Malicious PE Executable analysis – 787fa0e7475f

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ DLLMicrosoft Visual C++ v6.0UPolyX 0.3 -> delikon

Symbol obfuscation

Very high

1 malicious · 6 files

EXE787fa0e7475f0ab410a0b3407ff75506

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	tmpVCIL04536721updater.exe
Full Name	tmpVCIL04536721updater.exe
EntryPoint	System.Void PoQ8PxtCg8fTJ71JyL.MqEalm36aGg0heMtrn::jUhCw86r2()
Scope Name	tmpVCIL04536721updater.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	tmpVCIL04536721updater
Assembly Version	158.32.5.64
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.8
Total Strings	39
Main Method	System.Void PoQ8PxtCg8fTJ71JyL.MqEalm36aGg0heMtrn::jUhCw86r2()
Main IL Instruction Count	42
Main IL	ldc.i4 5 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_00AA: ldc.i4.0 ldsfld npUxUt4Du4a7ZD5RCuC npUxUt4Du4a7ZD5RCuC::fLR4AltsXn call System.Void npUxUt4Du4a7ZD5RCuC::YeS2LdDG0e(npUxUt4Du4a7ZD5RCuC) ldc.i4 0 ldsfld <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64} <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64}::m_ff15f31443b341089de29e2aae060844 ldfld System.Int32 <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64}::m_26a8cf4e11f1423f92ee8bbbfa4f3ff1 brfalse IL_0012: switch(IL_00AA,IL_009A,IL_0081,IL_00A9,IL_0034,IL_005D) pop <null> ldc.i4 0 br IL_0012: switch(IL_00AA,IL_009A,IL_0081,IL_00A9,IL_0034,IL_005D) call System.Void cei9IEPLnBinPst4VMt.TiWcyAPo5E5kdJYAJCQ::kLjw4iIsCLsZtxc4lksN0j() ldc.i4 4 ldsfld <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64} <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64}::m_ff15f31443b341089de29e2aae060844 ldfld System.Int32 <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64}::m_147f8a430e824973aefcf207f17d59a2 brtrue IL_0012: switch(IL_00AA,IL_009A,IL_0081,IL_00A9,IL_0034,IL_005D) pop <null> ldc.i4 3 br IL_0012: switch(IL_00AA,IL_009A,IL_0081,IL_00A9,IL_0034,IL_005D) newobj System.Void Gfhs7gXs3o0Lpse.Gd9olpxDsg3T::.ctor() ldsfld inJuin4qPAYWNhe6o4Q inJuin4qPAYWNhe6o4Q::VpQ4r0J81K call System.Void inJuin4qPAYWNhe6o4Q::YeS2LdDG0e(System.Windows.Forms.Form,inJuin4qPAYWNhe6o4Q) ldc.i4 3 br IL_0012: switch(IL_00AA,IL_009A,IL_0081,IL_00A9,IL_0034,IL_005D) call System.Void QTyA3oP34a84e7ltZPx.urUaqvPFAffyR968nIo::Cav8JhFruG() ldc.i4 2 br IL_0012: switch(IL_00AA,IL_009A,IL_0081,IL_00A9,IL_0034,IL_005D) ret <null> ldc.i4.0 <null> ldsfld OwAuTn4gB3ewm2JVr4N OwAuTn4gB3ewm2JVr4N::NIF4bONSQd call System.Void OwAuTn4gB3ewm2JVr4N::YeS2LdDG0e(System.Boolean,OwAuTn4gB3ewm2JVr4N) ldc.i4 0 ldsfld <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64} <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64}::m_ff15f31443b341089de29e2aae060844 ldfld System.Int32 <Module>{44218a0a-8d67-4ef5-9c85-ede0bb975a64}::m_083d8fbcb1504f40833659b333e2210b brtrue IL_0012: switch(IL_00AA,IL_009A,IL_0081,IL_00A9,IL_0034,IL_005D) pop <null> ldc.i4 1 br IL_0012: switch(IL_00AA,IL_009A,IL_0081,IL_00A9,IL_0034,IL_005D)