Malicious PE Executable analysis – a94766fcd205

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Symbol obfuscation

Very high

1 malicious · 9 files

EXEa94766fcd2059a2cca8e7a5e33b3fc4b

Structure

BINResources

BIN.Net Resources

Name	Value
Module Name	Cpnmfpedxbr.exe
Full Name	Cpnmfpedxbr.exe
EntryPoint	System.Void tq8RdvtRNpq9MxMP6f.VgbCfS8VASO4nD00Rx::mYWux4YNp()
Scope Name	Cpnmfpedxbr.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Cpnmfpedxbr
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void tq8RdvtRNpq9MxMP6f.VgbCfS8VASO4nD00Rx::mYWux4YNp()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_0009: ldloc V_2 br IL_002D: nop nop <null> newobj System.Void Iirl70wvfCC72Ry1mP.CEMphBBjMRBEahuOBb::.ctor() ldsfld ykhGtW7uW0RuTeQ867q ykhGtW7uW0RuTeQ867q::O7Q7yX2TQJ call System.Boolean ykhGtW7uW0RuTeQ867q::REa7791A9q(System.Object,ykhGtW7uW0RuTeQ867q) brtrue IL_0095: leave IL_010C ldc.i4 0 ldsfld <Module>{f6d20844-c9a6-4da5-8b25-af491211448b} <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_b2907f6703724f4fb09e6144708fe4dd ldfld System.Int32 <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_d2fd8235e44a448ba0ab26fd42b41168 brfalse IL_0073: switch(IL_008F) pop <null> ldc.i4 1 br IL_0073: switch(IL_008F) br IL_006F: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_006F: ldloc V_1 br IL_008F: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_010C: ret pop <null> ldc.i4 0 ldsfld <Module>{f6d20844-c9a6-4da5-8b25-af491211448b} <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_b2907f6703724f4fb09e6144708fe4dd ldfld System.Int32 <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_de357a069e98497b87b6b9058b1101da brtrue IL_00CC: switch(IL_00E8) pop <null> ldc.i4 3 br IL_00CC: switch(IL_00E8) br IL_00C8: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_00C8: ldloc V_0 br IL_00E8: leave IL_010C leave IL_010C: ret ldc.i4 0 ldsfld <Module>{f6d20844-c9a6-4da5-8b25-af491211448b} <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_b2907f6703724f4fb09e6144708fe4dd ldfld System.Int32 <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_5b41935d9e5344c9b6503f0cde69e9df brtrue IL_000D: switch(IL_010C,IL_002D) pop <null> ldc.i4 6 br IL_000D: switch(IL_010C,IL_002D) ret <null>
Module Name	Cpnmfpedxbr.exe
Full Name	Cpnmfpedxbr.exe
EntryPoint	System.Void tq8RdvtRNpq9MxMP6f.VgbCfS8VASO4nD00Rx::mYWux4YNp()
Scope Name	Cpnmfpedxbr.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Cpnmfpedxbr
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	43
Main Method	System.Void tq8RdvtRNpq9MxMP6f.VgbCfS8VASO4nD00Rx::mYWux4YNp()
Main IL Instruction Count	58
Main IL	ldc.i4 1 stloc V_2 ldloc V_2 switch dnlib.DotNet.Emit.Instruction[] ldloc V_2 ldc.i4 989 beq IL_0009: ldloc V_2 br IL_002D: nop nop <null> newobj System.Void Iirl70wvfCC72Ry1mP.CEMphBBjMRBEahuOBb::.ctor() ldsfld ykhGtW7uW0RuTeQ867q ykhGtW7uW0RuTeQ867q::O7Q7yX2TQJ call System.Boolean ykhGtW7uW0RuTeQ867q::REa7791A9q(System.Object,ykhGtW7uW0RuTeQ867q) brtrue IL_0095: leave IL_010C ldc.i4 0 ldsfld <Module>{f6d20844-c9a6-4da5-8b25-af491211448b} <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_b2907f6703724f4fb09e6144708fe4dd ldfld System.Int32 <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_d2fd8235e44a448ba0ab26fd42b41168 brfalse IL_0073: switch(IL_008F) pop <null> ldc.i4 1 br IL_0073: switch(IL_008F) br IL_006F: ldloc V_1 ldc.i4 0 stloc V_1 ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] ldloc V_1 ldc.i4 988 beq IL_006F: ldloc V_1 br IL_008F: newobj System.Void System.InvalidOperationException::.ctor() newobj System.Void System.InvalidOperationException::.ctor() throw <null> leave IL_010C: ret pop <null> ldc.i4 0 ldsfld <Module>{f6d20844-c9a6-4da5-8b25-af491211448b} <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_b2907f6703724f4fb09e6144708fe4dd ldfld System.Int32 <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_de357a069e98497b87b6b9058b1101da brtrue IL_00CC: switch(IL_00E8) pop <null> ldc.i4 3 br IL_00CC: switch(IL_00E8) br IL_00C8: ldloc V_0 ldc.i4 0 stloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] ldloc V_0 ldc.i4 988 beq IL_00C8: ldloc V_0 br IL_00E8: leave IL_010C leave IL_010C: ret ldc.i4 0 ldsfld <Module>{f6d20844-c9a6-4da5-8b25-af491211448b} <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_b2907f6703724f4fb09e6144708fe4dd ldfld System.Int32 <Module>{f6d20844-c9a6-4da5-8b25-af491211448b}::m_5b41935d9e5344c9b6503f0cde69e9df brtrue IL_000D: switch(IL_010C,IL_002D) pop <null> ldc.i4 6 br IL_000D: switch(IL_010C,IL_002D) ret <null>