Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 8 files
EXE8090eb445c3526aba6f73220f98d2376
Structure
Name Value
Info
PDB Path: VGeko.pdb
Module Name
VGeko.exe
Full Name
VGeko.exe
EntryPoint
System.Void M4NGqDA5GTyd9ikUEE.wQdSOoOwaLo5icF4WZ::KlXYGtrAeg(System.String[])
Scope Name
VGeko.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VGeko
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.1
Total Strings
111
Main Method
System.Void M4NGqDA5GTyd9ikUEE.wQdSOoOwaLo5icF4WZ::KlXYGtrAeg(System.String[])
Main IL Instruction Count
76
Main IL 
br.s IL_0007: call System.Void jgMgvwsTYn45gIiB4m.iSAtsBxuCbdBOJUQpY::kLjw4iIsCLsZtxc4lksN0j()
call <null>
call System.Void jgMgvwsTYn45gIiB4m.iSAtsBxuCbdBOJUQpY::kLjw4iIsCLsZtxc4lksN0j()
call System.Boolean mSuyEuLdi6j4f9UEdV.BUykrEDZkkPTuNFqYb::K8DYzL4PLj()
brtrue IL_0034: ldc.i4.0
ldc.i4 13778
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldc.i4 6936
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ret <null>
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.1 <null>
ldc.i4 14166
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
pop <null>
ldarg.0 <null>
ldlen <null>
brfalse IL_0083: ldloc.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br IL_007B: ldloc.2
nop <null>
ldloc.1 <null>
call System.Void System.IO.File::Delete(System.String)
leave IL_0083: ldloc.0
pop <null>
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
leave IL_0077: ldloc.2
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4.s 10
ble IL_005B: nop
ldloc.0 <null>
brtrue IL_00AC: ldc.i4.2
ldc.i4 14180
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldc.i4 6936
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4.1 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void SpP4NNtkoTfDDGmuXv.X1W46gBTVNIgA5IpfK::gO3B1JWtIx(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void SpP4NNtkoTfDDGmuXv.X1W46gBTVNIgA5IpfK::wx2Bb4MrEa(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void bI0CeXifk5oq5nlwSl.srdOM0veXfrb3apvll::TN6nhFyzxaK6P()
call System.Void SYD5HUZ0o2GbiGloul.bvqHGp7bnYpjxeNjYQ::wOYXy2I5n7()
ret <null>
Module Name
VGeko.exe
Full Name
VGeko.exe
EntryPoint
System.Void M4NGqDA5GTyd9ikUEE.wQdSOoOwaLo5icF4WZ::KlXYGtrAeg(System.String[])
Scope Name
VGeko.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
VGeko
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5.1
Total Strings
111
Main Method
System.Void M4NGqDA5GTyd9ikUEE.wQdSOoOwaLo5icF4WZ::KlXYGtrAeg(System.String[])
Main IL Instruction Count
76
Main IL 
br.s IL_0007: call System.Void jgMgvwsTYn45gIiB4m.iSAtsBxuCbdBOJUQpY::kLjw4iIsCLsZtxc4lksN0j()
call <null>
call System.Void jgMgvwsTYn45gIiB4m.iSAtsBxuCbdBOJUQpY::kLjw4iIsCLsZtxc4lksN0j()
call System.Boolean mSuyEuLdi6j4f9UEdV.BUykrEDZkkPTuNFqYb::K8DYzL4PLj()
brtrue IL_0034: ldc.i4.0
ldc.i4 13778
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldc.i4 6936
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ret <null>
ldc.i4.0 <null>
stloc.0 <null>
ldc.i4.1 <null>
ldc.i4 14166
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldloca.s V_0
newobj System.Void System.Threading.Mutex::.ctor(System.Boolean,System.String,System.Boolean&)
pop <null>
ldarg.0 <null>
ldlen <null>
brfalse IL_0083: ldloc.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
br IL_007B: ldloc.2
nop <null>
ldloc.1 <null>
call System.Void System.IO.File::Delete(System.String)
leave IL_0083: ldloc.0
pop <null>
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
leave IL_0077: ldloc.2
ldloc.2 <null>
ldc.i4.1 <null>
add <null>
stloc.2 <null>
ldloc.2 <null>
ldc.i4.s 10
ble IL_005B: nop
ldloc.0 <null>
brtrue IL_00AC: ldc.i4.2
ldc.i4 14180
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldc.i4 6936
call System.String bTpyGkpMySApaYtwBe.D7xVotUDCjAvVduPa5::tiHlbHfWJJ(System.Int32)
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4.1 <null>
call System.Void System.Environment::Exit(System.Int32)
ldc.i4.2 <null>
call System.Void System.Windows.Forms.Application::SetUnhandledExceptionMode(System.Windows.Forms.UnhandledExceptionMode)
ldnull <null>
ldftn System.Void SpP4NNtkoTfDDGmuXv.X1W46gBTVNIgA5IpfK::gO3B1JWtIx(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void SpP4NNtkoTfDDGmuXv.X1W46gBTVNIgA5IpfK::wx2Bb4MrEa(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
call System.Void bI0CeXifk5oq5nlwSl.srdOM0veXfrb3apvll::TN6nhFyzxaK6P()
call System.Void SYD5HUZ0o2GbiGloul.bvqHGp7bnYpjxeNjYQ::wOYXy2I5n7()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙