910177419aed4b21f118570eff5aad7b

PE Executable

MD5: 910177419aed4b21f118570eff5aad7b

Size: 48.64 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	910177419aed4b21f118570eff5aad7b
Sha1	510ab5bb200382c18cd35af659f5317ac7c6b62f
Sha256	c50aaeeb818ba3fd2ff56ff05702286ee3700461f84d2b499a0de2a4c99f5cdc
Sha384	7f6a4db728cabce0e40fb455bf4384194fb95fab8c549371cfdb86220c3651a641fa894ed139864d03fef29b508a0477
Sha512	03fc6149ed7cfb336730eb2bf8cf7d1ce4c07084eb3141f784a325448e3256873a02142297863c501d5558c7c572eb41f7871a1c7b27ac68d5054c9696b8d4f4
SSDeep	768:YuYHKTsufqG9vSLjWUvlPRmo2qbMEht18wmoFcPIrUOJtaO0bsc2vkfnNwdFGVk5:YuYHKTsjMvSX2/EhFmoFhrjJ8bsXgnNO
TLSH	BB233B002BE8C127F2BE4F7499F221558577F2633603DA4D1CC8469A5B13FC696926FE

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Module Name	QIwscflYIY
Full Name	QIwscflYIY
EntryPoint	System.Void VSJLOzZrltuBuI.LggeTuznXhD::Main()
Scope Name	QIwscflYIY
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	lol
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Info	PE Detect: PeReader OK (file layout)
Total Strings	120
Main Method	System.Void VSJLOzZrltuBuI.LggeTuznXhD::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::TydBePXrXcWXggp call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean VSJLOzZrltuBuI.gLQInIFDESP::MiFhNNGQReCIa() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean ZomdStztXBc.RDQrHJXshvyLas::REpTjiNNzbHN() brtrue IL_0043: ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::XQIRpqUbUnhBbR ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::XQIRpqUbUnhBbR call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::CQnSCHDoKLpqx call System.Void ZomdStztXBc.uEiRKiIIZRU::spQfchofCKuaPojAy() ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::CQnSCHDoKLpqx call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::AxljxPEEzW call System.Void rnEipxlDPFCly.OXYNbFQSnyaY::UZccMlbZwyRg() ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::AxljxPEEzW call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void ZomdStztXBc.OtnaUZftNpdG::xLvIKOYAWjVh() call System.Boolean ZomdStztXBc.OtnaUZftNpdG::QoJzQduJIs() brfalse IL_0089: call System.Void ZomdStztXBc.OtnaUZftNpdG::xLvIKOYAWjVh() call System.Void ZomdStztXBc.QBYOMXTfZkR::HfhDpaBgIabl() call System.Void ZomdStztXBc.OtnaUZftNpdG::xLvIKOYAWjVh() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean iUrMzfFnGFTw.iIdfcPDvLEormrCo::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void iUrMzfFnGFTw.iIdfcPDvLEormrCo::AAfspOIMJCR() call System.Void iUrMzfFnGFTw.iIdfcPDvLEormrCo::TVUYBMnUcorq() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop
Module Name	QIwscflYIY
Full Name	QIwscflYIY
EntryPoint	System.Void VSJLOzZrltuBuI.LggeTuznXhD::Main()
Scope Name	QIwscflYIY
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	lol
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0,Profile=Client
Total Strings	120
Main Method	System.Void VSJLOzZrltuBuI.LggeTuznXhD::Main()
Main IL Instruction Count	51
Main IL	ldc.i4.0 <null> stloc.0 <null> br IL_0015: ldloc.0 ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldc.i4.1 <null> add <null> stloc.0 <null> ldloc.0 <null> ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::TydBePXrXcWXggp call System.Int32 System.Convert::ToInt32(System.String) blt.s IL_0007: ldc.i4 1000 call System.Boolean VSJLOzZrltuBuI.gLQInIFDESP::MiFhNNGQReCIa() brtrue IL_0032: nop ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) nop <null> call System.Boolean ZomdStztXBc.RDQrHJXshvyLas::REpTjiNNzbHN() brtrue IL_0043: ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::XQIRpqUbUnhBbR ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::XQIRpqUbUnhBbR call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0057: ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::CQnSCHDoKLpqx call System.Void ZomdStztXBc.uEiRKiIIZRU::spQfchofCKuaPojAy() ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::CQnSCHDoKLpqx call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_006B: ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::AxljxPEEzW call System.Void rnEipxlDPFCly.OXYNbFQSnyaY::UZccMlbZwyRg() ldsfld System.String VSJLOzZrltuBuI.gLQInIFDESP::AxljxPEEzW call System.Boolean System.Convert::ToBoolean(System.String) brfalse IL_0089: call System.Void ZomdStztXBc.OtnaUZftNpdG::xLvIKOYAWjVh() call System.Boolean ZomdStztXBc.OtnaUZftNpdG::QoJzQduJIs() brfalse IL_0089: call System.Void ZomdStztXBc.OtnaUZftNpdG::xLvIKOYAWjVh() call System.Void ZomdStztXBc.QBYOMXTfZkR::HfhDpaBgIabl() call System.Void ZomdStztXBc.OtnaUZftNpdG::xLvIKOYAWjVh() leave IL_0099: nop pop <null> leave IL_0099: nop nop <null> call System.Boolean iUrMzfFnGFTw.iIdfcPDvLEormrCo::get_IsConnected() brtrue IL_00AE: leave IL_00B9 call System.Void iUrMzfFnGFTw.iIdfcPDvLEormrCo::AAfspOIMJCR() call System.Void iUrMzfFnGFTw.iIdfcPDvLEormrCo::TVUYBMnUcorq() leave IL_00B9: ldc.i4 5000 pop <null> leave IL_00B9: ldc.i4 5000 ldc.i4 5000 call System.Void System.Threading.Thread::Sleep(System.Int32) br.s IL_0099: nop

No malware configuration was found at this point.

You must be signed in to view YARA rules.