Deep Malware Analysis of 7994985f12d0779828101b75dddefb94 | md5: 7994985f12d0779828101b75dddefb94 | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net Obfuscator | .Net Reactor | .Net | SOS: 0.30

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

PeID

.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

Name	Value
Module Name	Gwffteuzw.exe
Full Name	Gwffteuzw.exe
EntryPoint	System.Void HidSharp.Elements.HiddenElement::AccessGroupedElement()
Scope Name	Gwffteuzw.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Gwffteuzw
Assembly Version	1.0.6759.23626
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	754
Main Method	System.Void HidSharp.Elements.HiddenElement::AccessGroupedElement()
Main IL Instruction Count	31
Main IL	ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0053: ret ldsfld System.Action`1<System.IO.MemoryStream> HidSharp.Elements.HiddenElement/<>c::efficientToken dup <null> brtrue IL_006A: call System.Void HidSharp.Elements.HiddenElement::ModifyScopeElement(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 1 ldsfld <Module>{3c82323f-8b76-414f-86ab-79515e95d744} <Module>{3c82323f-8b76-414f-86ab-79515e95d744}::m_493e4920ae814076a883e2787eeed0ca ldfld System.Int32 <Module>{3c82323f-8b76-414f-86ab-79515e95d744}::m_06e0fc6f40114531bada8e0c75a8b1cf brtrue IL_0012: switch(IL_0053,IL_0054,IL_0028) pop <null> ldc.i4 1 br IL_0012: switch(IL_0053,IL_0054,IL_0028) ret <null> ldsfld HidSharp.Elements.HiddenElement/<>c HidSharp.Elements.HiddenElement/<>c::m_FinalizerSystem ldftn System.Void HidSharp.Elements.HiddenElement/<>c::UsePassiveRole(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> HidSharp.Elements.HiddenElement/<>c::efficientToken call System.Void HidSharp.Elements.HiddenElement::ModifyScopeElement(System.Action`1<System.IO.MemoryStream>) ldc.i4 0 ldsfld <Module>{3c82323f-8b76-414f-86ab-79515e95d744} <Module>{3c82323f-8b76-414f-86ab-79515e95d744}::m_493e4920ae814076a883e2787eeed0ca ldfld System.Int32 <Module>{3c82323f-8b76-414f-86ab-79515e95d744}::m_9d593d2744b542ecb2554ad74cebf7e4 brtrue IL_0012: switch(IL_0053,IL_0054,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0053,IL_0054,IL_0028)
Module Name	Gwffteuzw.exe
Full Name	Gwffteuzw.exe
EntryPoint	System.Void HidSharp.Elements.HiddenElement::AccessGroupedElement()
Scope Name	Gwffteuzw.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Gwffteuzw
Assembly Version	1.0.6759.23626
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	754
Main Method	System.Void HidSharp.Elements.HiddenElement::AccessGroupedElement()
Main IL Instruction Count	31
Main IL	ldc.i4 2 stloc V_0 br IL_000E: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_0053: ret ldsfld System.Action`1<System.IO.MemoryStream> HidSharp.Elements.HiddenElement/<>c::efficientToken dup <null> brtrue IL_006A: call System.Void HidSharp.Elements.HiddenElement::ModifyScopeElement(System.Action`1<System.IO.MemoryStream>) pop <null> ldc.i4 1 ldsfld <Module>{3c82323f-8b76-414f-86ab-79515e95d744} <Module>{3c82323f-8b76-414f-86ab-79515e95d744}::m_493e4920ae814076a883e2787eeed0ca ldfld System.Int32 <Module>{3c82323f-8b76-414f-86ab-79515e95d744}::m_06e0fc6f40114531bada8e0c75a8b1cf brtrue IL_0012: switch(IL_0053,IL_0054,IL_0028) pop <null> ldc.i4 1 br IL_0012: switch(IL_0053,IL_0054,IL_0028) ret <null> ldsfld HidSharp.Elements.HiddenElement/<>c HidSharp.Elements.HiddenElement/<>c::m_FinalizerSystem ldftn System.Void HidSharp.Elements.HiddenElement/<>c::UsePassiveRole(System.IO.MemoryStream) newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.Action`1<System.IO.MemoryStream> HidSharp.Elements.HiddenElement/<>c::efficientToken call System.Void HidSharp.Elements.HiddenElement::ModifyScopeElement(System.Action`1<System.IO.MemoryStream>) ldc.i4 0 ldsfld <Module>{3c82323f-8b76-414f-86ab-79515e95d744} <Module>{3c82323f-8b76-414f-86ab-79515e95d744}::m_493e4920ae814076a883e2787eeed0ca ldfld System.Int32 <Module>{3c82323f-8b76-414f-86ab-79515e95d744}::m_9d593d2744b542ecb2554ad74cebf7e4 brtrue IL_0012: switch(IL_0053,IL_0054,IL_0028) pop <null> ldc.i4 0 br IL_0012: switch(IL_0053,IL_0054,IL_0028)