Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 8f0f02eb59fbd12f9bcca7c0c2add3b3
Size: 610.82 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 8f0f02eb59fbd12f9bcca7c0c2add3b3
Sha1 9ce3c627c3f1b276c4c2bd4b1463415b668fbfd2
Sha256 7abc66114083c1af5345a564369c5a9a57ede5dc4f8018c679d6fa2073781c19
Sha384 68cfaddb7d7bf8f3b41f2fdfe9b2d8429dab3e7443ef33b75622f51507712e1f1d22b68816f686893672cd42da95f1cc
Sha512 308469149b30890e6b2d80b295af96a5b9c0b922547afe73608a85bc8a635fa2d17ec312652f2d429772899b48215787d9235a9f0e46b02a7345a06f751e39ef
SSDeep 12288:NV1l3zZjrx550omh69bKYzcNCL9ADArlQ:lQh2bKwcSrl
TLSH B5D4AD6833EA9244E17F97359E764A004BF0F903CA33C61FA69718ED8B6679455233B3
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
8f0f02eb59fbd12f9bcca7c0c2add3b3
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Jq4jkBy3e5.g.resources
Jq4jkBy3e5.Resources.resources
e0843d4dee4e57.Resources.resources
02f637510
[NBF]root.Data
02f637511
[NBF]root.Data
02f637512
[NBF]root.Data
02f637513
[NBF]root.Data
02f637514
[NBF]root.Data
02f637515
[NBF]root.Data
02f637516
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Jq4jkBy3e5
Full Name
Jq4jkBy3e5
EntryPoint
System.Void Jq4jkBy3e5.Lw3xt7zS::rn5P4()
Scope Name
Jq4jkBy3e5
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jq4jkBy3e5
Assembly Version
24.27.26.182
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1005
Main Method
System.Void Jq4jkBy3e5.Lw3xt7zS::rn5P4()
Main IL Instruction Count
106
Main IL 
nop <null>
nop <null>
newobj System.Void Jq4jkBy3e5.Lw3xt7zS::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.3 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0051: ldloc.3
br.s IL_006E: ldloc.s V_5
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken Jq4jkBy3e5.Lw3xt7zS
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass Jq4jkBy3e5.Lw3xt7zS
stloc.0 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.2 <null>
leave.s IL_00ED: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
nop <null>
nop <null>
ldc.i4 214
stloc.s V_7
br.s IL_00B1: ldloc.s V_7
ldloc.s V_7
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_7
ldloc.s V_7
ldc.i4.s 24
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_00AF: nop
ldc.i4.s 24
stloc.s V_7
ldstr resources/9875193
call System.Byte[] Jq4jkBy3e5.Nk0om::Ye5br3XpT(System.String)
stloc.s V_8
br.s IL_00BF: ldloc.s V_8
nop <null>
nop <null>
ldloc.s V_7
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_10
ldloc.s V_10
brtrue.s IL_008B: ldloc.s V_7
ldloc.s V_8
castclass System.Byte[]
call System.Void Jq4jkBy3e5.Gw3m6osX/Sqn6s8jB7e.Rb7r1faFwwW6K::8rjQL0gxiM5aJ(System.Byte[])
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
leave.s IL_00E5: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E5: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00ED: nop
nop <null>
ret <null>
Module Name
Jq4jkBy3e5
Full Name
Jq4jkBy3e5
EntryPoint
System.Void Jq4jkBy3e5.Lw3xt7zS::rn5P4()
Scope Name
Jq4jkBy3e5
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Jq4jkBy3e5
Assembly Version
24.27.26.182
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1005
Main Method
System.Void Jq4jkBy3e5.Lw3xt7zS::rn5P4()
Main IL Instruction Count
106
Main IL 
nop <null>
nop <null>
newobj System.Void Jq4jkBy3e5.Lw3xt7zS::.ctor()
stloc.0 <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.1 <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
newobj System.Void System.Object::.ctor()
ldnull <null>
ldstr CreateTab
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr segmen
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldloc.0 <null>
stelem.ref <null>
dup <null>
stloc.3 <null>
ldnull <null>
ldnull <null>
ldc.i4.2 <null>
newarr System.Boolean
dup <null>
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
dup <null>
stloc.s V_4
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
stloc.s V_5
ldloc.s V_4
ldc.i4.1 <null>
ldelem.u1 <null>
brtrue.s IL_0051: ldloc.3
br.s IL_006E: ldloc.s V_5
ldloc.3 <null>
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken Jq4jkBy3e5.Lw3xt7zS
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass Jq4jkBy3e5.Lw3xt7zS
stloc.0 <null>
ldloc.s V_5
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.2 <null>
leave.s IL_00ED: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
nop <null>
nop <null>
ldc.i4 214
stloc.s V_7
br.s IL_00B1: ldloc.s V_7
ldloc.s V_7
ldc.i4.3 <null>
mul.ovf <null>
stloc.s V_7
ldloc.s V_7
ldc.i4.s 24
cgt <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_00AF: nop
ldc.i4.s 24
stloc.s V_7
ldstr resources/9875193
call System.Byte[] Jq4jkBy3e5.Nk0om::Ye5br3XpT(System.String)
stloc.s V_8
br.s IL_00BF: ldloc.s V_8
nop <null>
nop <null>
ldloc.s V_7
ldc.i4.s 24
rem <null>
ldc.i4.0 <null>
cgt.un <null>
stloc.s V_10
ldloc.s V_10
brtrue.s IL_008B: ldloc.s V_7
ldloc.s V_8
castclass System.Byte[]
call System.Void Jq4jkBy3e5.Gw3m6osX/Sqn6s8jB7e.Rb7r1faFwwW6K::8rjQL0gxiM5aJ(System.Byte[])
nop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
nop <null>
leave.s IL_00E5: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00E5: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00ED: nop
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙