Deep Malware Analysis of 9d82b9408af99a97511ce4f40b04b176 | md5: 9d82b9408af99a97511ce4f40b04b176 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | PDB Path | .Net | SOS: 0.29

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

Name	Value
Info	PE Detect: PeReader OK (file layout)
Info	PDB Path: C:\Users\Izoly\Desktop\NebulaRun\NebulaRun\obj\Release\NebulaRun.pdb
Module Name	NebulaRun.exe
Full Name	NebulaRun.exe
EntryPoint	System.Void NebulaRun.Program::Main()
Scope Name	NebulaRun.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	NebulaRun
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	84
Main Method	System.Void NebulaRun.Program::Main()
Main IL Instruction Count	39
Main IL	call System.AppDomain System.AppDomain::get_CurrentDomain() ldsfld System.ResolveEventHandler NebulaRun.Program/<>c::<>9__0_0 dup <null> brtrue.s IL_0024: callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) pop <null> ldsfld NebulaRun.Program/<>c NebulaRun.Program/<>c::<>9 ldftn System.Reflection.Assembly NebulaRun.Program/<>c::<Main>b__0_0(System.Object,System.ResolveEventArgs) newobj System.Void System.ResolveEventHandler::.ctor(System.Object,System.IntPtr) dup <null> stsfld System.ResolveEventHandler NebulaRun.Program/<>c::<>9__0_0 callvirt System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler) call System.Void NebulaRun.Nbl::EncryptAll() ldnull <null> ldftn System.Threading.Tasks.Task NebulaRun.Program::LoopUsbSpread() newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr) call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>) pop <null> ldnull <null> ldftn System.Threading.Tasks.Task NebulaRun.Program::LoopLANSpread() newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr) call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>) pop <null> ldc.i4 4000 call System.Threading.Tasks.Task System.Threading.Tasks.Task::Delay(System.Int32) pop <null> call System.String NebulaRun.Nbl::GetBase64Key() call System.String NebulaRun.Nbl::GetBase64IV() call System.String NebulaRun.Nbl::get_VictimCode() call System.Threading.Tasks.Task NebulaRun.Send::SendKeyAndIvAsync(System.String,System.String,System.String) callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter() stloc.0 <null> ldloca.s V_0 call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult() call System.Void System.Windows.Forms.Application::EnableVisualStyles() ldc.i4.0 <null> call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean) newobj System.Void NebulaRun.Nbl::.ctor() call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form) ret <null>