Suspicious
Suspect

PE Executable
MD5: a64b88886eb159809acf533b4ffd23df
Size: 1.28 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 a64b88886eb159809acf533b4ffd23df
Sha1 5658db16e8b944ce20fb293617e26caed77cb687
Sha256 a2b77c33ea165b0a7b753e41a7b9bc0c626cc323feb031203cf3d52e3f750f9c
Sha384 7d67e7db049f38e878bdbe88818a756e28e166509d66e6b7a8dd00de23479e53b590792e8c1d01813c3bb2ea46aafdba
Sha512 ed904a5f6d7ba0585ee1fccf4b942c885e4c00314485f2d757fb820e62860eab4c4088bd9d6b865dddaeea0fd482113492f2a774b45a006b04f404de5dd14c3d
SSDeep 12288:zkiAJBBfe7MYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BrgbkNEQCvoGFvxGtY:4toAPCmQui1rBgc+90HEQCvoGF4Y
TLSH ED45CF2D368F495CD5A1DB788F333BD41770C47658F2D35ABF8C5378A62A6E09A8C242
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a64b88886eb159809acf533b4ffd23df
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Tfa1j5bQmC3.Resources.resources
Tfa1j5bQmC3.g.resources
3544b283ae0338.Resources.resources
6146f6340
[NBF]root.Data
6146f6341
[NBF]root.Data
6146f63410
[NBF]root.Data
6146f63411
[NBF]root.Data
6146f63412
[NBF]root.Data
6146f63413
[NBF]root.Data
6146f63414
[NBF]root.Data
6146f63415
[NBF]root.Data
6146f63416
[NBF]root.Data
6146f63417
[NBF]root.Data
6146f63418
[NBF]root.Data
6146f63419
[NBF]root.Data
6146f6342
[NBF]root.Data
6146f63420
[NBF]root.Data
6146f6343
[NBF]root.Data
6146f6344
[NBF]root.Data
6146f6345
[NBF]root.Data
6146f6346
[NBF]root.Data
6146f6347
[NBF]root.Data
6146f6348
[NBF]root.Data
6146f6349
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Tfa1j5bQmC3
Full Name
Tfa1j5bQmC3
EntryPoint
System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
Scope Name
Tfa1j5bQmC3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tfa1j5bQmC3
Assembly Version
23.21.5.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
Main IL Instruction Count
201
Main IL 
ldsfld System.Byte[] gk6Ym7Lno.6xdKcyX3w8w::sPb7Z2foyJ
stloc.s V_12
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0010: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0050: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.2 <null>
stloc.s V_11
br.s IL_0013: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.3 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B8: ldc.i4.2
ldc.i4.s 10
stloc.s V_11
br IL_0013: ldloc.s V_11
ldc.i4.2 <null>
br.s IL_00B1: stloc.s V_11
nop <null>
ldtoken Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz/rAm8Ex3i1zzL.oWy9pc
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296839016
ldc.i4.7 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object rz5Y7Wkam3iXx.6RryA_::ag7L4(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.1 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void Psm5iS8w6gC.2jfDsMq8g3C::8tbQrnD63zcZn(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0111: ldloc.s V_12
ldc.i4.8 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_12
ldc.i4 278
ldelem.u1 <null>
ldc.i4 183
sub <null>
br.s IL_010A: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4.s 85
ldc.i4.5 <null>
ldc.i4 237390300
ldc.i4.4 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.0 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
nop <null>
ldc.i4 161
ldc.i4.4 <null>
ldc.i4 237390301
ldc.i4.s 12
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.7 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
ldloc.s V_5
nop <null>
ldtoken rz5Y7Wkam3iXx.6RryA_/1Babk6gNrpP.4KdnitD92
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296838982
ldc.i4.6 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.s 12
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
leave IL_025A: br.s IL_025C
br.s IL_019B: br.s IL_019D
br.s IL_019D: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_01A8: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_14
ldloc.s V_14
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01CC: nop
nop <null>
nop <null>
ldc.i4.s 87
ldc.i4.4 <null>
ldc.i4 237390301
ldc.i4.6 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
nop <null>
ldtoken rz5Y7Wkam3iXx.6RryA_/zm7LK.Tj6n0seRE4ckq
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296839022
ldc.i4.1 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.5 <null>
stloc.s V_14
br.s IL_01AB: ldloc.s V_14
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.s 29
ldc.i4.8 <null>
ldc.i4 1453910238
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/Lj3mbBm41b.Da2s9kyWB1mi8::wd2Hq7PpGsd5(System.Char,System.Int32,System.Int32)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_0230: br.s IL_0232
br.s IL_0221: br.s IL_0223
br.s IL_0223: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0230: br.s IL_0232
br.s IL_0232: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_16
ldloc.s V_16
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0252: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_025A: br.s IL_025C
br.s IL_025C: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_18
ldloc.s V_18
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_027C: nop
nop <null>
ret <null>
ldtoken System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
pop <null>
ret <null>
Module Name
Tfa1j5bQmC3
Full Name
Tfa1j5bQmC3
EntryPoint
System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
Scope Name
Tfa1j5bQmC3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tfa1j5bQmC3
Assembly Version
23.21.5.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
Main IL Instruction Count
201
Main IL 
ldsfld System.Byte[] gk6Ym7Lno.6xdKcyX3w8w::sPb7Z2foyJ
stloc.s V_12
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0010: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0050: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.2 <null>
stloc.s V_11
br.s IL_0013: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.3 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B8: ldc.i4.2
ldc.i4.s 10
stloc.s V_11
br IL_0013: ldloc.s V_11
ldc.i4.2 <null>
br.s IL_00B1: stloc.s V_11
nop <null>
ldtoken Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz/rAm8Ex3i1zzL.oWy9pc
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296839016
ldc.i4.7 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object rz5Y7Wkam3iXx.6RryA_::ag7L4(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.1 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void Psm5iS8w6gC.2jfDsMq8g3C::8tbQrnD63zcZn(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0111: ldloc.s V_12
ldc.i4.8 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_12
ldc.i4 278
ldelem.u1 <null>
ldc.i4 183
sub <null>
br.s IL_010A: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4.s 85
ldc.i4.5 <null>
ldc.i4 237390300
ldc.i4.4 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.0 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
nop <null>
ldc.i4 161
ldc.i4.4 <null>
ldc.i4 237390301
ldc.i4.s 12
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.7 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
ldloc.s V_5
nop <null>
ldtoken rz5Y7Wkam3iXx.6RryA_/1Babk6gNrpP.4KdnitD92
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296838982
ldc.i4.6 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.s 12
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
leave IL_025A: br.s IL_025C
br.s IL_019B: br.s IL_019D
br.s IL_019D: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_01A8: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_14
ldloc.s V_14
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01CC: nop
nop <null>
nop <null>
ldc.i4.s 87
ldc.i4.4 <null>
ldc.i4 237390301
ldc.i4.6 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
nop <null>
ldtoken rz5Y7Wkam3iXx.6RryA_/zm7LK.Tj6n0seRE4ckq
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296839022
ldc.i4.1 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.5 <null>
stloc.s V_14
br.s IL_01AB: ldloc.s V_14
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.s 29
ldc.i4.8 <null>
ldc.i4 1453910238
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/Lj3mbBm41b.Da2s9kyWB1mi8::wd2Hq7PpGsd5(System.Char,System.Int32,System.Int32)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_0230: br.s IL_0232
br.s IL_0221: br.s IL_0223
br.s IL_0223: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0230: br.s IL_0232
br.s IL_0232: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_16
ldloc.s V_16
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0252: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_025A: br.s IL_025C
br.s IL_025C: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_18
ldloc.s V_18
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_027C: nop
nop <null>
ret <null>
ldtoken System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
pop <null>
ret <null>
a64b88886eb159809acf533b4ffd23df
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Tfa1j5bQmC3.Resources.resources
Tfa1j5bQmC3.g.resources
3544b283ae0338.Resources.resources
6146f6340
[NBF]root.Data
6146f6341
[NBF]root.Data
6146f63410
[NBF]root.Data
6146f63411
[NBF]root.Data
6146f63412
[NBF]root.Data
6146f63413
[NBF]root.Data
6146f63414
[NBF]root.Data
6146f63415
[NBF]root.Data
6146f63416
[NBF]root.Data
6146f63417
[NBF]root.Data
6146f63418
[NBF]root.Data
6146f63419
[NBF]root.Data
6146f6342
[NBF]root.Data
6146f63420
[NBF]root.Data
6146f6343
[NBF]root.Data
6146f6344
[NBF]root.Data
6146f6345
[NBF]root.Data
6146f6346
[NBF]root.Data
6146f6347
[NBF]root.Data
6146f6348
[NBF]root.Data
6146f6349
[NBF]root.Data
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙