Malicious PE Executable analysis – 76dd5d4252d5

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0

Symbol obfuscation

Very high

1 malicious · 13 files

EXE76dd5d4252d50901b747b1373701a297

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Xqyqcdr.exe
Full Name	Xqyqcdr.exe
EntryPoint	System.Void Xqyqcdr.Axgozwxnr::Main()
Scope Name	Xqyqcdr.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Xqyqcdr
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	41
Main Method	System.Void Xqyqcdr.Axgozwxnr::Main()
Main IL Instruction Count	101
Main IL	ldc.i4 5 stloc V_3 br IL_000E: ldloc V_3 ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_00AE: nop br IL_00AD: ret ldc.i4 2 br IL_0012: switch(IL_00AE,IL_0067,IL_00AD,IL_0034,IL_0043,IL_0087) br IL_0067: nop ldc.i4 1 ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_fd8f14adf9ba403e891b2c328e5c42a3 brfalse IL_0012: switch(IL_00AE,IL_0067,IL_00AD,IL_0034,IL_0043,IL_0087) pop <null> ldc.i4 0 br IL_0012: switch(IL_00AE,IL_0067,IL_00AD,IL_0034,IL_0043,IL_0087) nop <null> ldc.i4 0 ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_7dfd4cce9dca459193d7a6a3270c0e66 brfalse IL_0012: switch(IL_00AE,IL_0067,IL_00AD,IL_0034,IL_0043,IL_0087) pop <null> ldc.i4 0 br IL_0012: switch(IL_00AE,IL_0067,IL_00AD,IL_0034,IL_0043,IL_0087) newobj System.Void Xqyqcdr.Kqacogcwwt::.ctor() stloc.s V_0 ldc.i4 2 ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_54c3825e155545ad9b3ce63990ea5c42 brtrue IL_0012: switch(IL_00AE,IL_0067,IL_00AD,IL_0034,IL_0043,IL_0087) pop <null> ldc.i4 4 br IL_0012: switch(IL_00AE,IL_0067,IL_00AD,IL_0034,IL_0043,IL_0087) ret <null> nop <null> ldloc.s V_0 call System.Byte[] Xqyqcdr.Properties.Sibmw::get_Mfuegmxogfr() ldsfld System.Object FPOH7mERKl7XrEEaYe.A2EIl82rSGuhbZX2RN::Rvk3LyUmV ldsfld System.Object FPOH7mERKl7XrEEaYe.A2EIl82rSGuhbZX2RN::u0QX2LD3g ldc.i4 -1692052295 ldc.i4 6 shr <null> ldc.i4 -917861889 xor <null> ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_ccec41dc19c548fbb9e6c3aecb483009 xor <null> call System.String WHh5cc01taTvK4kQ5vw.M2KuL607QIEDJABtseH::ts708ETjLE(System.Int32) ldc.i4 -1881367238 ldc.i4 -1636547612 sub <null> ldc.i4 -1231089937 xor <null> ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_bbb0741c867b4a379f7bcfe7caf43d0b xor <null> call System.String WHh5cc01taTvK4kQ5vw.M2KuL607QIEDJABtseH::ts708ETjLE(System.Int32) ldnull <null> callvirt System.Void Xqyqcdr.Kqacogcwwt::Esubplvkmz(System.Byte[],System.Byte[],System.Byte[],System.String,System.String,System.Object[]) ldc.i4 0 ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_bd0ef7ff043a468c8ee700e3239baf3d brfalse IL_012B: switch(IL_013D,IL_0161) pop <null> ldc.i4 0 br IL_012B: switch(IL_013D,IL_0161) ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] br IL_013D: br IL_0161 br IL_0161: leave IL_00AD ldc.i4 1 ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_d3be0b9e9ced4d20a75108835dca08f1 brtrue IL_012B: switch(IL_013D,IL_0161) pop <null> ldc.i4 1 br IL_012B: switch(IL_013D,IL_0161) leave IL_00AD: ret pop <null> ldc.i4 0 ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_c47bf161add04e2dba40b5d4fda455d4 brtrue IL_018A: switch(IL_019C,IL_01C0) pop <null> ldc.i4 0 br IL_018A: switch(IL_019C,IL_01C0) ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br IL_019C: br IL_01C0 br IL_01C0: leave IL_00AD ldc.i4 1 ldsfld <Module>{542e9eb0-8771-40d0-b747-2255d8efb800} <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_f48186171131453b9d1690fbba464222 ldfld System.Int32 <Module>{542e9eb0-8771-40d0-b747-2255d8efb800}::m_ccf0d180727f43b8b6ee3ca9d423e891 brfalse IL_018A: switch(IL_019C,IL_01C0) pop <null> ldc.i4 1 br IL_018A: switch(IL_019C,IL_01C0) leave IL_00AD: ret ldc.i4 3 br IL_0012: switch(IL_00AE,IL_0067,IL_00AD,IL_0034,IL_0043,IL_0087)