Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableHQR data fileMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 8 files
EXE7c3ab69a303b33b506e0a777d5b04c07
Structure
Name Value
Module Name
Vshaomuef.exe
Full Name
Vshaomuef.exe
EntryPoint
System.Void MG8qV76xod3ZV8Z3b7.pRrq2yPBT7ndnARlxa::jG5nBElk4()
Scope Name
Vshaomuef.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vshaomuef
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void MG8qV76xod3ZV8Z3b7.pRrq2yPBT7ndnARlxa::jG5nBElk4()
Main IL Instruction Count
83
Main IL 
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0009: ldloc V_3
br IL_002D: nop
nop <null>
call System.Boolean fVXhXlSN9RjoZthXrd.ElcDBguHqTE7mBImTW::TUrd377Mn()
brtrue IL_00AC: leave IL_0173
ldc.i4 0
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_109c98d2c4ab4a8882f7d83523e8444c
brtrue IL_0069: switch(IL_0085)
pop <null>
ldc.i4 5
br IL_0069: switch(IL_0085)
br IL_0065: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0065: ldloc V_0
br IL_0085: ldc.i4 -717790180
ldc.i4 -717790180
ldc.i4 381461225
sub <null>
ldc.i4 -1740499504
xor <null>
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_57c8497e08c140f0ae0848dc23120513
xor <null>
call System.String CUj7v8kFXnAdAyHAc6.abhpqR1tN45TCCmq4F::JEpQc0y0fY(System.Int32)
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
leave IL_0173: ret
stloc.s V_2
ldc.i4 4
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_57871ec8147b49c2ab75599d51ce2a7c
brtrue IL_00E4: switch(IL_014F,IL_0104)
pop <null>
ldc.i4 1
br IL_00E4: switch(IL_014F,IL_0104)
br IL_00E0: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_00E0: ldloc V_1
br IL_0104: ldc.i4 -25192107
ldc.i4 -25192107
ldc.i4 -250859600
xor <null>
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_46ee9ed5acf14f4c9e0f393660bb66b1
xor <null>
call System.String CUj7v8kFXnAdAyHAc6.abhpqR1tN45TCCmq4F::JEpQc0y0fY(System.Int32)
ldloc.s V_2
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4 4
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_37f37a84949c47d7a5efcd48f3808f6a
brfalse IL_00E4: switch(IL_014F,IL_0104)
pop <null>
ldc.i4 0
br IL_00E4: switch(IL_014F,IL_0104)
leave IL_0173: ret
ldc.i4 0
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_9ca00cffe59a4aaaaffcd8583e918057
brtrue IL_000D: switch(IL_0173,IL_002D)
pop <null>
ldc.i4 3
br IL_000D: switch(IL_0173,IL_002D)
ret <null>
Module Name
Vshaomuef.exe
Full Name
Vshaomuef.exe
EntryPoint
System.Void MG8qV76xod3ZV8Z3b7.pRrq2yPBT7ndnARlxa::jG5nBElk4()
Scope Name
Vshaomuef.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Vshaomuef
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
43
Main Method
System.Void MG8qV76xod3ZV8Z3b7.pRrq2yPBT7ndnARlxa::jG5nBElk4()
Main IL Instruction Count
83
Main IL 
ldc.i4 1
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 989
beq IL_0009: ldloc V_3
br IL_002D: nop
nop <null>
call System.Boolean fVXhXlSN9RjoZthXrd.ElcDBguHqTE7mBImTW::TUrd377Mn()
brtrue IL_00AC: leave IL_0173
ldc.i4 0
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_109c98d2c4ab4a8882f7d83523e8444c
brtrue IL_0069: switch(IL_0085)
pop <null>
ldc.i4 5
br IL_0069: switch(IL_0085)
br IL_0065: ldloc V_0
ldc.i4 0
stloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_0
ldc.i4 988
beq IL_0065: ldloc V_0
br IL_0085: ldc.i4 -717790180
ldc.i4 -717790180
ldc.i4 381461225
sub <null>
ldc.i4 -1740499504
xor <null>
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_57c8497e08c140f0ae0848dc23120513
xor <null>
call System.String CUj7v8kFXnAdAyHAc6.abhpqR1tN45TCCmq4F::JEpQc0y0fY(System.Int32)
newobj System.Void System.Exception::.ctor(System.String)
throw <null>
leave IL_0173: ret
stloc.s V_2
ldc.i4 4
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_57871ec8147b49c2ab75599d51ce2a7c
brtrue IL_00E4: switch(IL_014F,IL_0104)
pop <null>
ldc.i4 1
br IL_00E4: switch(IL_014F,IL_0104)
br IL_00E0: ldloc V_1
ldc.i4 0
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 989
beq IL_00E0: ldloc V_1
br IL_0104: ldc.i4 -25192107
ldc.i4 -25192107
ldc.i4 -250859600
xor <null>
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_46ee9ed5acf14f4c9e0f393660bb66b1
xor <null>
call System.String CUj7v8kFXnAdAyHAc6.abhpqR1tN45TCCmq4F::JEpQc0y0fY(System.Int32)
ldloc.s V_2
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
ldc.i4 4
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_37f37a84949c47d7a5efcd48f3808f6a
brfalse IL_00E4: switch(IL_014F,IL_0104)
pop <null>
ldc.i4 0
br IL_00E4: switch(IL_014F,IL_0104)
leave IL_0173: ret
ldc.i4 0
ldsfld <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d} <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_2639c7e072c4432c8c512b08b0ee5c2a
ldfld System.Int32 <Module>{31d4e73f-27cb-467a-b35a-56ad20975c3d}::m_9ca00cffe59a4aaaaffcd8583e918057
brtrue IL_000D: switch(IL_0173,IL_002D)
pop <null>
ldc.i4 3
br IL_000D: switch(IL_0173,IL_002D)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙