Suspicious
Suspect

PE Executable
MD5: 9898b1c4dd84e3820c2a0dd239e204be
Size: 715.26 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 9898b1c4dd84e3820c2a0dd239e204be
Sha1 c865d8e2212b7f111d72f2b295061fe7f0a7baa3
Sha256 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa
Sha384 1c1341fcd2b7e955ff5f28ef7499f3d5059af11a1036624d7cd883ab570a62fc05cac791270419243a59b6a7cd4e01b9
Sha512 fa9f609e167d85cd912c0ce31be68389d626f574becef0a8b8af796c44d174194a43fb7a956ac5584598a29ca958c843a59f7b4f4ecadc7617b95eb68acb86f3
SSDeep 12288:2ArMDSNgFd/GxkAlJX5kcu+FdX1uxwWFEJqqvqHC54:lFgb/GiAljl1uxwWAqZw4
TLSH ADE47B6123E85F18F5BFAB396570010147F6FC16DF22DB9D3E9468DA2831E80C962B63
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
9898b1c4dd84e3820c2a0dd239e204be
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Ginaporizan.6813905.png
bTk89m.Resources.resources
8b951de6d75f7f.Resources.resources
718aa0820
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
bTk89m
Full Name
bTk89m
EntryPoint
System.Void bTk89m.Sw2b8kqNq::iXy6f3T()
Scope Name
bTk89m
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bTk89m
Assembly Version
15.2.22.297
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1713
Main Method
System.Void bTk89m.Sw2b8kqNq::iXy6f3T()
Main IL Instruction Count
102
Main IL 
nop <null>
nop <null>
ldloc.0 <null>
newobj System.Void bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::.ctor(bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.s 24
clt <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0028: ldc.i4.1
ldloc.0 <null>
ldc.i4.s 24
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
conv.r8 <null>
ldc.r8 24
div <null>
call System.Double System.Math::Ceiling(System.Double)
ldc.r8 1
add <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Range(System.Int32,System.Int32)
ldsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
brfalse.s IL_0062: ldsfld bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::eFn9xp3Kn7Ba
ldsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
br.s IL_0078: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::eFn9xp3Kn7Ba
ldftn System.Int32 bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::4Ao_k5Ke0w(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
call System.Int32[] System.Linq.Enumerable::ToArray<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.1 <null>
ldloc.0 <null>
ldloc.1 <null>
ldloc.0 <null>
ldftn System.Boolean bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::6yiSy5FjCa(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
call System.Int32 System.Linq.Enumerable::First<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.2 <null>
sub.ovf <null>
stloc.s V_5
ldc.i4.0 <null>
stloc.s V_6
br.s IL_00C5: ldloc.s V_6
ldloc.2 <null>
ldloc.s V_6
ldnull <null>
stelem.ref <null>
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldloc.s V_5
ble.s IL_00BA: ldloc.2
ldstr gnp.5093186
call System.String Microsoft.VisualBasic.Strings::StrReverse(System.String)
stloc.3 <null>
ldloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
sub.ovf <null>
ldloc.3 <null>
call System.Byte[] bTk89m.8Bwimy5G1Pqo_3::7dxZE3fctMa4(System.Object)
call System.Byte[] bTk89m.2gfNA8actx1Yy6::2XgrapP0fR8jn(System.Byte[])
stelem.ref <null>
ldloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
call System.Void bTk89m.sGn8px7AF2::Qf1jcrX8R(System.Object[],System.Int32)
nop <null>
leave.s IL_010A: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_010A: nop
nop <null>
ret <null>
Module Name
bTk89m
Full Name
bTk89m
EntryPoint
System.Void bTk89m.Sw2b8kqNq::iXy6f3T()
Scope Name
bTk89m
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bTk89m
Assembly Version
15.2.22.297
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1713
Main Method
System.Void bTk89m.Sw2b8kqNq::iXy6f3T()
Main IL Instruction Count
102
Main IL 
nop <null>
nop <null>
ldloc.0 <null>
newobj System.Void bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::.ctor(bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.s 24
clt <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0028: ldc.i4.1
ldloc.0 <null>
ldc.i4.s 24
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
conv.r8 <null>
ldc.r8 24
div <null>
call System.Double System.Math::Ceiling(System.Double)
ldc.r8 1
add <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Range(System.Int32,System.Int32)
ldsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
brfalse.s IL_0062: ldsfld bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::eFn9xp3Kn7Ba
ldsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
br.s IL_0078: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::eFn9xp3Kn7Ba
ldftn System.Int32 bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::4Ao_k5Ke0w(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
call System.Int32[] System.Linq.Enumerable::ToArray<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.1 <null>
ldloc.0 <null>
ldloc.1 <null>
ldloc.0 <null>
ldftn System.Boolean bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::6yiSy5FjCa(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
call System.Int32 System.Linq.Enumerable::First<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.2 <null>
sub.ovf <null>
stloc.s V_5
ldc.i4.0 <null>
stloc.s V_6
br.s IL_00C5: ldloc.s V_6
ldloc.2 <null>
ldloc.s V_6
ldnull <null>
stelem.ref <null>
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldloc.s V_5
ble.s IL_00BA: ldloc.2
ldstr gnp.5093186
call System.String Microsoft.VisualBasic.Strings::StrReverse(System.String)
stloc.3 <null>
ldloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
sub.ovf <null>
ldloc.3 <null>
call System.Byte[] bTk89m.8Bwimy5G1Pqo_3::7dxZE3fctMa4(System.Object)
call System.Byte[] bTk89m.2gfNA8actx1Yy6::2XgrapP0fR8jn(System.Byte[])
stelem.ref <null>
ldloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
call System.Void bTk89m.sGn8px7AF2::Qf1jcrX8R(System.Object[],System.Int32)
nop <null>
leave.s IL_010A: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_010A: nop
nop <null>
ret <null>
9898b1c4dd84e3820c2a0dd239e204be
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Ginaporizan.6813905.png
bTk89m.Resources.resources
8b951de6d75f7f.Resources.resources
718aa0820
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙