Malicious PE Executable analysis – 95172d15d33e

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXE95172d15d33e8f5c9f1f754e75a9b704

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Zhfttbczzg.exe
Full Name	Zhfttbczzg.exe
EntryPoint	System.Void IudkqLUcmbKRPVHRIb.Gdwj9xLtCLPHcwahlH::prMIGdG1V()
Scope Name	Zhfttbczzg.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Zhfttbczzg
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void IudkqLUcmbKRPVHRIb.Gdwj9xLtCLPHcwahlH::prMIGdG1V()
Main IL Instruction Count	55
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_00FD: ret nop <null> ldsfld cd6bdlsQLWMKhMCiOQb cd6bdlsQLWMKhMCiOQb::JlFsKB37DY call System.Boolean cd6bdlsQLWMKhMCiOQb::X7dsned8Gm(cd6bdlsQLWMKhMCiOQb) pop <null> ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_62823a974b4f41f0b1773ca16e6df539 brtrue IL_006A: switch(IL_0086) pop <null> ldc.i4 1 br IL_006A: switch(IL_0086) br IL_0066: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0066: ldloc V_0 br IL_0086: leave IL_00FD leave IL_00FD: ret pop <null> ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_cba316683284414d97bb18e5f317f88a brtrue IL_00BD: switch(IL_00D9) pop <null> ldc.i4 4 br IL_00BD: switch(IL_00D9) br IL_00B9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00B9: ldloc V_2 br IL_00D9: leave IL_00FD leave IL_00FD: ret ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_10b2dea4fd4f47bca88cc236024e9aac brtrue IL_000D: switch(IL_00FD,IL_002D) pop <null> ldc.i4 5 br IL_000D: switch(IL_00FD,IL_002D) ret <null>
Module Name	Zhfttbczzg.exe
Full Name	Zhfttbczzg.exe
EntryPoint	System.Void IudkqLUcmbKRPVHRIb.Gdwj9xLtCLPHcwahlH::prMIGdG1V()
Scope Name	Zhfttbczzg.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Zhfttbczzg
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void IudkqLUcmbKRPVHRIb.Gdwj9xLtCLPHcwahlH::prMIGdG1V()
Main IL Instruction Count	55
Main IL	ldc.i4 1 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 989 beq IL_0009: ldloc V_1 br IL_00FD: ret nop <null> ldsfld cd6bdlsQLWMKhMCiOQb cd6bdlsQLWMKhMCiOQb::JlFsKB37DY call System.Boolean cd6bdlsQLWMKhMCiOQb::X7dsned8Gm(cd6bdlsQLWMKhMCiOQb) pop <null> ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_62823a974b4f41f0b1773ca16e6df539 brtrue IL_006A: switch(IL_0086) pop <null> ldc.i4 1 br IL_006A: switch(IL_0086) br IL_0066: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_0066: ldloc V_0 br IL_0086: leave IL_00FD leave IL_00FD: ret pop <null> ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_cba316683284414d97bb18e5f317f88a brtrue IL_00BD: switch(IL_00D9) pop <null> ldc.i4 4 br IL_00BD: switch(IL_00D9) br IL_00B9: ldloc V_2 ldc.i4 0 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 988 beq IL_00B9: ldloc V_2 br IL_00D9: leave IL_00FD leave IL_00FD: ret ldc.i4 0 ldsfld <Module>{67402713-9f56-40b4-805d-3d6006985660} <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_725d895fd7f741248d9040d105e6d944 ldfld System.Int32 <Module>{67402713-9f56-40b4-805d-3d6006985660}::m_10b2dea4fd4f47bca88cc236024e9aac brtrue IL_000D: switch(IL_00FD,IL_002D) pop <null> ldc.i4 5 br IL_000D: switch(IL_00FD,IL_002D) ret <null>