Suspicious
Suspect

8b15d1a7695a23d821254c79aef85f41

PE Executable
MD5: 8b15d1a7695a23d821254c79aef85f41
Size: 910.34 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8b15d1a7695a23d821254c79aef85f41
Sha1 0e1e510f3e12de26e600c8ae44c62fa86e7ec273
Sha256 d3ad3af0b8d43b575caacb2790a31c6c34407d3c08e58b5c8faf55e792d4fdb3
Sha384 602b11ec0c15720a67fab3bcaf6877b83a75ffea66d032ced1958bc3c1d61ca423829eca3a11be92de162a4e259c8172
Sha512 ed48c9993e472b73eb473f952e1d235698370323d4fc50ff56caca2f33c9eb5a8afe86da256077c7831dc09400119d7eb3b746b4d556b133d7c95f0221923414
SSDeep 12288:dk/y6WtsnECgpp4NMEAWjL7KcXdnE5ZNR3O/WoGYdyNCNyOxA7:dkK6TCrEnLGcXdE73O/WoGYd6syM
TLSH 8B15BF61BE126F10D63D9BBDC4E10054D3F99E079201F74FAEE832E959B7A8EC50B981
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8b15d1a7695a23d821254c79aef85f41
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
0GygK.Resources.resources
0GygK.g.resources
8eaec2d716008c.Resources.resources
edc0d8f40
[NBF]root.Data
edc0d8f41
[NBF]root.Data
edc0d8f410
[NBF]root.Data
edc0d8f411
[NBF]root.Data
edc0d8f412
[NBF]root.Data
edc0d8f413
[NBF]root.Data
edc0d8f414
[NBF]root.Data
edc0d8f415
[NBF]root.Data
edc0d8f416
[NBF]root.Data
edc0d8f417
[NBF]root.Data
edc0d8f418
[NBF]root.Data
edc0d8f419
[NBF]root.Data
edc0d8f42
[NBF]root.Data
edc0d8f420
[NBF]root.Data
edc0d8f43
[NBF]root.Data
edc0d8f44
[NBF]root.Data
edc0d8f45
[NBF]root.Data
edc0d8f46
[NBF]root.Data
edc0d8f47
[NBF]root.Data
edc0d8f48
[NBF]root.Data
edc0d8f49
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
0GygK
Full Name
0GygK
EntryPoint
System.Void Lo0rf7c.cz6RbJd::3cgBD4etwRm()
Scope Name
0GygK
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
0GygK
Assembly Version
3.14.19.229
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Lo0rf7c.cz6RbJd::3cgBD4etwRm()
Main IL Instruction Count
382
Main IL 
ldsfld System.Int32[] 4dzPiNw8.4Teqr0tJz::3Pqefm2JbE
stloc.s V_27
nop <null>
br.s IL_000A: ldc.i4.s 26
ldc.i4.s 26
stloc.s V_26
ldloc.s V_26
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0093: nop
nop <null>
newobj System.Void System.Random::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldc.i4.s 20
ldc.i4 500
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stloc.1 <null>
ldloc.1 <null>
stloc.s V_6
ldc.i4.s 22
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.1 <null>
stloc.s V_7
ldc.i4.s 17
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldloc.s V_7
ldc.i4.2 <null>
sub <null>
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.s 13
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.4 <null>
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
br.s IL_00F0: stloc.s V_26
ldc.i4.s 24
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
br.s IL_00F0: stloc.s V_26
ldc.i4.s 15
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
br.s IL_00F0: stloc.s V_26
ldloc.s V_27
ldc.i4 166
ldelem.i4 <null>
ldc.i4 35206
sub <null>
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
br.s IL_00F0: stloc.s V_26
ldc.i4.s 30
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
call System.Guid System.Guid::NewGuid()
stloc.s V_13
ldloca.s V_13
nop <null>
ldc.i4 656938211
ldnull <null>
ldc.i4.3 <null>
ldc.i8 6
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
call System.String System.Guid::ToString(System.String)
stloc.s V_8
ldc.i4.s 12
stloc.s V_26
br IL_000E: ldloc.s V_26
call System.Int32 System.Environment::get_ProcessorCount()
stloc.s V_9
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.s V_10
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
ldc.i4.s 25
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.3 <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.String System.Version::ToString()
stloc.s V_11
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.s V_12
ldc.i4.s 14
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.s 35
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
nop <null>
ldc.i4 656949224
ldnull <null>
ldc.i4.3 <null>
ldc.i8 6
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
nop <null>
ldc.i4 301489087
ldc.i4.1 <null>
ldc.i8 12
call System.String Ja8dc4Kknz.Hew8ay0/Fk7c6.Dqm5fZ::2coHjEo75yn(System.Int32,System.Int32,System.Int64)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_14
ldc.i4.6 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_14
call System.Boolean System.IO.Directory::Exists(System.String)
stloc.s V_15
ldloc.s V_4
castclass System.Object[]
stloc.2 <null>
ldc.i4.0 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
nop <null>
ldc.i4 656949131
ldnull <null>
ldc.i4.4 <null>
ldc.i8 2
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
stloc.s V_16
ldloc.s V_16
nop <null>
ldc.i4 301489111
ldc.i4.5 <null>
ldc.i8 14
call System.String Ja8dc4Kknz.Hew8ay0/Fk7c6.Dqm5fZ::2coHjEo75yn(System.Int32,System.Int32,System.Int64)
nop <null>
ldc.i4 656949180
ldnull <null>
ldc.i4.1 <null>
ldc.i8 9
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
nop <null>
ldc.i4 301489116
ldc.i4.2 <null>
ldc.i8 5
call System.String Ja8dc4Kknz.Hew8ay0/Fk7c6.Dqm5fZ::2coHjEo75yn(System.Int32,System.Int32,System.Int64)
call System.String System.String::Format(System.String,System.Object,System.Object,System.Object)
stloc.s V_5
ldc.i4.s 19
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_5
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
ldc.i4.0 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.2 <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] sn1DF7aw.9Mmobd1Rp/4BnqPtt9n6sRx.ks1Xp::Cz3xpo(System.String)
stelem.ref <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
isinst System.Byte[]
brtrue.s IL_02F4: ldc.i4.3
ldloc.s V_27
ldc.i4 335
ldelem.i4 <null>
ldc.i4 24473
sub <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.3 <null>
br.s IL_02ED: stloc.s V_26
ldc.i4.0 <null>
br.s IL_0304: stloc.s V_18
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
ldlen <null>
conv.i4 <null>
stloc.s V_18
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] Lo0rf7c.cz6RbJd/9AapJe7c5Fijn8.Qf3wanC8/na6Db2Pmyt7Cz8.4HewYkd8k3q::oAo1B(System.Byte[])
stelem.ref <null>
ldc.i4.1 <null>
stloc.s V_19
ldc.i4.0 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.3 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
nop <null>
ldc.i4 656949164
ldnull <null>
ldc.i4.4 <null>
ldc.i8 1
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
nop <null>
ldc.i4 656949156
ldnull <null>
ldc.i4.1 <null>
ldc.i8 8
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
nop <null>
ldc.i4 656945242
ldnull <null>
ldc.i4.5 <null>
ldc.i8 9
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
stelem.ref <null>
stloc.s V_20
ldc.i4.s 28
stloc.s V_26
br IL_000E: ldloc.s V_26
newobj System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::.ctor()
stloc.s V_22
ldloc.s V_22
ldloc.s V_20
ldc.i4.0 <null>
ldelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
ldc.i4.s 9
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldloc.s V_22
ldloc.s V_20
ldc.i4.2 <null>
ldelem.ref <null>
ldc.i4.3 <null>
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_22
stloc.s V_21
ldc.i4.s 11
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_21
ldloc.s V_20
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldloc.2 <null>
ldloc.s V_21
ldloc.s V_20
ldc.i4.2 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object)
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Double At0qp1.4rcPN5ia0tgHg::0kmCEx9w5a(System.String,System.Object)
ldc.r8 0
cgt <null>
stloc.s V_23
ldc.i4.5 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_23
brfalse.s IL_040B: ldc.i4.7
ldc.i4.s 10
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.7 <null>
br.s IL_0404: stloc.s V_26
ldc.i4.2 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.s 21
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.2 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.2 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_7
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_7
ldc.i4.s 17
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_7
ldloc.s V_6
ble.s IL_0450: ldc.i4.s 18
ldc.i4.s 21
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.s 18
br.s IL_0449: stloc.s V_26
leave.s IL_046A: br.s IL_046C
br.s IL_0458: br.s IL_045A
br.s IL_045A: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_24
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_046A: br.s IL_046C
br.s IL_046C: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_048C: nop
nop <null>
ldsfld System.Byte[] 8FxqTqd0rC2r.2YfnEa9e7G::7byYrBi25wCnM
ldc.i4.s 51
ldsfld System.Byte[] 8FxqTqd0rC2r.2YfnEa9e7G::7byYrBi25wCnM
ldc.i4.s 51
ldelem.u1 <null>
ldsfld System.Byte[] 8FxqTqd0rC2r.2YfnEa9e7G::7byYrBi25wCnM
ldc.i4.s 9
ldelem.u1 <null>
sub <null>
ldc.i4 219
and <null>
stelem.i1 <null>
ret <null>
ldtoken System.Void Lo0rf7c.cz6RbJd::3cgBD4etwRm()
pop <null>
ret <null>
Module Name
0GygK
Full Name
0GygK
EntryPoint
System.Void Lo0rf7c.cz6RbJd::3cgBD4etwRm()
Scope Name
0GygK
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
0GygK
Assembly Version
3.14.19.229
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Lo0rf7c.cz6RbJd::3cgBD4etwRm()
Main IL Instruction Count
382
Main IL 
ldsfld System.Int32[] 4dzPiNw8.4Teqr0tJz::3Pqefm2JbE
stloc.s V_27
nop <null>
br.s IL_000A: ldc.i4.s 26
ldc.i4.s 26
stloc.s V_26
ldloc.s V_26
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0093: nop
nop <null>
newobj System.Void System.Random::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldc.i4.s 20
ldc.i4 500
callvirt System.Int32 System.Random::Next(System.Int32,System.Int32)
stloc.1 <null>
ldloc.1 <null>
stloc.s V_6
ldc.i4.s 22
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.1 <null>
stloc.s V_7
ldc.i4.s 17
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldloc.s V_7
ldc.i4.2 <null>
sub <null>
switch dnlib.DotNet.Emit.Instruction[]
ldc.i4.s 13
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.4 <null>
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
br.s IL_00F0: stloc.s V_26
ldc.i4.s 24
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
br.s IL_00F0: stloc.s V_26
ldc.i4.s 15
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
br.s IL_00F0: stloc.s V_26
ldloc.s V_27
ldc.i4 166
ldelem.i4 <null>
ldc.i4 35206
sub <null>
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
br.s IL_00F0: stloc.s V_26
ldc.i4.s 30
br.s IL_00F0: stloc.s V_26
ldc.i4.s 23
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
call System.Guid System.Guid::NewGuid()
stloc.s V_13
ldloca.s V_13
nop <null>
ldc.i4 656938211
ldnull <null>
ldc.i4.3 <null>
ldc.i8 6
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
call System.String System.Guid::ToString(System.String)
stloc.s V_8
ldc.i4.s 12
stloc.s V_26
br IL_000E: ldloc.s V_26
call System.Int32 System.Environment::get_ProcessorCount()
stloc.s V_9
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.s V_10
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo)
nop <null>
call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture()
call System.Void System.Globalization.CultureInfo::set_CurrentUICulture(System.Globalization.CultureInfo)
ldc.i4.s 25
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
call System.DateTime System.DateTime::get_Now()
stloc.3 <null>
call System.OperatingSystem System.Environment::get_OSVersion()
callvirt System.Version System.OperatingSystem::get_Version()
callvirt System.String System.Version::ToString()
stloc.s V_11
ldc.r8 24
call System.Double System.Math::Abs(System.Double)
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
stloc.s V_12
ldc.i4.s 14
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_4
ldc.i4.0 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.s 35
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
nop <null>
ldc.i4 656949224
ldnull <null>
ldc.i4.3 <null>
ldc.i8 6
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
nop <null>
ldc.i4 301489087
ldc.i4.1 <null>
ldc.i8 12
call System.String Ja8dc4Kknz.Hew8ay0/Fk7c6.Dqm5fZ::2coHjEo75yn(System.Int32,System.Int32,System.Int64)
call System.String System.IO.Path::Combine(System.String,System.String,System.String)
stloc.s V_14
ldc.i4.6 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_14
call System.Boolean System.IO.Directory::Exists(System.String)
stloc.s V_15
ldloc.s V_4
castclass System.Object[]
stloc.2 <null>
ldc.i4.0 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
nop <null>
ldc.i4 656949131
ldnull <null>
ldc.i4.4 <null>
ldc.i8 2
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
stloc.s V_16
ldloc.s V_16
nop <null>
ldc.i4 301489111
ldc.i4.5 <null>
ldc.i8 14
call System.String Ja8dc4Kknz.Hew8ay0/Fk7c6.Dqm5fZ::2coHjEo75yn(System.Int32,System.Int32,System.Int64)
nop <null>
ldc.i4 656949180
ldnull <null>
ldc.i4.1 <null>
ldc.i8 9
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
nop <null>
ldc.i4 301489116
ldc.i4.2 <null>
ldc.i8 5
call System.String Ja8dc4Kknz.Hew8ay0/Fk7c6.Dqm5fZ::2coHjEo75yn(System.Int32,System.Int32,System.Int64)
call System.String System.String::Format(System.String,System.Object,System.Object,System.Object)
stloc.s V_5
ldc.i4.s 19
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.2 <null>
ldc.i4.0 <null>
ldloc.s V_5
stelem.ref <null>
call System.Text.Encoding System.Text.Encoding::get_UTF8()
ldloc.s V_5
callvirt System.Byte[] System.Text.Encoding::GetBytes(System.String)
ldc.i4.0 <null>
call System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldloc.2 <null>
ldc.i4.0 <null>
ldelem.ref <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Byte[] sn1DF7aw.9Mmobd1Rp/4BnqPtt9n6sRx.ks1Xp::Cz3xpo(System.String)
stelem.ref <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
isinst System.Byte[]
brtrue.s IL_02F4: ldc.i4.3
ldloc.s V_27
ldc.i4 335
ldelem.i4 <null>
ldc.i4 24473
sub <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.3 <null>
br.s IL_02ED: stloc.s V_26
ldc.i4.0 <null>
br.s IL_0304: stloc.s V_18
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
ldlen <null>
conv.i4 <null>
stloc.s V_18
ldloc.2 <null>
ldc.i4.3 <null>
ldloc.2 <null>
ldc.i4.2 <null>
ldelem.ref <null>
castclass System.Byte[]
call System.Byte[] Lo0rf7c.cz6RbJd/9AapJe7c5Fijn8.Qf3wanC8/na6Db2Pmyt7Cz8.4HewYkd8k3q::oAo1B(System.Byte[])
stelem.ref <null>
ldc.i4.1 <null>
stloc.s V_19
ldc.i4.0 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.3 <null>
newarr System.String
dup <null>
ldc.i4.0 <null>
nop <null>
ldc.i4 656949164
ldnull <null>
ldc.i4.4 <null>
ldc.i8 1
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
nop <null>
ldc.i4 656949156
ldnull <null>
ldc.i4.1 <null>
ldc.i8 8
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
nop <null>
ldc.i4 656945242
ldnull <null>
ldc.i4.5 <null>
ldc.i8 9
call System.String Ja8dc4Kknz.Hew8ay0/yi8P0jTqsLp1sd.yg3C9tXaG::Pwa9nC6bTqi12e(System.Int32,System.Reflection.Assembly,System.Int32,System.Int64)
stelem.ref <null>
stloc.s V_20
ldc.i4.s 28
stloc.s V_26
br IL_000E: ldloc.s V_26
newobj System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::.ctor()
stloc.s V_22
ldloc.s V_22
ldloc.s V_20
ldc.i4.0 <null>
ldelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
ldc.i4.s 9
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldloc.s V_22
ldloc.s V_20
ldc.i4.2 <null>
ldelem.ref <null>
ldc.i4.3 <null>
box System.Int32
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.Object>::Add(System.String,System.Object)
nop <null>
ldloc.s V_22
stloc.s V_21
ldc.i4.s 11
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_21
ldloc.s V_20
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
ldloc.2 <null>
ldloc.s V_21
ldloc.s V_20
ldc.i4.2 <null>
ldelem.ref <null>
callvirt System.Object System.Collections.Generic.Dictionary`2<System.String,System.Object>::get_Item(System.String)
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.Object)
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
call System.Double At0qp1.4rcPN5ia0tgHg::0kmCEx9w5a(System.String,System.Object)
ldc.r8 0
cgt <null>
stloc.s V_23
ldc.i4.5 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_23
brfalse.s IL_040B: ldc.i4.7
ldc.i4.s 10
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.7 <null>
br.s IL_0404: stloc.s V_26
ldc.i4.2 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.s 21
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.2 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
nop <null>
ldc.i4.2 <null>
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_7
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_7
ldc.i4.s 17
stloc.s V_26
br IL_000E: ldloc.s V_26
ldloc.s V_7
ldloc.s V_6
ble.s IL_0450: ldc.i4.s 18
ldc.i4.s 21
stloc.s V_26
br IL_000E: ldloc.s V_26
ldc.i4.s 18
br.s IL_0449: stloc.s V_26
leave.s IL_046A: br.s IL_046C
br.s IL_0458: br.s IL_045A
br.s IL_045A: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_24
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_046A: br.s IL_046C
br.s IL_046C: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_048C: nop
nop <null>
ldsfld System.Byte[] 8FxqTqd0rC2r.2YfnEa9e7G::7byYrBi25wCnM
ldc.i4.s 51
ldsfld System.Byte[] 8FxqTqd0rC2r.2YfnEa9e7G::7byYrBi25wCnM
ldc.i4.s 51
ldelem.u1 <null>
ldsfld System.Byte[] 8FxqTqd0rC2r.2YfnEa9e7G::7byYrBi25wCnM
ldc.i4.s 9
ldelem.u1 <null>
sub <null>
ldc.i4 219
and <null>
stelem.i1 <null>
ret <null>
ldtoken System.Void Lo0rf7c.cz6RbJd::3cgBD4etwRm()
pop <null>
ret <null>
8b15d1a7695a23d821254c79aef85f41
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
0GygK.Resources.resources
0GygK.g.resources
8eaec2d716008c.Resources.resources
edc0d8f40
[NBF]root.Data
edc0d8f41
[NBF]root.Data
edc0d8f410
[NBF]root.Data
edc0d8f411
[NBF]root.Data
edc0d8f412
[NBF]root.Data
edc0d8f413
[NBF]root.Data
edc0d8f414
[NBF]root.Data
edc0d8f415
[NBF]root.Data
edc0d8f416
[NBF]root.Data
edc0d8f417
[NBF]root.Data
edc0d8f418
[NBF]root.Data
edc0d8f419
[NBF]root.Data
edc0d8f42
[NBF]root.Data
edc0d8f420
[NBF]root.Data
edc0d8f43
[NBF]root.Data
edc0d8f44
[NBF]root.Data
edc0d8f45
[NBF]root.Data
edc0d8f46
[NBF]root.Data
edc0d8f47
[NBF]root.Data
edc0d8f48
[NBF]root.Data
edc0d8f49
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙