Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5: a64b88886eb159809acf533b4ffd23df
Size: 1.28 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 a64b88886eb159809acf533b4ffd23df
Sha1 5658db16e8b944ce20fb293617e26caed77cb687
Sha256 a2b77c33ea165b0a7b753e41a7b9bc0c626cc323feb031203cf3d52e3f750f9c
Sha384 7d67e7db049f38e878bdbe88818a756e28e166509d66e6b7a8dd00de23479e53b590792e8c1d01813c3bb2ea46aafdba
Sha512 ed904a5f6d7ba0585ee1fccf4b942c885e4c00314485f2d757fb820e62860eab4c4088bd9d6b865dddaeea0fd482113492f2a774b45a006b04f404de5dd14c3d
SSDeep 12288:zkiAJBBfe7MYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BrgbkNEQCvoGFvxGtY:4toAPCmQui1rBgc+90HEQCvoGF4Y
TLSH ED45CF2D368F495CD5A1DB788F333BD41770C47658F2D35ABF8C5378A62A6E09A8C242
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
a64b88886eb159809acf533b4ffd23df
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
Tfa1j5bQmC3.Resources.resources
Tfa1j5bQmC3.g.resources
3544b283ae0338.Resources.resources
6146f6340
[NBF]root.Data
6146f6341
[NBF]root.Data
6146f63410
[NBF]root.Data
6146f63411
[NBF]root.Data
6146f63412
[NBF]root.Data
6146f63413
[NBF]root.Data
6146f63414
[NBF]root.Data
6146f63415
[NBF]root.Data
6146f63416
[NBF]root.Data
6146f63417
[NBF]root.Data
6146f63418
[NBF]root.Data
6146f63419
[NBF]root.Data
6146f6342
[NBF]root.Data
6146f63420
[NBF]root.Data
6146f6343
[NBF]root.Data
6146f6344
[NBF]root.Data
6146f6345
[NBF]root.Data
6146f6346
[NBF]root.Data
6146f6347
[NBF]root.Data
6146f6348
[NBF]root.Data
6146f6349
[NBF]root.Data
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Tfa1j5bQmC3
Full Name
Tfa1j5bQmC3
EntryPoint
System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
Scope Name
Tfa1j5bQmC3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tfa1j5bQmC3
Assembly Version
23.21.5.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
Main IL Instruction Count
201
Main IL 
ldsfld System.Byte[] gk6Ym7Lno.6xdKcyX3w8w::sPb7Z2foyJ
stloc.s V_12
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0010: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0050: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.2 <null>
stloc.s V_11
br.s IL_0013: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.3 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B8: ldc.i4.2
ldc.i4.s 10
stloc.s V_11
br IL_0013: ldloc.s V_11
ldc.i4.2 <null>
br.s IL_00B1: stloc.s V_11
nop <null>
ldtoken Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz/rAm8Ex3i1zzL.oWy9pc
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296839016
ldc.i4.7 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object rz5Y7Wkam3iXx.6RryA_::ag7L4(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.1 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void Psm5iS8w6gC.2jfDsMq8g3C::8tbQrnD63zcZn(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0111: ldloc.s V_12
ldc.i4.8 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_12
ldc.i4 278
ldelem.u1 <null>
ldc.i4 183
sub <null>
br.s IL_010A: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4.s 85
ldc.i4.5 <null>
ldc.i4 237390300
ldc.i4.4 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.0 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
nop <null>
ldc.i4 161
ldc.i4.4 <null>
ldc.i4 237390301
ldc.i4.s 12
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.7 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
ldloc.s V_5
nop <null>
ldtoken rz5Y7Wkam3iXx.6RryA_/1Babk6gNrpP.4KdnitD92
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296838982
ldc.i4.6 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.s 12
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
leave IL_025A: br.s IL_025C
br.s IL_019B: br.s IL_019D
br.s IL_019D: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_01A8: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_14
ldloc.s V_14
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01CC: nop
nop <null>
nop <null>
ldc.i4.s 87
ldc.i4.4 <null>
ldc.i4 237390301
ldc.i4.6 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
nop <null>
ldtoken rz5Y7Wkam3iXx.6RryA_/zm7LK.Tj6n0seRE4ckq
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296839022
ldc.i4.1 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.5 <null>
stloc.s V_14
br.s IL_01AB: ldloc.s V_14
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.s 29
ldc.i4.8 <null>
ldc.i4 1453910238
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/Lj3mbBm41b.Da2s9kyWB1mi8::wd2Hq7PpGsd5(System.Char,System.Int32,System.Int32)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_0230: br.s IL_0232
br.s IL_0221: br.s IL_0223
br.s IL_0223: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0230: br.s IL_0232
br.s IL_0232: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_16
ldloc.s V_16
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0252: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_025A: br.s IL_025C
br.s IL_025C: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_18
ldloc.s V_18
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_027C: nop
nop <null>
ret <null>
ldtoken System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
pop <null>
ret <null>
Module Name
Tfa1j5bQmC3
Full Name
Tfa1j5bQmC3
EntryPoint
System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
Scope Name
Tfa1j5bQmC3
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Tfa1j5bQmC3
Assembly Version
23.21.5.2
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.6
Total Strings
0
Main Method
System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
Main IL Instruction Count
201
Main IL 
ldsfld System.Byte[] gk6Ym7Lno.6xdKcyX3w8w::sPb7Z2foyJ
stloc.s V_12
nop <null>
call System.Boolean System.Diagnostics.Debugger::get_IsAttached()
stloc.0 <null>
br.s IL_0010: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_11
ldloc.s V_11
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0050: nop
nop <null>
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
nop <null>
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
nop <null>
ldc.r8 0
stloc.1 <null>
ldc.i4.0 <null>
stloc.s V_6
ldc.i4.2 <null>
stloc.s V_11
br.s IL_0013: ldloc.s V_11
ldloc.1 <null>
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.01
mul <null>
call System.Double System.Math::Sin(System.Double)
ldloc.s V_6
conv.r8 <null>
ldc.r8 0.015
mul <null>
call System.Double System.Math::Cos(System.Double)
mul <null>
add <null>
stloc.1 <null>
ldc.i4.3 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_6
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_6
ldloc.s V_6
ldc.i4 5000
ble.s IL_00B8: ldc.i4.2
ldc.i4.s 10
stloc.s V_11
br IL_0013: ldloc.s V_11
ldc.i4.2 <null>
br.s IL_00B1: stloc.s V_11
nop <null>
ldtoken Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz/rAm8Ex3i1zzL.oWy9pc
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296839016
ldc.i4.7 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
stloc.2 <null>
ldc.i4 214
stloc.3 <null>
ldloc.3 <null>
call System.Object rz5Y7Wkam3iXx.6RryA_::ag7L4(System.Int32)
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_4
ldc.i4.1 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_4
castclass System.Byte[]
call System.Void Psm5iS8w6gC.2jfDsMq8g3C::8tbQrnD63zcZn(System.Byte[])
nop <null>
ldloc.2 <null>
call System.Boolean System.Diagnostics.EventLog::SourceExists(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.s V_7
ldloc.s V_7
brfalse.s IL_0111: ldloc.s V_12
ldc.i4.8 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
ldloc.s V_12
ldc.i4 278
ldelem.u1 <null>
ldc.i4 183
sub <null>
br.s IL_010A: stloc.s V_11
ldloc.2 <null>
nop <null>
ldc.i4.s 85
ldc.i4.5 <null>
ldc.i4 237390300
ldc.i4.4 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
call System.Void System.Diagnostics.EventLog::CreateEventSource(System.String,System.String)
nop <null>
nop <null>
ldc.i4.0 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
nop <null>
ldc.i4 161
ldc.i4.4 <null>
ldc.i4 237390301
ldc.i4.s 12
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
ldloc.2 <null>
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.7 <null>
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
ldloc.s V_5
nop <null>
ldtoken rz5Y7Wkam3iXx.6RryA_/1Babk6gNrpP.4KdnitD92
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296838982
ldc.i4.6 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
ldc.i4.4 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
ldc.i4.s 12
stloc.s V_11
br IL_0013: ldloc.s V_11
nop <null>
leave IL_025A: br.s IL_025C
br.s IL_019B: br.s IL_019D
br.s IL_019D: dup
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
nop <null>
br.s IL_01A8: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_14
ldloc.s V_14
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_01CC: nop
nop <null>
nop <null>
ldc.i4.s 87
ldc.i4.4 <null>
ldc.i4 237390301
ldc.i4.6 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/pn9BjGg23bSckD.sq2Ak9::Ko7ari(System.Char,System.Int32,System.Int32,System.Int32)
newobj System.Void System.Diagnostics.EventLog::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
nop <null>
ldtoken rz5Y7Wkam3iXx.6RryA_/zm7LK.Tj6n0seRE4ckq
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
ldc.i4 1296839022
ldc.i4.1 <null>
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3::2Jojr(System.Type,System.Int32,System.Int32)
callvirt System.Void System.Diagnostics.EventLog::set_Source(System.String)
ldc.i4.5 <null>
stloc.s V_14
br.s IL_01AB: ldloc.s V_14
nop <null>
ldloc.s V_9
nop <null>
ldc.i4.s 29
ldc.i4.8 <null>
ldc.i4 1453910238
call System.String 4mpMeE6c3atHf.5BzwZjg2bx6M8N/oZr3i2TmaEg9M.Mi9n3/Lj3mbBm41b.Da2s9kyWB1mi8::wd2Hq7PpGsd5(System.Char,System.Int32,System.Int32)
ldc.i4.2 <null>
callvirt System.Void System.Diagnostics.EventLog::WriteEntry(System.String,System.Diagnostics.EventLogEntryType)
nop <null>
leave.s IL_0230: br.s IL_0232
br.s IL_0221: br.s IL_0223
br.s IL_0223: call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0230: br.s IL_0232
br.s IL_0232: ldc.i4.2
ldc.i4.2 <null>
stloc.s V_16
ldloc.s V_16
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_0252: nop
nop <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_025A: br.s IL_025C
br.s IL_025C: ldc.i4.4
ldc.i4.4 <null>
stloc.s V_18
ldloc.s V_18
switch dnlib.DotNet.Emit.Instruction[]
br.s IL_027C: nop
nop <null>
ret <null>
ldtoken System.Void Psm5iS8w6gC.2jfDsMq8g3C/3Razmm.0dtRA1cz::2QpeHj8s9C()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙