n3Qcit
ldc.i4 467
ldelem.u2 <null>
ldsfld System.Char[] 7zqRCg9o.dWz0Cr4::0GswCj9n3Qcit
ldc.i4.s 82
ldelem.u2 <null>
and <null>
ldc.i4.s 126
and <null>
stelem.i2 <null>
sub <null>
br.s IL_00B9: stloc.s V_21
leave IL_034D: ret
ldc.i4.s 10
stloc.1 <null>
ldc.i4.s 25
stloc.2 <null>
ldloc.1 <null>
ldloc.2 <null>
mul.ovf <null>
ldc.i4.s 10
div <null>
stloc.3 <null>
ldc.i4.s 14
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.3 <null>
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_4
ldc.i4.s 14
newarr System.Char
dup <null>
ldtoken Bfr3o7xW.<PrivateImplementationDetails>/xP_5q4En3irKo.ႤႣႥ Bfr3o7xW.<PrivateImplementationDetails>::B3373FC3DF27B18CB59DA4B5CB85F97BE9B58AB913F8B674E71A6EF84C47246A
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_5
ldc.i4.s 10
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.s V_5
newobj System.Void System.String::.ctor(System.Char[])
stloc.s V_6
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_6
stelem.ref <null>
ldloc.s V_6
call System.Byte[] Zmy7kL5.jz7AQ1xbyw::Gxs08(System.String)
stloc.s V_7
ldc.i4.7 <null>
stloc.s V_21
br IL_001B: ldloc.s V_21
ldloc.s V_7
ldnull <null>
ceq <null>
stloc.s V_14
ldloc.s V_14
brfalse.s IL_0169: ldc.i4.8
ldc.i4.0 <null>
stloc.s V_21
br IL_001B: ldloc.s V_21
ldc.i4.8 <null>
br.s IL_0162: stloc.s V_21
leave IL_034D: ret
newobj System.Void System.Object::.ctor()
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_8
ldloc.s V_8
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void System.Threading.Monitor::Enter(System.Object)
nop <null>
br.s IL_018C: br.s IL_018E
br.s IL_018E: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_24
ldloc.s V_24
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01AE: nop
nop <null>
ldloc.s V_4
ldc.i4.2 <null>
ldloc.s V_7
stelem.ref <null>
ldloc.s V_4
ldc.i4.3 <null>
ldloc.s V_7
call System.Byte[] 7Jjxt.eJy1E4imprQ0z9::bLw6sp9K7(System.Byte[])
stelem.ref <null>
leave.s IL_01F3: br.s IL_01F5
br.s IL_01C4: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_26
ldloc.s V_26
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01E4: nop
nop <null>
ldloc.s V_8
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Void System.Threading.Monitor::Exit(System.Object)
nop <null>
endfinally <null>
br.s IL_01F5: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_28
ldloc.s V_28
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_022D: nop
nop <null>
ldc.i4.7 <null>
newobj System.Void System.Text.StringBuilder::.ctor(System.Int32)
stloc.s V_9
ldloc.s V_9
callvirt System.Text.StringBuilder System.Text.StringBuilder::Clear()
pop <null>
ldc.i4.7 <null>
newarr System.Char
dup <null>
ldtoken Bfr3o7xW.<PrivateImplementationDetails>/rFk52eRqsJi8p.ႤႣႭ Bfr3o7xW.<PrivateImplementationDetails>::9B425D78411BF937F05FB72623B29FD8A823EFBA6CF3559209E071C19208DD31
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_28
br.s IL_01F8: ldloc.s V_28
ldloc.s V_10
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
ldc.i4.s 10
stloc.s V_28
br.s IL_01F8: ldloc.s V_28
ldloc.s V_15
ldloc.s V_16
ldelem.u2 <null>
stloc.s V_17
ldloc.s V_9
ldloc.s V_17
callvirt System.Text.StringBuilder System.Text.StringBuilder::Append(System.Char)
pop <null>
nop <null>
ldloc.s V_16
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_16
ldc.i4.s 10
stloc.s V_28
br IL_01F8: ldloc.s V_28
ldloc.s V_16
ldloc.s V_15
ldlen <null>
conv.i4 <null>
clt <null>
stloc.s V_18
ldloc.s V_18
brtrue.s IL_029B: ldc.i4.2
ldc.i4.s 9
stloc.s V_28
br IL_01F8: ldloc.s V_28
ldc.i4.2 <null>
br.s IL_0294: stloc.s V_28
ldloc.s V_9
callvirt System.String System.Text.StringBuilder::ToString()
stloc.s V_11
ldloc.s V_11
ldloc.s V_4
ldc.i4.3 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Object 2Hpay3.e_3Nz8Mn/Zys3am4WD.Lct4k::Zw9if7S(System.String,System.Object)
pop <null>
ldc.i4.1 <null>
stloc.s V_28
br IL_01F8: ldloc.s V_28
nop <null>
ldc.i4 689946484
ldc.i4.2 <null>
ldnull <null>
call System.String 3Qqrw6zPLx1p.Stk24Tfi::3ncPymF72(System.Int32,System.Int32,System.Reflection.Assembly)
nop <null>
ldc.i8 4
ldc.i4 298902057
ldc.i4.2 <null>
call System.String 3Qqrw6zPLx1p.Stk24Tfi::yr7W5M(System.Int64,System.Int32,System.Int32)
call System.Void 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj/Eqw5k0iJyQ.Kg7o5_yF::tJj0ii6Sb3Wm(System.String,System.String)
ldc.i4.4 <null>
stloc.s V_28
br IL_01F8: ldloc.s V_28
nop <null>
call System.Void System.Threading.Thread::MemoryBarrier()
nop <null>
ldloc.s V_4
call System.Void System.GC::KeepAlive(System.Object)
nop <null>
leave.s IL_0321: br.s IL_0323
br.s IL_0302: br.s IL_0304
br.s IL_0304: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_19
nop <null>
call System.Void System.Windows.Forms.Application::ExitThread()
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0321: br.s IL_0323
br.s IL_0323: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_30
ldloc.s V_30
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0347: nop
nop <null>
ldc.i4.0 <null>
stloc.s V_30
br.s IL_0326: ldloc.s V_30
ret <null>
ldtoken System.Void 7Jjxt.eJy1E4imprQ0z9/Eia79.0Sjpft6Qn3Rcj::4oqSraM3cL7q8f()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙