Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
HQR data file
Symbol obfuscation
Very high
1 malicious · 5 files
EXEa15c75786052dd28f6b6c0368694a402
Structure
Name Value
Module Name
Kxmzjwaijhq.exe
Full Name
Kxmzjwaijhq.exe
EntryPoint
System.Void Kxmzjwaijhq.Lrnxemnqduu::Main()
Scope Name
Kxmzjwaijhq.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Kxmzjwaijhq
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
39
Main Method
System.Void Kxmzjwaijhq.Lrnxemnqduu::Main()
Main IL Instruction Count
101
Main IL 
ldc.i4 1
stloc V_0
br IL_000E: ldloc V_0
ldloc V_0
switch dnlib.DotNet.Emit.Instruction[]
br IL_01AC: br IL_0168
nop <null>
call System.Byte[] Kxmzjwaijhq.Properties.Qgfjafekvra::get_Pgfvp()
ldsfld System.Object BLfKwJVTJBYuSlEOAV.wJSQOvk9f6TA9ZJ3Gw::JCS3bfu5A
ldsfld System.Object BLfKwJVTJBYuSlEOAV.wJSQOvk9f6TA9ZJ3Gw::SPYPLghPu
call System.Byte[] rh3lqs0Tri8wPpTcLF.iR7XA4hDbDfC4r3UNH::BRXf3JPs9(System.Object,System.Object,System.Object)
call System.Byte[] a4U7bDrUhRQmqKPdnQ.ktd8yoJaLcp6WSo9PR::IhDYgRVJf(System.Object)
ldc.i4 -2122128752
ldc.i4 -416273710
xor <null>
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_1f6efbd4e3834dd489bca932ab82f2db
xor <null>
call System.String EddH2WO4N64OWm1jNF.YDeEFeWB9uiu0rhOqe::k5IGer5QcI(System.Int32)
ldc.i4 -180610338
ldc.i4 455125183
sub <null>
ldc.i4 -361020450
xor <null>
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_368e5816258d43cdac1f6b8e65af3036
xor <null>
call System.String EddH2WO4N64OWm1jNF.YDeEFeWB9uiu0rhOqe::k5IGer5QcI(System.Int32)
call System.Void VsFDrcSuSgFodicn48.yt7Opp6lfKCMcrNj4f::WbG7QGUBD(System.Object,System.Object,System.Object)
ldc.i4 1
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_6c3dc061fe5e4a94826f889b26248be8
brtrue IL_00AE: switch(IL_00E4,IL_00C0)
pop <null>
ldc.i4 0
br IL_00AE: switch(IL_00E4,IL_00C0)
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
br IL_00E4: leave IL_0167
br IL_00E4: leave IL_0167
ldc.i4 0
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_43ca53445a1a4f01b88153a09f3405d6
brtrue IL_00AE: switch(IL_00E4,IL_00C0)
pop <null>
ldc.i4 0
br IL_00AE: switch(IL_00E4,IL_00C0)
leave IL_0167: ret
pop <null>
ldc.i4 0
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_9fe26a4fbe024979a140c3fa951c6ba4
brtrue IL_010D: switch(IL_011F,IL_0143)
pop <null>
ldc.i4 0
br IL_010D: switch(IL_011F,IL_0143)
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_011F: br IL_0143
br IL_0143: leave IL_0167
ldc.i4 1
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_9a785d1927f04b9bbcb1904843fc9788
brfalse IL_010D: switch(IL_011F,IL_0143)
pop <null>
ldc.i4 1
br IL_010D: switch(IL_011F,IL_0143)
leave IL_0167: ret
ldc.i4 2
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_9a785d1927f04b9bbcb1904843fc9788
brfalse IL_0012: switch(IL_01AC,IL_0188,IL_01D0,IL_0030,IL_0167)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_01AC,IL_0188,IL_01D0,IL_0030,IL_0167)
ret <null>
nop <null>
ldc.i4 3
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_5c656a2182164c4f9c12eb99d67b3839
brtrue IL_0012: switch(IL_01AC,IL_0188,IL_01D0,IL_0030,IL_0167)
pop <null>
ldc.i4 3
br IL_0012: switch(IL_01AC,IL_0188,IL_01D0,IL_0030,IL_0167)
call System.Void WnOAa4jFV77HLxtmNXr.kYHy5MjOLmYcHfwxy3D::kLjw4iIsCLsZtxc4lksN0j()
ldc.i4 0
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_9879c1fc553b4235a72d0767646779ea
brtrue IL_0012: switch(IL_01AC,IL_0188,IL_01D0,IL_0030,IL_0167)
pop <null>
ldc.i4 0
br IL_0012: switch(IL_01AC,IL_0188,IL_01D0,IL_0030,IL_0167)
br IL_0168: nop
ldc.i4 4
ldsfld <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6} <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_c2df92d17f1947e59b23a5865dde07f5
ldfld System.Int32 <Module>{9f3316c0-0b2a-41a0-abcb-5acaecd40ba6}::m_d721baeba2ac45c9b1221ec059e9131d
brfalse IL_0012: switch(IL_01AC,IL_0188,IL_01D0,IL_0030,IL_0167)
pop <null>
ldc.i4 2
br IL_0012: switch(IL_01AC,IL_0188,IL_01D0,IL_0030,IL_0167)
br IL_0167: ret
An error has occurred. This application may no longer respond until reloaded. Reload 🗙