Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 6 files
EXE76f01710d778ea0f2bf5746993bf46eb
Structure
Name Value
Module Name
Cbzqo.exe
Full Name
Cbzqo.exe
EntryPoint
System.Void baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc::f1BCxw7og()
Scope Name
Cbzqo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cbzqo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc::f1BCxw7og()
Main IL Instruction Count
84
Main IL 
ldc.i4 3
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 991
beq IL_0009: ldloc V_2
br IL_0178: ldsfld GLymv3V5TBoWVJoNhXs GLymv3V5TBoWVJoNhXs::Q4pVn2exDT
ldsfld Is2BeTV3TOAU5IhRc8F Is2BeTV3TOAU5IhRc8F::I4YVpJ4KSA
call System.Void Is2BeTV3TOAU5IhRc8F::yrNV9ddLIb(Is2BeTV3TOAU5IhRc8F)
ldc.i4 0
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_18dd7ad70b534c189aac4ec3f9aa1a3f
brtrue IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
pop <null>
ldc.i4 6
br IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
nop <null>
ldsfld System.Threading.ThreadStart baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::gFl9gfNQo
dup <null>
brtrue IL_00D2: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldc.i4 0
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_1a624eb696a24640bf5b8567abcb704c
brtrue IL_009C: switch(IL_0100,IL_00BC)
pop <null>
ldc.i4 1
br IL_009C: switch(IL_0100,IL_00BC)
br IL_0098: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0098: ldloc V_1
br IL_00BC: ldsfld baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::KfoFDiVfu
ldsfld baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::KfoFDiVfu
ldftn System.Void baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::m1RxIUOVv()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::gFl9gfNQo
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld nG0JnEVsAEFXIDUrfW4 nG0JnEVsAEFXIDUrfW4::jqJVtfVmeK
call System.Void nG0JnEVsAEFXIDUrfW4::yrNV9ddLIb(System.Object,nG0JnEVsAEFXIDUrfW4)
ldc.i4 7
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_d8b907baf7d849c0873e326bcea3a48e
brtrue IL_009C: switch(IL_0100,IL_00BC)
pop <null>
ldc.i4 0
br IL_009C: switch(IL_0100,IL_00BC)
leave IL_0035: ldsfld Is2BeTV3TOAU5IhRc8F Is2BeTV3TOAU5IhRc8F::I4YVpJ4KSA
pop <null>
ldc.i4 0
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_3d5541ac942e4baaae8f82181fffb4ca
brtrue IL_0137: switch(IL_0153)
pop <null>
ldc.i4 2
br IL_0137: switch(IL_0153)
br IL_0133: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0133: ldloc V_0
br IL_0153: leave IL_0035
leave IL_0035: ldsfld Is2BeTV3TOAU5IhRc8F Is2BeTV3TOAU5IhRc8F::I4YVpJ4KSA
ldc.i4 8
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_99ecd67c2a4b43aab398723a0ef37ccd
brfalse IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
ret <null>
ldsfld GLymv3V5TBoWVJoNhXs GLymv3V5TBoWVJoNhXs::Q4pVn2exDT
call System.Void GLymv3V5TBoWVJoNhXs::yrNV9ddLIb(GLymv3V5TBoWVJoNhXs)
ldc.i4 2
br IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
Module Name
Cbzqo.exe
Full Name
Cbzqo.exe
EntryPoint
System.Void baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc::f1BCxw7og()
Scope Name
Cbzqo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Cbzqo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc::f1BCxw7og()
Main IL Instruction Count
84
Main IL 
ldc.i4 3
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 991
beq IL_0009: ldloc V_2
br IL_0178: ldsfld GLymv3V5TBoWVJoNhXs GLymv3V5TBoWVJoNhXs::Q4pVn2exDT
ldsfld Is2BeTV3TOAU5IhRc8F Is2BeTV3TOAU5IhRc8F::I4YVpJ4KSA
call System.Void Is2BeTV3TOAU5IhRc8F::yrNV9ddLIb(Is2BeTV3TOAU5IhRc8F)
ldc.i4 0
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_18dd7ad70b534c189aac4ec3f9aa1a3f
brtrue IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
pop <null>
ldc.i4 6
br IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
nop <null>
ldsfld System.Threading.ThreadStart baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::gFl9gfNQo
dup <null>
brtrue IL_00D2: newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
pop <null>
ldc.i4 0
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_1a624eb696a24640bf5b8567abcb704c
brtrue IL_009C: switch(IL_0100,IL_00BC)
pop <null>
ldc.i4 1
br IL_009C: switch(IL_0100,IL_00BC)
br IL_0098: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_0098: ldloc V_1
br IL_00BC: ldsfld baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::KfoFDiVfu
ldsfld baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::KfoFDiVfu
ldftn System.Void baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::m1RxIUOVv()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadStart baRXWkGVSrA5Rn1bo7.EPDGSXhYrIrHuhQSkc/<>c::gFl9gfNQo
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
ldsfld nG0JnEVsAEFXIDUrfW4 nG0JnEVsAEFXIDUrfW4::jqJVtfVmeK
call System.Void nG0JnEVsAEFXIDUrfW4::yrNV9ddLIb(System.Object,nG0JnEVsAEFXIDUrfW4)
ldc.i4 7
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_d8b907baf7d849c0873e326bcea3a48e
brtrue IL_009C: switch(IL_0100,IL_00BC)
pop <null>
ldc.i4 0
br IL_009C: switch(IL_0100,IL_00BC)
leave IL_0035: ldsfld Is2BeTV3TOAU5IhRc8F Is2BeTV3TOAU5IhRc8F::I4YVpJ4KSA
pop <null>
ldc.i4 0
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_3d5541ac942e4baaae8f82181fffb4ca
brtrue IL_0137: switch(IL_0153)
pop <null>
ldc.i4 2
br IL_0137: switch(IL_0153)
br IL_0133: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0133: ldloc V_0
br IL_0153: leave IL_0035
leave IL_0035: ldsfld Is2BeTV3TOAU5IhRc8F Is2BeTV3TOAU5IhRc8F::I4YVpJ4KSA
ldc.i4 8
ldsfld <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c} <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_57d73819d63e4336a75a9b18aab0f6f8
ldfld System.Int32 <Module>{e7e6fae3-4c03-45c7-946c-441cb1124a1c}::m_99ecd67c2a4b43aab398723a0ef37ccd
brfalse IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
pop <null>
ldc.i4 1
br IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
ret <null>
ldsfld GLymv3V5TBoWVJoNhXs GLymv3V5TBoWVJoNhXs::Q4pVn2exDT
call System.Void GLymv3V5TBoWVJoNhXs::yrNV9ddLIb(GLymv3V5TBoWVJoNhXs)
ldc.i4 2
br IL_000D: switch(IL_0177,IL_0035,IL_005E,IL_0178)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙