Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
937c0a09cb717d775df9c50633a2b016
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
3gq4BTwO26yDxLxw8t.qEBM7OPAJvmHECAsND
S7CUoCBS7NEDNP9IDi.aubECRhxAt2ugrAPOK
YTl4QyNAgZ6SHexQbb.jpBOa6CvDTrb4lZusT
xoESsqq3h4sOVMmLQZ.2ijBFcftVSDrIScZGP
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
ffCK.exe
Full Name
ffCK.exe
EntryPoint
System.Void lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::HRtUJh1k8()
Scope Name
ffCK.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ffCK
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
40
Main Method
System.Void lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::HRtUJh1k8()
Main IL Instruction Count
46
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
br IL_0015: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0094: nop
call System.Void rnUGjW2L7wOK2Mhm3F.yKLm0gs6670nxuIL6W::e4f1FQMDVcNyG()
ldc.i4 1
call lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::FlrpU3EHZQLHYsbRCs()
brfalse IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
pop <null>
br IL_0015: ldloc V_0
nop <null>
ldsfld sIKMDthoydl3PHgUJWO sIKMDthoydl3PHgUJWO::GcLhcU3Rgs
call System.Void sIKMDthoydl3PHgUJWO::L5whTjtjN(sIKMDthoydl3PHgUJWO)
ldc.i4 4
call lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::FlrpU3EHZQLHYsbRCs()
brfalse IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
pop <null>
ldc.i4 4
br IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
call System.Void tq8WTIrWFjb3V0bqIp.aHr74uglY9F7nsGuNs::veTxBWhzcBOgs()
ldc.i4 0
call lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::FlrpU3EHZQLHYsbRCs()
brfalse IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
pop <null>
br IL_0015: ldloc V_0
nop <null>
newobj System.Void AtmosphericNetwork.Form1::.ctor()
ldsfld Ujarjmh3mO8H1RTwsB8 Ujarjmh3mO8H1RTwsB8::Oc0hXNm00G
call System.Void Ujarjmh3mO8H1RTwsB8::L5whTjtjN(System.Windows.Forms.Form,Ujarjmh3mO8H1RTwsB8)
ldc.i4 5
call System.Boolean lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::VEWNsVtrYN6hOPRyaj()
brtrue IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
pop <null>
br IL_0015: ldloc V_0
nop <null>
ldc.i4.0 <null>
ldsfld cqKhF8hF36q1OXLtBsI cqKhF8hF36q1OXLtBsI::vHthvHutlB
call System.Void cqKhF8hF36q1OXLtBsI::L5whTjtjN(System.Boolean,cqKhF8hF36q1OXLtBsI)
ldc.i4 3
br IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
nop <null>
ret <null>
Module Name
ffCK.exe
Full Name
ffCK.exe
EntryPoint
System.Void lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::HRtUJh1k8()
Scope Name
ffCK.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
ffCK
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.5
Total Strings
40
Main Method
System.Void lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::HRtUJh1k8()
Main IL Instruction Count
46
Main IL 
br.s IL_0007: ldc.i4 2
call <null>
ldc.i4 2
stloc V_0
br IL_0015: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_0094: nop
call System.Void rnUGjW2L7wOK2Mhm3F.yKLm0gs6670nxuIL6W::e4f1FQMDVcNyG()
ldc.i4 1
call lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::FlrpU3EHZQLHYsbRCs()
brfalse IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
pop <null>
br IL_0015: ldloc V_0
nop <null>
ldsfld sIKMDthoydl3PHgUJWO sIKMDthoydl3PHgUJWO::GcLhcU3Rgs
call System.Void sIKMDthoydl3PHgUJWO::L5whTjtjN(sIKMDthoydl3PHgUJWO)
ldc.i4 4
call lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::FlrpU3EHZQLHYsbRCs()
brfalse IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
pop <null>
ldc.i4 4
br IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
call System.Void tq8WTIrWFjb3V0bqIp.aHr74uglY9F7nsGuNs::veTxBWhzcBOgs()
ldc.i4 0
call lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::FlrpU3EHZQLHYsbRCs()
brfalse IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
pop <null>
br IL_0015: ldloc V_0
nop <null>
newobj System.Void AtmosphericNetwork.Form1::.ctor()
ldsfld Ujarjmh3mO8H1RTwsB8 Ujarjmh3mO8H1RTwsB8::Oc0hXNm00G
call System.Void Ujarjmh3mO8H1RTwsB8::L5whTjtjN(System.Windows.Forms.Form,Ujarjmh3mO8H1RTwsB8)
ldc.i4 5
call System.Boolean lPGaJ2Ke1PRcm8Pi35.m4fbyj4DnVcCJc6arN::VEWNsVtrYN6hOPRyaj()
brtrue IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
pop <null>
br IL_0015: ldloc V_0
nop <null>
ldc.i4.0 <null>
ldsfld cqKhF8hF36q1OXLtBsI cqKhF8hF36q1OXLtBsI::vHthvHutlB
call System.Void cqKhF8hF36q1OXLtBsI::L5whTjtjN(System.Boolean,cqKhF8hF36q1OXLtBsI)
ldc.i4 3
br IL_0019: switch(IL_0094,IL_0055,IL_003B,IL_007A,IL_00B9,IL_00CF)
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙