Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: 9898b1c4dd84e3820c2a0dd239e204be
Size: 715.26 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 9898b1c4dd84e3820c2a0dd239e204be
Sha1 c865d8e2212b7f111d72f2b295061fe7f0a7baa3
Sha256 829fad413d5103822bc05f8cbf726203d8a57be3da077e0deaa3a901b6be1efa
Sha384 1c1341fcd2b7e955ff5f28ef7499f3d5059af11a1036624d7cd883ab570a62fc05cac791270419243a59b6a7cd4e01b9
Sha512 fa9f609e167d85cd912c0ce31be68389d626f574becef0a8b8af796c44d174194a43fb7a956ac5584598a29ca958c843a59f7b4f4ecadc7617b95eb68acb86f3
SSDeep 12288:2ArMDSNgFd/GxkAlJX5kcu+FdX1uxwWFEJqqvqHC54:lFgb/GiAljl1uxwWAqZw4
TLSH ADE47B6123E85F18F5BFAB396570010147F6FC16DF22DB9D3E9468DA2831E80C962B63
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
9898b1c4dd84e3820c2a0dd239e204be
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0032
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
Ginaporizan.6813905.png
bTk89m.Resources.resources
8b951de6d75f7f.Resources.resources
718aa0820
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
bTk89m
Full Name
bTk89m
EntryPoint
System.Void bTk89m.Sw2b8kqNq::iXy6f3T()
Scope Name
bTk89m
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bTk89m
Assembly Version
15.2.22.297
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1713
Main Method
System.Void bTk89m.Sw2b8kqNq::iXy6f3T()
Main IL Instruction Count
102
Main IL 
nop <null>
nop <null>
ldloc.0 <null>
newobj System.Void bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::.ctor(bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.s 24
clt <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0028: ldc.i4.1
ldloc.0 <null>
ldc.i4.s 24
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
conv.r8 <null>
ldc.r8 24
div <null>
call System.Double System.Math::Ceiling(System.Double)
ldc.r8 1
add <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Range(System.Int32,System.Int32)
ldsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
brfalse.s IL_0062: ldsfld bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::eFn9xp3Kn7Ba
ldsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
br.s IL_0078: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::eFn9xp3Kn7Ba
ldftn System.Int32 bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::4Ao_k5Ke0w(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
call System.Int32[] System.Linq.Enumerable::ToArray<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.1 <null>
ldloc.0 <null>
ldloc.1 <null>
ldloc.0 <null>
ldftn System.Boolean bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::6yiSy5FjCa(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
call System.Int32 System.Linq.Enumerable::First<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.2 <null>
sub.ovf <null>
stloc.s V_5
ldc.i4.0 <null>
stloc.s V_6
br.s IL_00C5: ldloc.s V_6
ldloc.2 <null>
ldloc.s V_6
ldnull <null>
stelem.ref <null>
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldloc.s V_5
ble.s IL_00BA: ldloc.2
ldstr gnp.5093186
call System.String Microsoft.VisualBasic.Strings::StrReverse(System.String)
stloc.3 <null>
ldloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
sub.ovf <null>
ldloc.3 <null>
call System.Byte[] bTk89m.8Bwimy5G1Pqo_3::7dxZE3fctMa4(System.Object)
call System.Byte[] bTk89m.2gfNA8actx1Yy6::2XgrapP0fR8jn(System.Byte[])
stelem.ref <null>
ldloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
call System.Void bTk89m.sGn8px7AF2::Qf1jcrX8R(System.Object[],System.Int32)
nop <null>
leave.s IL_010A: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_010A: nop
nop <null>
ret <null>
Module Name
bTk89m
Full Name
bTk89m
EntryPoint
System.Void bTk89m.Sw2b8kqNq::iXy6f3T()
Scope Name
bTk89m
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
bTk89m
Assembly Version
15.2.22.297
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
1713
Main Method
System.Void bTk89m.Sw2b8kqNq::iXy6f3T()
Main IL Instruction Count
102
Main IL 
nop <null>
nop <null>
ldloc.0 <null>
newobj System.Void bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::.ctor(bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS)
stloc.0 <null>
ldloc.0 <null>
ldc.i4.1 <null>
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.s 24
clt <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0028: ldc.i4.1
ldloc.0 <null>
ldc.i4.s 24
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
conv.r8 <null>
ldc.r8 24
div <null>
call System.Double System.Math::Ceiling(System.Double)
ldc.r8 1
add <null>
call System.Double System.Math::Round(System.Double)
conv.ovf.i4 <null>
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Range(System.Int32,System.Int32)
ldsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
brfalse.s IL_0062: ldsfld bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::eFn9xp3Kn7Ba
ldsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
br.s IL_0078: call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
ldsfld bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::eFn9xp3Kn7Ba
ldftn System.Int32 bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::4Ao_k5Ke0w(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Int32>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`2<System.Int32,System.Int32> bTk89m.Sw2b8kqNq/0HdqMi6.qXy2_a1E::7bbMrK5m
call System.Collections.Generic.IEnumerable`1<System.Int32> System.Linq.Enumerable::Select<System.Int32,System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Int32>)
call System.Int32[] System.Linq.Enumerable::ToArray<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>)
stloc.1 <null>
ldloc.0 <null>
ldloc.1 <null>
ldloc.0 <null>
ldftn System.Boolean bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::6yiSy5FjCa(System.Int32)
newobj System.Void System.Func`2<System.Int32,System.Boolean>::.ctor(System.Object,System.IntPtr)
call System.Int32 System.Linq.Enumerable::First<System.Int32>(System.Collections.Generic.IEnumerable`1<System.Int32>,System.Func`2<System.Int32,System.Boolean>)
stfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
sub.ovf <null>
ldc.i4.1 <null>
add.ovf <null>
newarr System.Object
stloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.2 <null>
sub.ovf <null>
stloc.s V_5
ldc.i4.0 <null>
stloc.s V_6
br.s IL_00C5: ldloc.s V_6
ldloc.2 <null>
ldloc.s V_6
ldnull <null>
stelem.ref <null>
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldloc.s V_5
ble.s IL_00BA: ldloc.2
ldstr gnp.5093186
call System.String Microsoft.VisualBasic.Strings::StrReverse(System.String)
stloc.3 <null>
ldloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
ldc.i4.1 <null>
sub.ovf <null>
ldloc.3 <null>
call System.Byte[] bTk89m.8Bwimy5G1Pqo_3::7dxZE3fctMa4(System.Object)
call System.Byte[] bTk89m.2gfNA8actx1Yy6::2XgrapP0fR8jn(System.Byte[])
stelem.ref <null>
ldloc.2 <null>
ldloc.0 <null>
ldfld System.Int32 bTk89m.Sw2b8kqNq/pi6KE2.3Zbsd0oS::Gkg92Dtdjr5Y
call System.Void bTk89m.sGn8px7AF2::Qf1jcrX8R(System.Object[],System.Int32)
nop <null>
leave.s IL_010A: nop
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_010A: nop
nop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙