Suspicious
Suspect

95ca11ff00293585dca9c0109a408f66

PE Executable
MD5: 95ca11ff00293585dca9c0109a408f66
Size: 1.52 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 95ca11ff00293585dca9c0109a408f66
Sha1 544db360d4cf7497e3bab7435167519454b52419
Sha256 d9745c3c74bdc3e3a192add8bae6a88bac3b6bfe8da02c4b0bc0df05d8a76870
Sha384 84da78159aa0052b06bdb7c80fddccc421e0364b7b91be81eb61a65af2f74aaee27c0da076c994324d5edc4b06c0b3fd
Sha512 1b98d472b2ddccda3cc26e2a41ff5048613d8c855a2e8a49b7ebf745a2846de7cfeab5667fb11768aa7f1de5fed0faddbfd58226f27aeab22c6d380ea17ec2ea
SSDeep 24576:iL284Pw0adUchbSbcKInJ9OtnkD33AsTCCG9dS57P2MWJg8EnikiuKR87liQI7:+Ij8rGcb8kEsEQWJEikRk2if
TLSH E36533063B5DE051C35CEA7AC8A468948831B7E804B2CDCEC97077555CBABBF57A872C
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
95ca11ff00293585dca9c0109a408f66
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Zqovnpwt.Properties.Resources.resources
Pxcdegskx
ILRepack.List
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Tngdtqcpztn
Full Name
Tngdtqcpztn
EntryPoint
System.Void Zqovnpwt.Ighuqi::Main()
Scope Name
Tngdtqcpztn
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tngdtqcpztn
Assembly Version
1.0.1305.19748
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
48
Main Method
System.Void Zqovnpwt.Ighuqi::Main()
Main IL Instruction Count
60
Main IL 
newobj System.Void Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::.ctor()
stloc.0 <null>
ldstr L6gogEhk6AKGNPA4Bxj8BQ==
stloc.1 <null>
ldstr bJB83o00iXk=
stloc.2 <null>
ldsfld System.Func`1<System.Byte[]> Zqovnpwt.Ighuqi/<>c::<>9__0_0
dup <null>
brtrue.s IL_0031: newobj System.Void Zqovnpwt.Yfgilx::.ctor(System.Func`1<System.Byte[]>)
pop <null>
ldsfld Zqovnpwt.Ighuqi/<>c Zqovnpwt.Ighuqi/<>c::<>9
ldftn System.Byte[] Zqovnpwt.Ighuqi/<>c::<Main>b__0_0()
newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Byte[]> Zqovnpwt.Ighuqi/<>c::<>9__0_0
newobj System.Void Zqovnpwt.Yfgilx::.ctor(System.Func`1<System.Byte[]>)
ldloc.0 <null>
ldloc.1 <null>
ldloc.2 <null>
newobj System.Void Zqovnpwt.Bxbtbmnbv::.ctor(System.String,System.String)
stfld Zqovnpwt.Bxbtbmnbv Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::decryptor
ldloc.0 <null>
newobj System.Void Zqovnpwt.Pchiubmn::.ctor()
stfld Zqovnpwt.Pchiubmn Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::loader
ldloc.0 <null>
ldstr jwte4Uvl6Em5Fqhc5N.eegVHjOdHgka2HgfZG
ldstr ktuwLeWET
newobj System.Void Zqovnpwt.Ijgrgdatms::.ctor(System.String,System.String)
stfld Zqovnpwt.Ijgrgdatms Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::invoker
dup <null>
ldloc.0 <null>
ldftn System.Void Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::<Main>b__1(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Zqovnpwt.Yfgilx::add_DownloadCompleted(System.Action`1<System.IO.MemoryStream>)
ldloc.0 <null>
ldfld Zqovnpwt.Bxbtbmnbv Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::decryptor
ldloc.0 <null>
ldftn System.Void Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::<Main>b__2(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Zqovnpwt.Bxbtbmnbv::add_DecryptionCompleted(System.Action`1<System.IO.MemoryStream>)
ldloc.0 <null>
ldfld Zqovnpwt.Pchiubmn Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::loader
ldloc.0 <null>
ldftn System.Void Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::<Main>b__3(System.Reflection.Assembly)
newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Zqovnpwt.Pchiubmn::add_LoadCompleted(System.Action`1<System.Reflection.Assembly>)
ldloc.0 <null>
ldfld Zqovnpwt.Ijgrgdatms Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::invoker
ldsfld System.Action Zqovnpwt.Ighuqi/<>c::<>9__0_4
dup <null>
brtrue.s IL_00C8: callvirt System.Void Zqovnpwt.Ijgrgdatms::add_InvocationCompleted(System.Action)
pop <null>
ldsfld Zqovnpwt.Ighuqi/<>c Zqovnpwt.Ighuqi/<>c::<>9
ldftn System.Void Zqovnpwt.Ighuqi/<>c::<Main>b__0_4()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Zqovnpwt.Ighuqi/<>c::<>9__0_4
callvirt System.Void Zqovnpwt.Ijgrgdatms::add_InvocationCompleted(System.Action)
callvirt System.Void Zqovnpwt.Yfgilx::Dzstekdz()
ret <null>
Module Name
Tngdtqcpztn
Full Name
Tngdtqcpztn
EntryPoint
System.Void Zqovnpwt.Ighuqi::Main()
Scope Name
Tngdtqcpztn
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tngdtqcpztn
Assembly Version
1.0.1305.19748
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
48
Main Method
System.Void Zqovnpwt.Ighuqi::Main()
Main IL Instruction Count
60
Main IL 
newobj System.Void Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::.ctor()
stloc.0 <null>
ldstr L6gogEhk6AKGNPA4Bxj8BQ==
stloc.1 <null>
ldstr bJB83o00iXk=
stloc.2 <null>
ldsfld System.Func`1<System.Byte[]> Zqovnpwt.Ighuqi/<>c::<>9__0_0
dup <null>
brtrue.s IL_0031: newobj System.Void Zqovnpwt.Yfgilx::.ctor(System.Func`1<System.Byte[]>)
pop <null>
ldsfld Zqovnpwt.Ighuqi/<>c Zqovnpwt.Ighuqi/<>c::<>9
ldftn System.Byte[] Zqovnpwt.Ighuqi/<>c::<Main>b__0_0()
newobj System.Void System.Func`1<System.Byte[]>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Byte[]> Zqovnpwt.Ighuqi/<>c::<>9__0_0
newobj System.Void Zqovnpwt.Yfgilx::.ctor(System.Func`1<System.Byte[]>)
ldloc.0 <null>
ldloc.1 <null>
ldloc.2 <null>
newobj System.Void Zqovnpwt.Bxbtbmnbv::.ctor(System.String,System.String)
stfld Zqovnpwt.Bxbtbmnbv Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::decryptor
ldloc.0 <null>
newobj System.Void Zqovnpwt.Pchiubmn::.ctor()
stfld Zqovnpwt.Pchiubmn Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::loader
ldloc.0 <null>
ldstr jwte4Uvl6Em5Fqhc5N.eegVHjOdHgka2HgfZG
ldstr ktuwLeWET
newobj System.Void Zqovnpwt.Ijgrgdatms::.ctor(System.String,System.String)
stfld Zqovnpwt.Ijgrgdatms Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::invoker
dup <null>
ldloc.0 <null>
ldftn System.Void Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::<Main>b__1(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Zqovnpwt.Yfgilx::add_DownloadCompleted(System.Action`1<System.IO.MemoryStream>)
ldloc.0 <null>
ldfld Zqovnpwt.Bxbtbmnbv Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::decryptor
ldloc.0 <null>
ldftn System.Void Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::<Main>b__2(System.IO.MemoryStream)
newobj System.Void System.Action`1<System.IO.MemoryStream>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Zqovnpwt.Bxbtbmnbv::add_DecryptionCompleted(System.Action`1<System.IO.MemoryStream>)
ldloc.0 <null>
ldfld Zqovnpwt.Pchiubmn Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::loader
ldloc.0 <null>
ldftn System.Void Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::<Main>b__3(System.Reflection.Assembly)
newobj System.Void System.Action`1<System.Reflection.Assembly>::.ctor(System.Object,System.IntPtr)
callvirt System.Void Zqovnpwt.Pchiubmn::add_LoadCompleted(System.Action`1<System.Reflection.Assembly>)
ldloc.0 <null>
ldfld Zqovnpwt.Ijgrgdatms Zqovnpwt.Ighuqi/<>c__DisplayClass0_0::invoker
ldsfld System.Action Zqovnpwt.Ighuqi/<>c::<>9__0_4
dup <null>
brtrue.s IL_00C8: callvirt System.Void Zqovnpwt.Ijgrgdatms::add_InvocationCompleted(System.Action)
pop <null>
ldsfld Zqovnpwt.Ighuqi/<>c Zqovnpwt.Ighuqi/<>c::<>9
ldftn System.Void Zqovnpwt.Ighuqi/<>c::<Main>b__0_4()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Zqovnpwt.Ighuqi/<>c::<>9__0_4
callvirt System.Void Zqovnpwt.Ijgrgdatms::add_InvocationCompleted(System.Action)
callvirt System.Void Zqovnpwt.Yfgilx::Dzstekdz()
ret <null>
95ca11ff00293585dca9c0109a408f66
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Zqovnpwt.Properties.Resources.resources
Pxcdegskx
ILRepack.List
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙