Suspicious
Suspect

PE Executable
MD5: 8f0f02eb59fbd12f9bcca7c0c2add3b3
Size: 610.82 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8f0f02eb59fbd12f9bcca7c0c2add3b3
Sha1 9ce3c627c3f1b276c4c2bd4b1463415b668fbfd2
Sha256 7abc66114083c1af5345a564369c5a9a57ede5dc4f8018c679d6fa2073781c19
Sha384 68cfaddb7d7bf8f3b41f2fdfe9b2d8429dab3e7443ef33b75622f51507712e1f1d22b68816f686893672cd42da95f1cc
Sha512 308469149b30890e6b2d80b295af96a5b9c0b922547afe73608a85bc8a635fa2d17ec312652f2d429772899b48215787d9235a9f0e46b02a7345a06f751e39ef
SSDeep 12288:NV1l3zZjrx550omh69bKYzcNCL9ADArlQ:lQh2bKwcSrl
TLSH B5D4AD6833EA9244E17F97359E764A004BF0F903CA33C61FA69718ED8B6679455233B3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8f0f02eb59fbd12f9bcca7c0c2add3b3
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Jq4jkBy3e5.g.resources
Jq4jkBy3e5.Resources.resources
e0843d4dee4e57.Resources.resources
02f637510
[NBF]root.Data
02f637511
[NBF]root.Data
02f637512
[NBF]root.Data
02f637513
[NBF]root.Data
02f637514
[NBF]root.Data
02f637515
[NBF]root.Data
02f637516
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Jq4jkBy3e5
Full Name
Jq4jkBy3e5
EntryPoint
System.Void Jq4jkBy3e5.Lw3xt7zS::rn5P4()
Scope Name
Jq4jkBy3e5
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jq4jkBy3e5
Assembly Version
24.27.26.182
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1005
Main Method
System.Void Jq4jkBy3e5.Lw3xt7zS::rn5P4()
Main IL Instruction Count
106
Main IL 
nop <null>
nop <null>
newobj System.Void Jq4jkBy3e5.Lw3xt7zS::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.3 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0051: ldloc.3
br.s IL_006E: ldloc.s V_5
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken Jq4jkBy3e5.Lw3xt7zS
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass Jq4jkBy3e5.Lw3xt7zS
stloc.0 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.2 <null>
leave.s IL_00ED: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
nop <null>
nop <null>
ldc.i4 214
stloc.s V_7
br.s IL_00B1: ldloc.s V_7
ldloc.s V_7
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_7
ldloc.s V_7
ldc.i4.s 24
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_00AF: nop
ldc.i4.s 24
stloc.s V_7
ldstr resources/9875193
call System.Byte[] Jq4jkBy3e5.Nk0om::Ye5br3XpT(System.String)
stloc.s V_8
br.s IL_00BF: ldloc.s V_8
nop <null>
nop <null>
ldloc.s V_7
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_10
ldloc.s V_10
brtrue.s IL_008B: ldloc.s V_7
ldloc.s V_8
castclass System.Byte[]
call System.Void Jq4jkBy3e5.Gw3m6osX/Sqn6s8jB7e.Rb7r1faFwwW6K::8rjQL0gxiM5aJ(System.Byte[])
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
leave.s IL_00E5: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E5: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00ED: nop
nop <null>
ret <null>
Module Name
Jq4jkBy3e5
Full Name
Jq4jkBy3e5
EntryPoint
System.Void Jq4jkBy3e5.Lw3xt7zS::rn5P4()
Scope Name
Jq4jkBy3e5
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jq4jkBy3e5
Assembly Version
24.27.26.182
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1005
Main Method
System.Void Jq4jkBy3e5.Lw3xt7zS::rn5P4()
Main IL Instruction Count
106
Main IL 
nop <null>
nop <null>
newobj System.Void Jq4jkBy3e5.Lw3xt7zS::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.3 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0051: ldloc.3
br.s IL_006E: ldloc.s V_5
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken Jq4jkBy3e5.Lw3xt7zS
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass Jq4jkBy3e5.Lw3xt7zS
stloc.0 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.2 <null>
leave.s IL_00ED: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
nop <null>
nop <null>
ldc.i4 214
stloc.s V_7
br.s IL_00B1: ldloc.s V_7
ldloc.s V_7
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_7
ldloc.s V_7
ldc.i4.s 24
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_00AF: nop
ldc.i4.s 24
stloc.s V_7
ldstr resources/9875193
call System.Byte[] Jq4jkBy3e5.Nk0om::Ye5br3XpT(System.String)
stloc.s V_8
br.s IL_00BF: ldloc.s V_8
nop <null>
nop <null>
ldloc.s V_7
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_10
ldloc.s V_10
brtrue.s IL_008B: ldloc.s V_7
ldloc.s V_8
castclass System.Byte[]
call System.Void Jq4jkBy3e5.Gw3m6osX/Sqn6s8jB7e.Rb7r1faFwwW6K::8rjQL0gxiM5aJ(System.Byte[])
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
leave.s IL_00E5: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E5: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00ED: nop
nop <null>
ret <null>
8f0f02eb59fbd12f9bcca7c0c2add3b3
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Jq4jkBy3e5.g.resources
Jq4jkBy3e5.Resources.resources
e0843d4dee4e57.Resources.resources
02f637510
[NBF]root.Data
02f637511
[NBF]root.Data
02f637512
[NBF]root.Data
02f637513
[NBF]root.Data
02f637514
[NBF]root.Data
02f637515
[NBF]root.Data
02f637516
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙