Suspicious
Suspect

PE Executable
MD5: 8a18cf15ab5139d2d29a3b1666645d72
Size: 1.72 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 8a18cf15ab5139d2d29a3b1666645d72
Sha1 ba73edea1ee77c5da696751dadc8e64bf49d6a0d
Sha256 94d0084fb4121ce1d42f363b54ec8aac2caed34bcbbcf952b8c397cd4be32ecd
Sha384 9bdda348c89a360adc7eda7bac30cd4bb18f8d75b721e1bb8fd291794efd1b6ab4f1be3a405921f7c7268fd3a92e7144
Sha512 4a52c331789fa49c0a735eb78aa32edd4cb32285325fd4ce989392b4fa83cfea002a7dbb3dbc1f77cb90a44a3817753381d9556b1062b056900e5b13e270cd00
SSDeep 24576:d9e9/NnUigo68bxmY0oBU00mNyhy/jaNLLMpIknpkGg9Z0edTQRbA1b:DeJNn6o68VtU006yfNLL4/pkGg7b9j
TLSH 0C8533A25B88B3B5C0101C3CFF778A06AB94046A55BBE9AA7500F72D91E5B38BC51C76
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8a18cf15ab5139d2d29a3b1666645d72
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Dltbtqt.Properties.Resources.resources
Sekrk
ILRepack.List
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Order
Full Name
Order
EntryPoint
System.Void Dltbtqt.Zdzgupgt::Main()
Scope Name
Order
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Order
Assembly Version
1.0.4082.29372
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
48
Main Method
System.Void Dltbtqt.Zdzgupgt::Main()
Main IL Instruction Count
60
Main IL 
newobj System.Void Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::.ctor()
stloc.0 <null>
ldstr 7qxyoNP2MJpv+NVQ1Tz9Sw==
stloc.1 <null>
ldstr 6lpaDPNnFxM=
stloc.2 <null>
ldsfld System.Func`1<System.Byte[]> Dltbtqt.Zdzgupgt/<>c::<>9__0_0
dup <null>
brtrue.s IL_0031: newobj System.Void Dltbtqt.Kloehtlix::.ctor(System.Func`1<System.Byte[]>)
pop <null>
ldsfld Dltbtqt.Zdzgupgt/<>c Dltbtqt.Zdzgupgt/<>c::<>9
ldftn System.Byte[] Dltbtqt.Zdzgupgt/<>c::<Main>b__0_0()
newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Byte[]> Dltbtqt.Zdzgupgt/<>c::<>9__0_0
newobj System.Void Dltbtqt.Kloehtlix::.ctor(System.Func`1<System.Byte[]>)
ldloc.0 <null>
ldloc.1 <null>
ldloc.2 <null>
newobj System.Void Dltbtqt.Zuszcuh::.ctor(System.String,System.String)
stfld Dltbtqt.Zuszcuh Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::decryptor
ldloc.0 <null>
newobj System.Void Dltbtqt.Aplerwet::.ctor()
stfld Dltbtqt.Aplerwet Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::loader
ldloc.0 <null>
ldstr iKsvpxgtd4lJqRjt7w.xZFWJqvjVLvF6alThd
ldstr ylmil4GW9
newobj System.Void Dltbtqt.Wyaoi::.ctor(System.String,System.String)
stfld Dltbtqt.Wyaoi Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::invoker
dup <null>
ldloc.0 <null>
ldftn System.Void Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::<Main>b__1(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Dltbtqt.Kloehtlix::add_DownloadCompleted(System.Action`1<System.IO.MemoryStream>)
ldloc.0 <null>
ldfld Dltbtqt.Zuszcuh Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::decryptor
ldloc.0 <null>
ldftn System.Void Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::<Main>b__2(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Dltbtqt.Zuszcuh::add_DecryptionCompleted(System.Action`1<System.IO.MemoryStream>)
ldloc.0 <null>
ldfld Dltbtqt.Aplerwet Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::loader
ldloc.0 <null>
ldftn System.Void Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::<Main>b__3(System.Reflection.Assembly)
newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Dltbtqt.Aplerwet::add_LoadCompleted(System.Action`1<System.Reflection.Assembly>)
ldloc.0 <null>
ldfld Dltbtqt.Wyaoi Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::invoker
ldsfld System.Action Dltbtqt.Zdzgupgt/<>c::<>9__0_4
dup <null>
brtrue.s IL_00C8: callvirt System.Void Dltbtqt.Wyaoi::add_InvocationCompleted(System.Action)
pop <null>
ldsfld Dltbtqt.Zdzgupgt/<>c Dltbtqt.Zdzgupgt/<>c::<>9
ldftn System.Void Dltbtqt.Zdzgupgt/<>c::<Main>b__0_4()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Dltbtqt.Zdzgupgt/<>c::<>9__0_4
callvirt System.Void Dltbtqt.Wyaoi::add_InvocationCompleted(System.Action)
callvirt System.Void Dltbtqt.Kloehtlix::Dbhhvmwt()
ret <null>
Module Name
Order
Full Name
Order
EntryPoint
System.Void Dltbtqt.Zdzgupgt::Main()
Scope Name
Order
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Order
Assembly Version
1.0.4082.29372
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
48
Main Method
System.Void Dltbtqt.Zdzgupgt::Main()
Main IL Instruction Count
60
Main IL 
newobj System.Void Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::.ctor()
stloc.0 <null>
ldstr 7qxyoNP2MJpv+NVQ1Tz9Sw==
stloc.1 <null>
ldstr 6lpaDPNnFxM=
stloc.2 <null>
ldsfld System.Func`1<System.Byte[]> Dltbtqt.Zdzgupgt/<>c::<>9__0_0
dup <null>
brtrue.s IL_0031: newobj System.Void Dltbtqt.Kloehtlix::.ctor(System.Func`1<System.Byte[]>)
pop <null>
ldsfld Dltbtqt.Zdzgupgt/<>c Dltbtqt.Zdzgupgt/<>c::<>9
ldftn System.Byte[] Dltbtqt.Zdzgupgt/<>c::<Main>b__0_0()
newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Byte[]> Dltbtqt.Zdzgupgt/<>c::<>9__0_0
newobj System.Void Dltbtqt.Kloehtlix::.ctor(System.Func`1<System.Byte[]>)
ldloc.0 <null>
ldloc.1 <null>
ldloc.2 <null>
newobj System.Void Dltbtqt.Zuszcuh::.ctor(System.String,System.String)
stfld Dltbtqt.Zuszcuh Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::decryptor
ldloc.0 <null>
newobj System.Void Dltbtqt.Aplerwet::.ctor()
stfld Dltbtqt.Aplerwet Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::loader
ldloc.0 <null>
ldstr iKsvpxgtd4lJqRjt7w.xZFWJqvjVLvF6alThd
ldstr ylmil4GW9
newobj System.Void Dltbtqt.Wyaoi::.ctor(System.String,System.String)
stfld Dltbtqt.Wyaoi Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::invoker
dup <null>
ldloc.0 <null>
ldftn System.Void Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::<Main>b__1(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Dltbtqt.Kloehtlix::add_DownloadCompleted(System.Action`1<System.IO.MemoryStream>)
ldloc.0 <null>
ldfld Dltbtqt.Zuszcuh Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::decryptor
ldloc.0 <null>
ldftn System.Void Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::<Main>b__2(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Dltbtqt.Zuszcuh::add_DecryptionCompleted(System.Action`1<System.IO.MemoryStream>)
ldloc.0 <null>
ldfld Dltbtqt.Aplerwet Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::loader
ldloc.0 <null>
ldftn System.Void Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::<Main>b__3(System.Reflection.Assembly)
newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Dltbtqt.Aplerwet::add_LoadCompleted(System.Action`1<System.Reflection.Assembly>)
ldloc.0 <null>
ldfld Dltbtqt.Wyaoi Dltbtqt.Zdzgupgt/<>c__DisplayClass0_0::invoker
ldsfld System.Action Dltbtqt.Zdzgupgt/<>c::<>9__0_4
dup <null>
brtrue.s IL_00C8: callvirt System.Void Dltbtqt.Wyaoi::add_InvocationCompleted(System.Action)
pop <null>
ldsfld Dltbtqt.Zdzgupgt/<>c Dltbtqt.Zdzgupgt/<>c::<>9
ldftn System.Void Dltbtqt.Zdzgupgt/<>c::<Main>b__0_4()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Dltbtqt.Zdzgupgt/<>c::<>9__0_4
callvirt System.Void Dltbtqt.Wyaoi::add_InvocationCompleted(System.Action)
callvirt System.Void Dltbtqt.Kloehtlix::Dbhhvmwt()
ret <null>
8a18cf15ab5139d2d29a3b1666645d72
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Dltbtqt.Properties.Resources.resources
Sekrk
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙